1421 files changed, 43086 insertions, 15076 deletions
diff --git a/Documentation/ABI/testing/debugfs-driver-genwqe b/Documentation/ABI/testing/debugfs-driver-genwqe
new file mode 100644
index 000000000000..1c2f25674e8c
--- /dev/null
+++ b/Documentation/ABI/testing/debugfs-driver-genwqe
@@ -0,0 +1,91 @@
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/ddcb_info
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    DDCB queue dump used for debugging queueing problems.
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/curr_regs
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Dump of the current error registers.
+                Only available for PF.
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/curr_dbg_uid0
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Internal chip state of UID0 (unit id 0).
+                Only available for PF.
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/curr_dbg_uid1
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Internal chip state of UID1.
+                Only available for PF.
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/curr_dbg_uid2
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Internal chip state of UID2.
+                Only available for PF.
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/prev_regs
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Dump of the error registers before the last reset of
+                the card occured.
+                Only available for PF.
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/prev_dbg_uid0
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Internal chip state of UID0 before card was reset.
+                Only available for PF.
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/prev_dbg_uid1
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Internal chip state of UID1 before card was reset.
+                Only available for PF.
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/prev_dbg_uid2
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Internal chip state of UID2 before card was reset.
+                Only available for PF.
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/info
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Comprehensive summary of bitstream version and software
+                version. Used bitstream and bitstream clocking information.
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/err_inject
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Possibility to inject error cases to ensure that the drivers
+                error handling code works well.
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/vf<0..14>_jobtimeout_msec
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Default VF timeout 250ms. Testing might require 1000ms.
+                Using 0 will use the cards default value (whatever that is).
+                The timeout depends on the max number of available cards
+                in the system and the maximum allowed queue size.
+                The driver ensures that the settings are done just before
+                the VFs get enabled. Changing the timeouts in flight is not
+                possible.
+                Only available for PF.
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/jobtimer
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Dump job timeout register values for PF and VFs.
+                Only available for PF.
+What:           /sys/kernel/debug/genwqe/genwqe<n>_card/queue_working_time
+Date:           Dec 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Dump queue working time register values for PF and VFs.
+                Only available for PF.
diff --git a/Documentation/ABI/testing/sysfs-driver-genwqe b/Documentation/ABI/testing/sysfs-driver-genwqe
new file mode 100644
index 000000000000..1870737a1f5e
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-driver-genwqe
@@ -0,0 +1,62 @@
+What:           /sys/class/genwqe/genwqe<n>_card/version
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Unique bitstream identification e.g.
+                '0000000330336283.00000000475a4950'.
+What:           /sys/class/genwqe/genwqe<n>_card/appid
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Identifies the currently active card application e.g. 'GZIP'
+                for compression/decompression.
+What:           /sys/class/genwqe/genwqe<n>_card/type
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Type of the card e.g. 'GenWQE5-A7'.
+What:           /sys/class/genwqe/genwqe<n>_card/curr_bitstream
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Currently active bitstream. 1 is default, 0 is backup.
+What:           /sys/class/genwqe/genwqe<n>_card/next_bitstream
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Interface to set the next bitstream to be used.
+What:           /sys/class/genwqe/genwqe<n>_card/tempsens
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Interface to read the cards temperature sense register.
+What:           /sys/class/genwqe/genwqe<n>_card/freerunning_timer
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Interface to read the cards free running timer.
+                Used for performance and utilization measurements.
+What:           /sys/class/genwqe/genwqe<n>_card/queue_working_time
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Interface to read queue working time.
+                Used for performance and utilization measurements.
+What:           /sys/class/genwqe/genwqe<n>_card/state
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    State of the card: "unused", "used", "error".
+What:           /sys/class/genwqe/genwqe<n>_card/base_clock
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Base clock frequency of the card.
+What:           /sys/class/genwqe/genwqe<n>_card/device/sriov_numvfs
+Date:           Oct 2013
+Contact:        haver@linux.vnet.ibm.com
+Description:    Enable VFs (1..15):
+                  sudo sh -c 'echo 15 > \
+                    /sys/bus/pci/devices/0000\:1b\:00.0/sriov_numvfs'
+                Disable VFs:
+                  Write a 0 into the same sysfs entry.
diff --git a/Documentation/ABI/testing/sysfs-firmware-efi b/Documentation/ABI/testing/sysfs-firmware-efi
new file mode 100644
index 000000000000..05874da7ce80
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-firmware-efi
@@ -0,0 +1,20 @@
+What:           /sys/firmware/efi/fw_vendor
+Date:           December 2013
+Contact:        Dave Young <dyoung@redhat.com>
+Description:    It shows the physical address of firmware vendor field in the
+                EFI system table.
+Users:          Kexec
+What:           /sys/firmware/efi/runtime
+Date:           December 2013
+Contact:        Dave Young <dyoung@redhat.com>
+Description:    It shows the physical address of runtime service table entry in
+                the EFI system table.
+Users:          Kexec
+What:           /sys/firmware/efi/config_table
+Date:           December 2013
+Contact:        Dave Young <dyoung@redhat.com>
+Description:    It shows the physical address of config table entry in the EFI
+                system table.
+Users:          Kexec
diff --git a/Documentation/ABI/testing/sysfs-firmware-efi-runtime-map b/Documentation/ABI/testing/sysfs-firmware-efi-runtime-map
new file mode 100644
index 000000000000..c61b9b348e99
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-firmware-efi-runtime-map
@@ -0,0 +1,34 @@
+What:           /sys/firmware/efi/runtime-map/
+Date:           December 2013
+Contact:        Dave Young <dyoung@redhat.com>
+Description:    Switching efi runtime services to virtual mode requires
+                that all efi memory ranges which have the runtime attribute
+                bit set to be mapped to virtual addresses.
+                The efi runtime services can only be switched to virtual
+                mode once without rebooting. The kexec kernel must maintain
+                the same physical to virtual address mappings as the first
+                kernel. The mappings are exported to sysfs so userspace tools
+                can reassemble them and pass them into the kexec kernel.
+                /sys/firmware/efi/runtime-map/ is the directory the kernel
+                exports that information in.
+                subdirectories are named with the number of the memory range:
+                        /sys/firmware/efi/runtime-map/0
+                        /sys/firmware/efi/runtime-map/1
+                        /sys/firmware/efi/runtime-map/2
+                        /sys/firmware/efi/runtime-map/3
+                        ...
+                Each subdirectory contains five files:
+                attribute : The attributes of the memory range.
+                num_pages : The size of the memory range in pages.
+                phys_addr : The physical address of the memory range.
+                type      : The type of the memory range.
+                virt_addr : The virtual address of the memory range.
+                Above values are all hexadecimal numbers with the '0x' prefix.
+Users:          Kexec
diff --git a/Documentation/ABI/testing/sysfs-kernel-boot_params b/Documentation/ABI/testing/sysfs-kernel-boot_params
new file mode 100644
index 000000000000..eca38ce2852d
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-kernel-boot_params
@@ -0,0 +1,38 @@
+What:           /sys/kernel/boot_params
+Date:           December 2013
+Contact:        Dave Young <dyoung@redhat.com>
+Description:    The /sys/kernel/boot_params directory contains two
+                files: "data" and "version" and one subdirectory "setup_data".
+                It is used to export the kernel boot parameters of an x86
+                platform to userspace for kexec and debugging purpose.
+                If there's no setup_data in boot_params the subdirectory will
+                not be created.
+                "data" file is the binary representation of struct boot_params.
+                "version" file is the string representation of boot
+                protocol version.
+                "setup_data" subdirectory contains the setup_data data
+                structure in boot_params. setup_data is maintained in kernel
+                as a link list. In "setup_data" subdirectory there's one
+                subdirectory for each link list node named with the number
+                of the list nodes. The list node subdirectory contains two
+                files "type" and "data". "type" file is the string
+                representation of setup_data type. "data" file is the binary
+                representation of setup_data payload.
+                The whole boot_params directory structure is like below:
+                /sys/kernel/boot_params
+                |__ data
+                |__ setup_data
+                |   |__ 0
+                |   |   |__ data
+                |   |   |__ type
+                |   |__ 1
+                |       |__ data
+                |       |__ type
+                |__ version
+Users:          Kexec
diff --git a/Documentation/HOWTO b/Documentation/HOWTO
index 27faae3e3846..57cf5efb044d 100644
--- a/Documentation/HOWTO
+++ b/Documentation/HOWTO
@@ -112,7 +112,7 @@ required reading:
    Other excellent descriptions of how to create patches properly are:
        "The Perfect Patch"
-                http://kerneltrap.org/node/3737
+                http://www.ozlabs.org/~akpm/stuff/tpp.txt
        "Linux kernel patch submission format"
                http://linux.yyz.us/patch-format.html
@@ -579,7 +579,7 @@ all time.  It should describe the patch completely, containing:
 For more details on what this should all look like, please see the
 ChangeLog section of the document:
  "The Perfect Patch"
-      http://userweb.kernel.org/~akpm/stuff/tpp.txt
+      http://www.ozlabs.org/~akpm/stuff/tpp.txt
diff --git a/Documentation/RCU/trace.txt b/Documentation/RCU/trace.txt
index f3778f8952da..910870b15acd 100644
--- a/Documentation/RCU/trace.txt
+++ b/Documentation/RCU/trace.txt
@@ -396,14 +396,14 @@ o	Each element of the form "3/3 ..>. 0:7 ^0" represents one rcu_node
 The output of "cat rcu/rcu_sched/rcu_pending" looks as follows:
-  0!np=26111 qsp=29 rpq=5386 cbr=1 cng=570 gpc=3674 gps=577 nn=15903
+  0!np=26111 qsp=29 rpq=5386 cbr=1 cng=570 gpc=3674 gps=577 nn=15903 ndw=0
-  1!np=28913 qsp=35 rpq=6097 cbr=1 cng=448 gpc=3700 gps=554 nn=18113
+  1!np=28913 qsp=35 rpq=6097 cbr=1 cng=448 gpc=3700 gps=554 nn=18113 ndw=0
-  2!np=32740 qsp=37 rpq=6202 cbr=0 cng=476 gpc=4627 gps=546 nn=20889
+  2!np=32740 qsp=37 rpq=6202 cbr=0 cng=476 gpc=4627 gps=546 nn=20889 ndw=0
-  3 np=23679 qsp=22 rpq=5044 cbr=1 cng=415 gpc=3403 gps=347 nn=14469
+  3 np=23679 qsp=22 rpq=5044 cbr=1 cng=415 gpc=3403 gps=347 nn=14469 ndw=0
-  4!np=30714 qsp=4 rpq=5574 cbr=0 cng=528 gpc=3931 gps=639 nn=20042
+  4!np=30714 qsp=4 rpq=5574 cbr=0 cng=528 gpc=3931 gps=639 nn=20042 ndw=0
-  5 np=28910 qsp=2 rpq=5246 cbr=0 cng=428 gpc=4105 gps=709 nn=18422
+  5 np=28910 qsp=2 rpq=5246 cbr=0 cng=428 gpc=4105 gps=709 nn=18422 ndw=0
-  6!np=38648 qsp=5 rpq=7076 cbr=0 cng=840 gpc=4072 gps=961 nn=25699
+  6!np=38648 qsp=5 rpq=7076 cbr=0 cng=840 gpc=4072 gps=961 nn=25699 ndw=0
-  7 np=37275 qsp=2 rpq=6873 cbr=0 cng=868 gpc=3416 gps=971 nn=25147
+  7 np=37275 qsp=2 rpq=6873 cbr=0 cng=868 gpc=3416 gps=971 nn=25147 ndw=0
 The fields are as follows:
@@ -432,6 +432,10 @@ o	"gpc" is the number of times that an old grace period had
 o       "gps" is the number of times that a new grace period had started,
        but this CPU was not yet aware of it.
+o       "ndw" is the number of times that a wakeup of an rcuo
+        callback-offload kthread had to be deferred in order to avoid
+        deadlock.
 o       "nn" is the number of times that this CPU needed nothing.
@@ -443,7 +447,7 @@ The output of "cat rcu/rcuboost" looks as follows:
    balk: nt=0 egt=6541 bt=0 nb=0 ny=126 nos=0
 This information is output only for rcu_preempt.  Each two-line entry
-corresponds to a leaf rcu_node strcuture.  The fields are as follows:
+corresponds to a leaf rcu_node structure.  The fields are as follows:
 o       "n:m" is the CPU-number range for the corresponding two-line
        entry.  In the sample output above, the first entry covers
diff --git a/Documentation/acpi/apei/einj.txt b/Documentation/acpi/apei/einj.txt
index a58b63da1a36..f51861bcb07b 100644
--- a/Documentation/acpi/apei/einj.txt
+++ b/Documentation/acpi/apei/einj.txt
@@ -45,11 +45,22 @@ directory apei/einj. The following files are provided.
  injection. Before this, please specify all necessary error
  parameters.
+- flags
+  Present for kernel version 3.13 and above. Used to specify which
+  of param{1..4} are valid and should be used by BIOS during injection.
+  Value is a bitmask as specified in ACPI5.0 spec for the
+  SET_ERROR_TYPE_WITH_ADDRESS data structure:
+        Bit 0 - Processor APIC field valid (see param3 below)
+        Bit 1 - Memory address and mask valid (param1 and param2)
+        Bit 2 - PCIe (seg,bus,dev,fn) valid (param4 below)
+  If set to zero, legacy behaviour is used where the type of injection
+  specifies just one bit set, and param1 is multiplexed.
 - param1
  This file is used to set the first error parameter value. Effect of
  parameter depends on error_type specified. For example, if error
  type is memory related type, the param1 should be a valid physical
-  memory address.
+  memory address. [Unless "flag" is set - see above]
 - param2
  This file is used to set the second error parameter value. Effect of
@@ -58,6 +69,12 @@ directory apei/einj. The following files are provided.
  address mask. Linux requires page or narrower granularity, say,
  0xfffffffffffff000.
+- param3
+  Used when the 0x1 bit is set in "flag" to specify the APIC id
+- param4
+  Used when the 0x4 bit is set in "flag" to specify target PCIe device
 - notrigger
  The EINJ mechanism is a two step process. First inject the error, then
  perform some actions to trigger it. Setting "notrigger" to 1 skips the
diff --git a/Documentation/block/null_blk.txt b/Documentation/block/null_blk.txt
new file mode 100644
index 000000000000..b2830b435895
--- /dev/null
+++ b/Documentation/block/null_blk.txt
@@ -0,0 +1,72 @@
+Null block device driver
+================================================================================
+I. Overview
+The null block device (/dev/nullb*) is used for benchmarking the various
+block-layer implementations. It emulates a block device of X gigabytes in size.
+The following instances are possible:
+  Single-queue block-layer
+    - Request-based.
+    - Single submission queue per device.
+    - Implements IO scheduling algorithms (CFQ, Deadline, noop).
+  Multi-queue block-layer
+    - Request-based.
+    - Configurable submission queues per device.
+  No block-layer (Known as bio-based)
+    - Bio-based. IO requests are submitted directly to the device driver.
+    - Directly accepts bio data structure and returns them.
+All of them have a completion queue for each core in the system.
+II. Module parameters applicable for all instances:
+queue_mode=[0-2]: Default: 2-Multi-queue
+  Selects which block-layer the module should instantiate with.
+  0: Bio-based.
+  1: Single-queue.
+  2: Multi-queue.
+home_node=[0--nr_nodes]: Default: NUMA_NO_NODE
+  Selects what CPU node the data structures are allocated from.
+gb=[Size in GB]: Default: 250GB
+  The size of the device reported to the system.
+bs=[Block size (in bytes)]: Default: 512 bytes
+  The block size reported to the system.
+nr_devices=[Number of devices]: Default: 2
+  Number of block devices instantiated. They are instantiated as /dev/nullb0,
+  etc.
+irq_mode=[0-2]: Default: 1-Soft-irq
+  The completion mode used for completing IOs to the block-layer.
+  0: None.
+  1: Soft-irq. Uses IPI to complete IOs across CPU nodes. Simulates the overhead
+     when IOs are issued from another CPU node than the home the device is
+     connected to.
+  2: Timer: Waits a specific period (completion_nsec) for each IO before
+     completion.
+completion_nsec=[ns]: Default: 10.000ns
+  Combined with irq_mode=2 (timer). The time each completion event must wait.
+submit_queues=[0..nr_cpus]:
+  The number of submission queues attached to the device driver. If unset, it
+  defaults to 1 on single-queue and bio-based instances. For multi-queue,
+  it is ignored when use_per_node_hctx module parameter is 1.
+hw_queue_depth=[0..qdepth]: Default: 64
+  The hardware queue depth of the device.
+III: Multi-queue specific parameters
+use_per_node_hctx=[0/1]: Default: 0
+  0: The number of submit queues are set to the value of the submit_queues
+     parameter.
+  1: The multi-queue block layer is instantiated with a hardware dispatch
+     queue for each CPU node in the system.
diff --git a/Documentation/circular-buffers.txt b/Documentation/circular-buffers.txt
index 8117e5bf6065..88951b179262 100644
--- a/Documentation/circular-buffers.txt
+++ b/Documentation/circular-buffers.txt
@@ -160,6 +160,7 @@ The producer will look something like this:
        spin_lock(&producer_lock);
        unsigned long head = buffer->head;
+        /* The spin_unlock() and next spin_lock() provide needed ordering. */
        unsigned long tail = ACCESS_ONCE(buffer->tail);
        if (CIRC_SPACE(head, tail, buffer->size) >= 1) {
@@ -168,9 +169,8 @@ The producer will look something like this:
                produce_item(item);
-                smp_wmb(); /* commit the item before incrementing the head */
+                smp_store_release(buffer->head,
+                                  (head + 1) & (buffer->size - 1));
-                buffer->head = (head + 1) & (buffer->size - 1);
                /* wake_up() will make sure that the head is committed before
                 * waking anyone up */
@@ -183,9 +183,14 @@ This will instruct the CPU that the contents of the new item must be written
 before the head index makes it available to the consumer and then instructs the
 CPU that the revised head index must be written before the consumer is woken.
-Note that wake_up() doesn't have to be the exact mechanism used, but whatever
+Note that wake_up() does not guarantee any sort of barrier unless something
-is used must guarantee a (write) memory barrier between the update of the head
+is actually awakened.  We therefore cannot rely on it for ordering.  However,
-index and the change of state of the consumer, if a change of state occurs.
+there is always one element of the array left empty.  Therefore, the
+producer must produce two elements before it could possibly corrupt the
+element currently being read by the consumer.  Therefore, the unlock-lock
+pair between consecutive invocations of the consumer provides the necessary
+ordering between the read of the index indicating that the consumer has
+vacated a given element and the write by the producer to that same element.
 THE CONSUMER
@@ -195,21 +200,20 @@ The consumer will look something like this:
        spin_lock(&consumer_lock);
-        unsigned long head = ACCESS_ONCE(buffer->head);
+        /* Read index before reading contents at that index. */
+        unsigned long head = smp_load_acquire(buffer->head);
        unsigned long tail = buffer->tail;
        if (CIRC_CNT(head, tail, buffer->size) >= 1) {
-                /* read index before reading contents at that index */
-                smp_read_barrier_depends();
                /* extract one item from the buffer */
                struct item *item = buffer[tail];
                consume_item(item);
-                smp_mb(); /* finish reading descriptor before incrementing tail */
+                /* Finish reading descriptor before incrementing tail. */
+                smp_store_release(buffer->tail,
-                buffer->tail = (tail + 1) & (buffer->size - 1);
+                                  (tail + 1) & (buffer->size - 1));
        }
        spin_unlock(&consumer_lock);
@@ -218,12 +222,17 @@ This will instruct the CPU to make sure the index is up to date before reading
 the new item, and then it shall make sure the CPU has finished reading the item
 before it writes the new tail pointer, which will erase the item.
+Note the use of ACCESS_ONCE() and smp_load_acquire() to read the
-Note the use of ACCESS_ONCE() in both algorithms to read the opposition index.
+opposition index.  This prevents the compiler from discarding and
-This prevents the compiler from discarding and reloading its cached value -
+reloading its cached value - which some compilers will do across
-which some compilers will do across smp_read_barrier_depends().  This isn't
+smp_read_barrier_depends().  This isn't strictly needed if you can
-strictly needed if you can be sure that the opposition index will _only_ be
+be sure that the opposition index will _only_ be used the once.
-used the once.
+The smp_load_acquire() additionally forces the CPU to order against
+subsequent memory references.  Similarly, smp_store_release() is used
+in both algorithms to write the thread's index.  This documents the
+fact that we are writing to something that can be read concurrently,
+prevents the compiler from tearing the store, and enforces ordering
+against previous accesses.
 ===============
diff --git a/Documentation/devicetree/bindings/arm/atmel-at91.txt b/Documentation/devicetree/bindings/arm/atmel-at91.txt
index 1196290082d1..78530e621a1e 100644
--- a/Documentation/devicetree/bindings/arm/atmel-at91.txt
+++ b/Documentation/devicetree/bindings/arm/atmel-at91.txt
@@ -20,6 +20,10 @@ TC/TCLIB Timer required properties:
 - interrupts: Should contain all interrupts for the TC block
  Note that you can specify several interrupt cells if the TC
  block has one interrupt per channel.
+- clock-names: tuple listing input clock names.
+        Required elements: "t0_clk"
+        Optional elements: "t1_clk", "t2_clk"
+- clocks: phandles to input clocks.
 Examples:
@@ -28,6 +32,8 @@ One interrupt per TC block:
                compatible = "atmel,at91rm9200-tcb";
                reg = <0xfff7c000 0x100>;
                interrupts = <18 4>;
+                clocks = <&tcb0_clk>;
+                clock-names = "t0_clk";
        };
 One interrupt per TC channel in a TC block:
@@ -35,6 +41,8 @@ One interrupt per TC channel in a TC block:
                compatible = "atmel,at91rm9200-tcb";
                reg = <0xfffdc000 0x100>;
                interrupts = <26 4 27 4 28 4>;
+                clocks = <&tcb1_clk>;
+                clock-names = "t0_clk";
        };
 RSTC Reset Controller required properties:
diff --git a/Documentation/devicetree/bindings/clock/exynos5250-clock.txt b/Documentation/devicetree/bindings/clock/exynos5250-clock.txt
index 46f5c791ea0d..0f2f920e8734 100644
--- a/Documentation/devicetree/bindings/clock/exynos5250-clock.txt
+++ b/Documentation/devicetree/bindings/clock/exynos5250-clock.txt
@@ -159,6 +159,8 @@ clock which they consume.
  mixer                 343
  hdmi                  344
  g2d                   345
+  mdma0                 346
+  smmu_mdma0            347
   [Clock Muxes]
diff --git a/Documentation/devicetree/bindings/extcon/extcon-palmas.txt b/Documentation/devicetree/bindings/extcon/extcon-palmas.txt
index 7dab6a8f4a0e..45414bbcd945 100644
--- a/Documentation/devicetree/bindings/extcon/extcon-palmas.txt
+++ b/Documentation/devicetree/bindings/extcon/extcon-palmas.txt
@@ -2,7 +2,11 @@ EXTCON FOR PALMAS/TWL CHIPS
 PALMAS USB COMPARATOR
 Required Properties:
- - compatible : Should be "ti,palmas-usb" or "ti,twl6035-usb"
+ - compatible: should contain one of:
+   * "ti,palmas-usb-vid".
+   * "ti,twl6035-usb-vid".
+   * "ti,palmas-usb" (DEPRECATED - use "ti,palmas-usb-vid").
+   * "ti,twl6035-usb" (DEPRECATED - use "ti,twl6035-usb-vid").
 Optional Properties:
 - ti,wakeup : To enable the wakeup comparator in probe
diff --git a/Documentation/devicetree/bindings/misc/atmel-ssc.txt b/Documentation/devicetree/bindings/misc/atmel-ssc.txt
index a45ae08c8ed1..60960b2755f4 100644
--- a/Documentation/devicetree/bindings/misc/atmel-ssc.txt
+++ b/Documentation/devicetree/bindings/misc/atmel-ssc.txt
@@ -6,6 +6,9 @@ Required properties:
        - atmel,at91sam9g45-ssc: support dma transfer
 - reg: Should contain SSC registers location and length
 - interrupts: Should contain SSC interrupt
+- clock-names: tuple listing input clock names.
+        Required elements: "pclk"
+- clocks: phandles to input clocks.
 Required properties for devices compatible with "atmel,at91sam9g45-ssc":
@@ -20,6 +23,8 @@ ssc0: ssc@fffbc000 {
        compatible = "atmel,at91rm9200-ssc";
        reg = <0xfffbc000 0x4000>;
        interrupts = <14 4 5>;
+        clocks = <&ssc0_clk>;
+        clock-names = "pclk";
 };
 - DMA transfer:
diff --git a/Documentation/devicetree/bindings/misc/bmp085.txt b/Documentation/devicetree/bindings/misc/bmp085.txt
index 91dfda2e4e11..d7a6deb6b21e 100644
--- a/Documentation/devicetree/bindings/misc/bmp085.txt
+++ b/Documentation/devicetree/bindings/misc/bmp085.txt
@@ -8,6 +8,8 @@ Optional properties:
 - temp-measurement-period: temperature measurement period (milliseconds)
 - default-oversampling: default oversampling value to be used at startup,
  value range is 0-3 with rising sensitivity.
+- interrupt-parent: should be the phandle for the interrupt controller
+- interrupts: interrupt mapping for IRQ
 Example:
@@ -17,4 +19,6 @@ pressure@77 {
        chip-id = <10>;
        temp-measurement-period = <100>;
        default-oversampling = <2>;
+        interrupt-parent = <&gpio0>;
+        interrupts = <25 IRQ_TYPE_EDGE_RISING>;
 };
diff --git a/Documentation/devicetree/bindings/timer/allwinner,sun5i-a13-hstimer.txt b/Documentation/devicetree/bindings/timer/allwinner,sun5i-a13-hstimer.txt
new file mode 100644
index 000000000000..7c26154b8bbb
--- /dev/null
+++ b/Documentation/devicetree/bindings/timer/allwinner,sun5i-a13-hstimer.txt
@@ -0,0 +1,22 @@
+Allwinner SoCs High Speed Timer Controller
+Required properties:
+- compatible :  should be "allwinner,sun5i-a13-hstimer" or
+                "allwinner,sun7i-a20-hstimer"
+- reg : Specifies base physical address and size of the registers.
+- interrupts :  The interrupts of these timers (2 for the sun5i IP, 4 for the sun7i
+                one)
+- clocks: phandle to the source clock (usually the AHB clock)
+Example:
+timer@01c60000 {
+        compatible = "allwinner,sun7i-a20-hstimer";
+        reg = <0x01c60000 0x1000>;
+        interrupts = <0 51 1>,
+                     <0 52 1>,
+                     <0 53 1>,
+                     <0 54 1>;
+        clocks = <&ahb1_gates 19>;
+};
diff --git a/Documentation/extcon/porting-android-switch-class b/Documentation/extcon/porting-android-switch-class
index 5377f6317961..49c81caef84d 100644
--- a/Documentation/extcon/porting-android-switch-class
+++ b/Documentation/extcon/porting-android-switch-class
@@ -50,7 +50,7 @@ so that they are still compatible with legacy userspace processes.
        Extcon's extended features for switch device drivers with
        complex features usually required magic numbers in state
        value of switch_dev. With extcon, such magic numbers that
-        support multiple cables (
+        support multiple cables are no more required or supported.
  1. Define cable names at edev->supported_cable.
  2. (Recommended) remove print_state callback.
@@ -114,11 +114,8 @@ exclusive, the two cables cannot be in ATTACHED state simulteneously.
 ****** ABI Location
-  If "CONFIG_ANDROID" is enabled and "CONFIG_ANDROID_SWITCH" is
+  If "CONFIG_ANDROID" is enabled, /sys/class/switch/* are created
-disabled, /sys/class/switch/* are created as symbolic links to
+as symbolic links to /sys/class/extcon/*.
-/sys/class/extcon/*. Because CONFIG_ANDROID_SWITCH creates
-/sys/class/switch directory, we disable symboling linking if
-CONFIG_ANDROID_SWITCH is enabled.
  The two files of switch class, name and state, are provided with
 extcon, too. When the multistate support (STEP 2 of CHAPTER 1.) is
diff --git a/Documentation/ja_JP/HOWTO b/Documentation/ja_JP/HOWTO
index 8148a47fc70e..0091a8215ac1 100644
--- a/Documentation/ja_JP/HOWTO
+++ b/Documentation/ja_JP/HOWTO
@@ -149,7 +149,7 @@ linux-api@ver.kernel.org に送ることを勧めます。
     この他にパッチを作る方法についてのよくできた記述は-
        "The Perfect Patch"
-                http://userweb.kernel.org/~akpm/stuff/tpp.txt
+                http://www.ozlabs.org/~akpm/stuff/tpp.txt
        "Linux kernel patch submission format"
                http://linux.yyz.us/patch-format.html
@@ -622,7 +622,7 @@ Linux カーネルコミュニティは、一度に大量のコードの塊を�
 これについて全てがどのようにあるべきかについての詳細は、以下のドキュメ
 ントの ChangeLog セクションを見てください-
  "The Perfect Patch"
-      http://userweb.kernel.org/~akpm/stuff/tpp.txt
+      http://www.ozlabs.org/~akpm/stuff/tpp.txt
 これらのどれもが、時にはとても困難です。これらの慣例を完璧に実施するに
 は数年かかるかもしれません。これは継続的な改善のプロセスであり、そのた
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 50680a59a2ff..4252af6ffda1 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -774,6 +774,15 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        disable=        [IPV6]
                        See Documentation/networking/ipv6.txt.
+        disable_cpu_apicid= [X86,APIC,SMP]
+                        Format: <int>
+                        The number of initial APIC ID for the
+                        corresponding CPU to be disabled at boot,
+                        mostly used for the kdump 2nd kernel to
+                        disable BSP to wake up multiple CPUs without
+                        causing system reset or hang due to sending
+                        INIT from AP to BSP.
        disable_ddw     [PPC/PSERIES]
                        Disable Dynamic DMA Window support. Use this if
                        to workaround buggy firmware.
@@ -881,6 +890,14 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        The xen output can only be used by Xen PV guests.
+        edac_report=    [HW,EDAC] Control how to report EDAC event
+                        Format: {"on" | "off" | "force"}
+                        on: enable EDAC to report H/W event. May be overridden
+                        by other higher priority error reporting module.
+                        off: disable H/W event reporting through EDAC.
+                        force: enforce the use of EDAC to report H/W event.
+                        default: on.
        ekgdboc=        [X86,KGDB] Allow early kernel console debugging
                        ekgdboc=kbd
@@ -890,6 +907,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        edd=            [EDD]
                        Format: {"off" | "on" | "skip[mbr]"}
+        efi=            [EFI]
+                        Format: { "old_map" }
+                        old_map [X86-64]: switch to the old ioremap-based EFI
+                        runtime services mapping. 32-bit still uses this one by
+                        default.
        efi_no_storage_paranoia [EFI; X86]
                        Using this parameter you can use more than 50% of
                        your efi variable storage. Use this parameter only if
@@ -1529,6 +1552,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        * atapi_dmadir: Enable ATAPI DMADIR bridge support
+                        * disable: Disable this device.
                        If there are multiple matching configurations changing
                        the same attribute, the last one is used.
@@ -1992,6 +2017,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
        noapic          [SMP,APIC] Tells the kernel to not make use of any
                        IOAPICs that may be present in the system.
+        nokaslr         [X86]
+                        Disable kernel base offset ASLR (Address Space
+                        Layout Randomization) if built into the kernel.
        noautogroup     Disable scheduler automatic task group creation.
        nobats          [PPC] Do not use BATs for mapping kernel lowmem
@@ -2625,7 +2654,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        for RCU-preempt, and "s" for RCU-sched, and "N"
                        is the CPU number.  This reduces OS jitter on the
                        offloaded CPUs, which can be useful for HPC and
                        real-time workloads.  It can also improve energy
                        efficiency for asymmetric multiprocessors.
@@ -2641,8 +2669,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        periodically wake up to do the polling.
        rcutree.blimit= [KNL]
-                        Set maximum number of finished RCU callbacks to process
+                        Set maximum number of finished RCU callbacks to
-                        in one batch.
+                        process in one batch.
        rcutree.rcu_fanout_leaf= [KNL]
                        Increase the number of CPUs assigned to each
@@ -2661,8 +2689,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        value is one, and maximum value is HZ.
        rcutree.qhimark= [KNL]
-                        Set threshold of queued
+                        Set threshold of queued RCU callbacks beyond which
-                        RCU callbacks over which batch limiting is disabled.
+                        batch limiting is disabled.
        rcutree.qlowmark= [KNL]
                        Set threshold of queued RCU callbacks below which
diff --git a/Documentation/kmsg/s390/zcrypt b/Documentation/kmsg/s390/zcrypt
new file mode 100644
index 000000000000..7fb2087409d6
--- /dev/null
+++ b/Documentation/kmsg/s390/zcrypt
@@ -0,0 +1,20 @@
+/*?
+ * Text: "Cryptographic device %x failed and was set offline\n"
+ * Severity: Error
+ * Parameter:
+ *   @1: device index
+ * Description:
+ * A cryptographic device failed to process a cryptographic request.
+ * The cryptographic device driver could not correct the error and
+ * set the device offline. The application that issued the
+ * request received an indication that the request has failed.
+ * User action:
+ * Use the lszcrypt command to confirm that the cryptographic
+ * hardware is still configured to your LPAR or z/VM guest virtual
+ * machine. If the device is available to your Linux instance the
+ * command output contains a line that begins with 'card<device index>',
+ * where <device index> is the two-digit decimal number in the message text.
+ * After ensuring that the device is available, use the chzcrypt command to
+ * set it online again.
+ * If the error persists, contact your support organization.
+ */
diff --git a/Documentation/ko_KR/HOWTO b/Documentation/ko_KR/HOWTO
index 680e64635958..dc2ff8f611e0 100644
--- a/Documentation/ko_KR/HOWTO
+++ b/Documentation/ko_KR/HOWTO
@@ -122,7 +122,7 @@ mtk.manpages@gmail.com의 메인테이너에게 보낼 것을 권장한다.
    올바른 패치들을 만드는 법에 관한 훌륭한 다른 문서들이 있다.
    "The Perfect Patch"
-        http://userweb.kernel.org/~akpm/stuff/tpp.txt
+        http://www.ozlabs.org/~akpm/stuff/tpp.txt
    "Linux kernel patch submission format"
        http://linux.yyz.us/patch-format.html
@@ -213,7 +213,7 @@ Documentation/DocBook/ 디렉토리 내에서 만들어지며 PDF, Postscript, H
 것은 Linux Cross-Reference project이며 그것은 자기 참조 방식이며
 소스코드를 인덱스된 웹 페이지들의 형태로 보여준다. 최신의 멋진 커널
 코드 저장소는 다음을 통하여 참조할 수 있다.
-      http://users.sosdg.org/~qiyong/lxr/
+      http://lxr.linux.no/+trees
 개발 프로세스
@@ -222,20 +222,20 @@ Documentation/DocBook/ 디렉토리 내에서 만들어지며 PDF, Postscript, H
 리눅스 커널 개발 프로세스는 현재 몇몇 다른 메인 커널 "브랜치들"과
 서브시스템에 특화된 커널 브랜치들로 구성된다. 몇몇 다른 메인
 브랜치들은 다음과 같다.
-  - main 2.6.x 커널 트리
+  - main 3.x 커널 트리
-  - 2.6.x.y - 안정된 커널 트리
+  - 3.x.y - 안정된 커널 트리
-  - 2.6.x -git 커널 패치들
+  - 3.x -git 커널 패치들
-  - 2.6.x -mm 커널 패치들
  - 서브시스템을 위한 커널 트리들과 패치들
+  - 3.x - 통합 테스트를 위한 next 커널 트리
-2.6.x 커널 트리
+3.x 커널 트리
 ---------------
-2.6.x 커널들은 Linux Torvalds가 관리하며 kernel.org의 pub/linux/kernel/v2.6/
+3.x 커널들은 Linux Torvalds가 관리하며 kernel.org의 pub/linux/kernel/v3.x/
 디렉토리에서 참조될 수 있다.개발 프로세스는 다음과 같다.
  - 새로운 커널이 배포되자마자 2주의 시간이 주어진다. 이 기간동은
    메인테이너들은 큰 diff들을 Linus에게 제출할 수 있다. 대개 이 패치들은
-    몇 주 동안 -mm 커널내에 이미 있었던 것들이다. 큰 변경들을 제출하는 데
+    몇 주 동안 -next 커널내에 이미 있었던 것들이다. 큰 변경들을 제출하는 데
    선호되는 방법은  git(커널의 소스 관리 툴, 더 많은 정보들은 http://git.or.cz/
    에서 참조할 수 있다)를 사용하는 것이지만 순수한 패치파일의 형식으로 보내는
    것도 무관하다.
@@ -262,20 +262,20 @@ Andrew Morton의 글이 있다.
         버그의 상황에 따라 배포되는 것이지 미리정해 놓은 시간에 따라
         배포되는 것은 아니기 때문이다."
-2.6.x.y - 안정 커널 트리
+3.x.y - 안정 커널 트리
 ------------------------
-4 자리 숫자로 이루어진 버젼의 커널들은 -stable 커널들이다. 그것들은 2.6.x
+3 자리 숫자로 이루어진 버젼의 커널들은 -stable 커널들이다. 그것들은 3.x
 커널에서 발견된 큰 회귀들이나 보안 문제들 중 비교적 작고 중요한 수정들을
 포함한다.
 이것은 가장 최근의 안정적인 커널을 원하는 사용자에게 추천되는 브랜치이며,
 개발/실험적 버젼을 테스트하는 것을 돕고자 하는 사용자들과는 별로 관련이 없다.
-어떤 2.6.x.y 커널도 사용할 수 없다면 그때는 가장 높은 숫자의 2.6.x
+어떤 3.x.y 커널도 사용할 수 없다면 그때는 가장 높은 숫자의 3.x
 커널이 현재의 안정 커널이다.
-2.6.x.y는 "stable" 팀<stable@kernel.org>에 의해 관리되며 거의 매번 격주로
+3.x.y는 "stable" 팀<stable@vger.kernel.org>에 의해 관리되며 거의 매번 격주로
 배포된다.
 커널 트리 문서들 내에 Documentation/stable_kernel_rules.txt 파일은 어떤
@@ -283,84 +283,46 @@ Andrew Morton의 글이 있다.
 진행되는지를 설명한다.
-2.6.x -git 패치들
+3.x -git 패치들
 ------------------
 git 저장소(그러므로 -git이라는 이름이 붙음)에는 날마다 관리되는 Linus의
 커널 트리의 snapshot 들이 있다. 이 패치들은 일반적으로 날마다 배포되며
 Linus의 트리의 현재 상태를 나타낸다. 이 패치들은 정상적인지 조금도
 살펴보지 않고 자동적으로 생성된 것이므로 -rc 커널들 보다도 더 실험적이다.
-2.6.x -mm 커널 패치들
---------------------
-Andrew Morton에 의해 배포된 실험적인 커널 패치들이다. Andrew는 모든 다른
-서브시스템 커널 트리와 패치들을 가져와서 리눅스 커널 메일링 리스트로
-온 많은 패치들과 한데 묶는다. 이 트리는 새로운 기능들과 패치들을 위한
-장소를 제공하는 역할을 한다. 하나의 패치가 -mm에 한동안 있으면서 그 가치가
-증명되게 되면 Andrew나 서브시스템 메인테이너는 그것을 메인라인에 포함시키기
-위하여 Linus에게 보낸다.
-커널 트리에 포함하고 싶은 모든 새로운 패치들은 Linus에게 보내지기 전에
-mm 트리에서 테스트를 하는 것을 적극 추천한다.
-이 커널들은 안정되게 사용할 시스템에서에 실행하는 것은 적합하지 않으며
-다른 브랜치들의 어떤 것들보다 위험하다.
-여러분이 커널 개발 프로세스를 돕길 원한다면 이 커널 배포들을 사용하고
-테스트한 후 어떤 문제를 발견하거나 또는 모든 것이 잘 동작한다면 리눅스
-커널 메일링 리스트로 피드백을 해달라.
-이 커널들은 일반적으로 모든 다른 실험적인 패치들과 배포될 당시의
-사용가능한 메인라인 -git 커널들의 몇몇 변경을 포함한다.
-mm 커널들은 정해진 일정대로 배포되지 않는다. 하지만 대개 몇몇 -mm 커널들은
-각 -rc 커널(1부터 3이 흔함) 사이에서 배포된다.
 서브시스템 커널 트리들과 패치들
 -------------------------------
-많은 다른 커널 서브시스템 개발자들은 커널의 다른 부분들에서 무슨 일이
+다양한 커널 서브시스템의 메인테이너들 --- 그리고 많은 커널 서브시스템 개발자들
-일어나고 있는지를 볼수 있도록 그들의 개발 트리를 공개한다. 이 트리들은
+--- 은 그들의 현재 개발 상태를 소스 저장소로 노출한다. 이를 통해 다른 사람들도
-위에서 설명하였던 것 처럼 -mm 커널 배포들로 합쳐진다.
+커널의 다른 영역에 어떤 변화가 이루어지고 있는지 알 수 있다. 급속히 개발이
+진행되는 영역이 있고 그렇지 않은 영역이 있으므로, 개발자는 다른 개발자가 제출한
-다음은  활용가능한 커널 트리들을 나열한다.
+수정 사항과 자신의 수정사항의 충돌이나 동일한 일을 동시에 두사람이 따로
-  git trees:
+진행하는 사태를 방지하기 위해 급속히 개발이 진행되고 있는 영역에 작업의
-    - Kbuild development tree, Sam Ravnborg < sam@ravnborg.org>
+베이스를 맞춰줄 것이 요구된다.
-    git.kernel.org:/pub/scm/linux/kernel/git/sam/kbuild.git
+대부분의 이러한 저장소는 git 트리지만, git이 아닌 SCM으로 관리되거나, quilt
-    - ACPI development tree, Len Brown <len.brown@intel.com >
+시리즈로 제공되는 패치들도 존재한다. 이러한 서브시스템 저장소들은 MAINTAINERS
-    git.kernel.org:/pub/scm/linux/kernel/git/lenb/linux-acpi-2.6.git
+파일에 나열되어 있다. 대부분은 http://git.kernel.org 에서 볼 수 있다.
-    - Block development tree, Jens Axboe <jens.axboe@oracle.com>
+제안된 패치는 서브시스템 트리에 커밋되기 전에 메일링 리스트를 통해
-    git.kernel.org:/pub/scm/linux/kernel/git/axboe/linux-2.6-block.git
+리뷰된다(아래의 관련 섹션을 참고하기 바란다). 일부 커널 서브시스템의 경우, 이
+리뷰 프로세스는 patchwork라는 도구를 통해 추적된다. patchwork은 등록된 패치와
-    - DRM development tree, Dave Airlie <airlied@linux.ie>
+패치에 대한 코멘트, 패치의 버전을 볼 수 있는 웹 인터페이스를 제공하고,
-    git.kernel.org:/pub/scm/linux/kernel/git/airlied/drm-2.6.git
+메인테이너는 패치를 리뷰 중, 리뷰 통과, 또는 반려됨으로 표시할 수 있다.
+대부분의 이러한 patchwork 사이트는 http://patchwork.kernel.org/ 또는
-    - ia64 development tree, Tony Luck < tony.luck@intel.com>
+http://patchwork.ozlabs.org/ 에 나열되어 있다.
-    git.kernel.org:/pub/scm/linux/kernel/git/aegl/linux-2.6.git
+3.x - 통합 테스트를 위한 next 커널 트리
-    - infiniband, Roland Dreier <rolandd@cisco.com >
+-----------------------------------------
-    git.kernel.org:/pub/scm/linux/kernel/git/roland/infiniband.git
+서브시스템 트리들의 변경사항들은 mainline 3.x 트리로 들어오기 전에 통합
+테스트를 거쳐야 한다. 이런 목적으로, 모든 서브시스템 트리의 변경사항을 거의
-    - libata, Jeff Garzik <jgarzik@pobox.com>
+매일 받아가는 특수한 테스트 저장소가 존재한다:
-    git.kernel.org:/pub/scm/linux/kernel/git/jgarzik/libata-dev.git
+       http://git.kernel.org/?p=linux/kernel/git/sfr/linux-next.git
+       http://linux.f-seidel.de/linux-next/pmwiki/
-    - network drivers, Jeff Garzik <jgarzik@pobox.com>
-    git.kernel.org:/pub/scm/linux/kernel/git/jgarzik/netdev-2.6.git
+이런 식으로, -next 커널을 통해 다음 머지 기간에 메인라인 커널에 어떤 변경이
+가해질 것인지 간략히 알 수 있다. 모험심 강한 테스터라면 -next 커널에서 테스트를
-    - pcmcia, Dominik Brodowski < linux@dominikbrodowski.net>
+수행하는 것도 좋을 것이다.
-    git.kernel.org:/pub/scm/linux/kernel/git/brodo/pcmcia-2.6.git
-    - SCSI, James Bottomley < James.Bottomley@SteelEye.com>
-    git.kernel.org:/pub/scm/linux/kernel/git/jejb/scsi-misc-2.6.git
-  quilt trees:
-    - USB, PCI, Driver Core, and I2C, Greg Kroah-Hartman < gregkh@linuxfoundation.org>
-    kernel.org/pub/linux/kernel/people/gregkh/gregkh-2.6/
-    - x86-64, partly i386, Andi Kleen < ak@suse.de>
-        ftp.firstfloor.org:/pub/ak/x86_64/quilt/
-  다른 커널 트리들은 http://kernel.org/git와 MAINTAINERS 파일에서 참조할 수
-  있다.
 버그 보고
 ---------
@@ -597,7 +559,7 @@ Pat이라는 이름을 가진 여자가 있을 수도 있는 것이다. 리눅�
 이것이 무엇인지 더 자세한 것을 알고 싶다면 다음 문서의 ChageLog 항을 봐라.
   "The Perfect Patch"
-    http://userweb.kernel.org/~akpm/stuff/tpp.txt
+    http://www.ozlabs.org/~akpm/stuff/tpp.txt
diff --git a/Documentation/memory-barriers.txt b/Documentation/memory-barriers.txt
index c8c42e64e953..102dc19c4119 100644
--- a/Documentation/memory-barriers.txt
+++ b/Documentation/memory-barriers.txt
@@ -194,18 +194,22 @@ There are some minimal guarantees that may be expected of a CPU:
 (*) On any given CPU, dependent memory accesses will be issued in order, with
     respect to itself.  This means that for:
-        Q = P; D = *Q;
+        ACCESS_ONCE(Q) = P; smp_read_barrier_depends(); D = ACCESS_ONCE(*Q);
     the CPU will issue the following memory operations:
        Q = LOAD P, D = LOAD *Q
-     and always in that order.
+     and always in that order.  On most systems, smp_read_barrier_depends()
+     does nothing, but it is required for DEC Alpha.  The ACCESS_ONCE()
+     is required to prevent compiler mischief.  Please note that you
+     should normally use something like rcu_dereference() instead of
+     open-coding smp_read_barrier_depends().
 (*) Overlapping loads and stores within a particular CPU will appear to be
     ordered within that CPU.  This means that for:
-        a = *X; *X = b;
+        a = ACCESS_ONCE(*X); ACCESS_ONCE(*X) = b;
     the CPU will only issue the following sequence of memory operations:
@@ -213,7 +217,7 @@ There are some minimal guarantees that may be expected of a CPU:
     And for:
-        *X = c; d = *X;
+        ACCESS_ONCE(*X) = c; d = ACCESS_ONCE(*X);
     the CPU will only issue:
@@ -224,6 +228,12 @@ There are some minimal guarantees that may be expected of a CPU:
 And there are a number of things that _must_ or _must_not_ be assumed:
+ (*) It _must_not_ be assumed that the compiler will do what you want with
+     memory references that are not protected by ACCESS_ONCE().  Without
+     ACCESS_ONCE(), the compiler is within its rights to do all sorts
+     of "creative" transformations, which are covered in the Compiler
+     Barrier section.
 (*) It _must_not_ be assumed that independent loads and stores will be issued
     in the order given.  This means that for:
@@ -371,33 +381,44 @@ Memory barriers come in four basic varieties:
 And a couple of implicit varieties:
- (5) LOCK operations.
+ (5) ACQUIRE operations.
     This acts as a one-way permeable barrier.  It guarantees that all memory
-     operations after the LOCK operation will appear to happen after the LOCK
+     operations after the ACQUIRE operation will appear to happen after the
-     operation with respect to the other components of the system.
+     ACQUIRE operation with respect to the other components of the system.
+     ACQUIRE operations include LOCK operations and smp_load_acquire()
+     operations.
-     Memory operations that occur before a LOCK operation may appear to happen
+     Memory operations that occur before an ACQUIRE operation may appear to
-     after it completes.
+     happen after it completes.
-     A LOCK operation should almost always be paired with an UNLOCK operation.
+     An ACQUIRE operation should almost always be paired with a RELEASE
+     operation.
- (6) UNLOCK operations.
+ (6) RELEASE operations.
     This also acts as a one-way permeable barrier.  It guarantees that all
-     memory operations before the UNLOCK operation will appear to happen before
+     memory operations before the RELEASE operation will appear to happen
-     the UNLOCK operation with respect to the other components of the system.
+     before the RELEASE operation with respect to the other components of the
+     system. RELEASE operations include UNLOCK operations and
+     smp_store_release() operations.
-     Memory operations that occur after an UNLOCK operation may appear to
+     Memory operations that occur after a RELEASE operation may appear to
     happen before it completes.
-     LOCK and UNLOCK operations are guaranteed to appear with respect to each
+     The use of ACQUIRE and RELEASE operations generally precludes the need
-     other strictly in the order specified.
+     for other sorts of memory barrier (but note the exceptions mentioned in
+     the subsection "MMIO write barrier").  In addition, a RELEASE+ACQUIRE
+     pair is -not- guaranteed to act as a full memory barrier.  However, after
+     an ACQUIRE on a given variable, all memory accesses preceding any prior
+     RELEASE on that same variable are guaranteed to be visible.  In other
+     words, within a given variable's critical section, all accesses of all
+     previous critical sections for that variable are guaranteed to have
+     completed.
-     The use of LOCK and UNLOCK operations generally precludes the need for
+     This means that ACQUIRE acts as a minimal "acquire" operation and
-     other sorts of memory barrier (but note the exceptions mentioned in the
+     RELEASE acts as a minimal "release" operation.
-     subsection "MMIO write barrier").
 Memory barriers are only required where there's a possibility of interaction
@@ -450,14 +471,14 @@ The usage requirements of data dependency barriers are a little subtle, and
 it's not always obvious that they're needed.  To illustrate, consider the
 following sequence of events:
-        CPU 1           CPU 2
+        CPU 1                 CPU 2
-        =============== ===============
+        ===============       ===============
        { A == 1, B == 2, C = 3, P == &A, Q == &C }
        B = 4;
        <write barrier>
-        P = &B
+        ACCESS_ONCE(P) = &B
-                        Q = P;
+                              Q = ACCESS_ONCE(P);
-                        D = *Q;
+                              D = *Q;
 There's a clear data dependency here, and it would seem that by the end of the
 sequence, Q must be either &A or &B, and that:
@@ -477,15 +498,15 @@ Alpha).
 To deal with this, a data dependency barrier or better must be inserted
 between the address load and the data load:
-        CPU 1           CPU 2
+        CPU 1                 CPU 2
-        =============== ===============
+        ===============       ===============
        { A == 1, B == 2, C = 3, P == &A, Q == &C }
        B = 4;
        <write barrier>
-        P = &B
+        ACCESS_ONCE(P) = &B
-                        Q = P;
+                              Q = ACCESS_ONCE(P);
-                        <data dependency barrier>
+                              <data dependency barrier>
-                        D = *Q;
+                              D = *Q;
 This enforces the occurrence of one of the two implications, and prevents the
 third possibility from arising.
@@ -500,25 +521,26 @@ odd-numbered bank is idle, one can see the new value of the pointer P (&B),
 but the old value of the variable B (2).
-Another example of where data dependency barriers might by required is where a
+Another example of where data dependency barriers might be required is where a
 number is read from memory and then used to calculate the index for an array
 access:
-        CPU 1           CPU 2
+        CPU 1                 CPU 2
-        =============== ===============
+        ===============       ===============
        { M[0] == 1, M[1] == 2, M[3] = 3, P == 0, Q == 3 }
        M[1] = 4;
        <write barrier>
-        P = 1
+        ACCESS_ONCE(P) = 1
-                        Q = P;
+                              Q = ACCESS_ONCE(P);
-                        <data dependency barrier>
+                              <data dependency barrier>
-                        D = M[Q];
+                              D = M[Q];
-The data dependency barrier is very important to the RCU system, for example.
+The data dependency barrier is very important to the RCU system,
-See rcu_dereference() in include/linux/rcupdate.h.  This permits the current
+for example.  See rcu_assign_pointer() and rcu_dereference() in
-target of an RCU'd pointer to be replaced with a new modified target, without
+include/linux/rcupdate.h.  This permits the current target of an RCU'd
-the replacement target appearing to be incompletely initialised.
+pointer to be replaced with a new modified target, without the replacement
+target appearing to be incompletely initialised.
 See also the subsection on "Cache Coherency" for a more thorough example.
@@ -530,24 +552,190 @@ A control dependency requires a full read memory barrier, not simply a data
 dependency barrier to make it work correctly.  Consider the following bit of
 code:
-        q = &a;
+        q = ACCESS_ONCE(a);
-        if (p) {
+        if (q) {
-                <data dependency barrier>
+                <data dependency barrier>  /* BUG: No data dependency!!! */
-                q = &b;
+                p = ACCESS_ONCE(b);
        }
-        x = *q;
 This will not have the desired effect because there is no actual data
-dependency, but rather a control dependency that the CPU may short-circuit by
+dependency, but rather a control dependency that the CPU may short-circuit
-attempting to predict the outcome in advance.  In such a case what's actually
+by attempting to predict the outcome in advance, so that other CPUs see
-required is:
+the load from b as having happened before the load from a.  In such a
+case what's actually required is:
-        q = &a;
+        q = ACCESS_ONCE(a);
-        if (p) {
+        if (q) {
                <read barrier>
-                q = &b;
+                p = ACCESS_ONCE(b);
+        }
+However, stores are not speculated.  This means that ordering -is- provided
+in the following example:
+        q = ACCESS_ONCE(a);
+        if (ACCESS_ONCE(q)) {
+                ACCESS_ONCE(b) = p;
+        }
+Please note that ACCESS_ONCE() is not optional!  Without the ACCESS_ONCE(),
+the compiler is within its rights to transform this example:
+        q = a;
+        if (q) {
+                b = p;  /* BUG: Compiler can reorder!!! */
+                do_something();
+        } else {
+                b = p;  /* BUG: Compiler can reorder!!! */
+                do_something_else();
+        }
+into this, which of course defeats the ordering:
+        b = p;
+        q = a;
+        if (q)
+                do_something();
+        else
+                do_something_else();
+Worse yet, if the compiler is able to prove (say) that the value of
+variable 'a' is always non-zero, it would be well within its rights
+to optimize the original example by eliminating the "if" statement
+as follows:
+        q = a;
+        b = p;  /* BUG: Compiler can reorder!!! */
+        do_something();
+The solution is again ACCESS_ONCE(), which preserves the ordering between
+the load from variable 'a' and the store to variable 'b':
+        q = ACCESS_ONCE(a);
+        if (q) {
+                ACCESS_ONCE(b) = p;
+                do_something();
+        } else {
+                ACCESS_ONCE(b) = p;
+                do_something_else();
+        }
+You could also use barrier() to prevent the compiler from moving
+the stores to variable 'b', but barrier() would not prevent the
+compiler from proving to itself that a==1 always, so ACCESS_ONCE()
+is also needed.
+It is important to note that control dependencies absolutely require a
+a conditional.  For example, the following "optimized" version of
+the above example breaks ordering:
+        q = ACCESS_ONCE(a);
+        ACCESS_ONCE(b) = p;  /* BUG: No ordering vs. load from a!!! */
+        if (q) {
+                /* ACCESS_ONCE(b) = p; -- moved up, BUG!!! */
+                do_something();
+        } else {
+                /* ACCESS_ONCE(b) = p; -- moved up, BUG!!! */
+                do_something_else();
        }
-        x = *q;
+It is of course legal for the prior load to be part of the conditional,
+for example, as follows:
+        if (ACCESS_ONCE(a) > 0) {
+                ACCESS_ONCE(b) = q / 2;
+                do_something();
+        } else {
+                ACCESS_ONCE(b) = q / 3;
+                do_something_else();
+        }
+This will again ensure that the load from variable 'a' is ordered before the
+stores to variable 'b'.
+In addition, you need to be careful what you do with the local variable 'q',
+otherwise the compiler might be able to guess the value and again remove
+the needed conditional.  For example:
+        q = ACCESS_ONCE(a);
+        if (q % MAX) {
+                ACCESS_ONCE(b) = p;
+                do_something();
+        } else {
+                ACCESS_ONCE(b) = p;
+                do_something_else();
+        }
+If MAX is defined to be 1, then the compiler knows that (q % MAX) is
+equal to zero, in which case the compiler is within its rights to
+transform the above code into the following:
+        q = ACCESS_ONCE(a);
+        ACCESS_ONCE(b) = p;
+        do_something_else();
+This transformation loses the ordering between the load from variable 'a'
+and the store to variable 'b'.  If you are relying on this ordering, you
+should do something like the following:
+        q = ACCESS_ONCE(a);
+        BUILD_BUG_ON(MAX <= 1); /* Order load from a with store to b. */
+        if (q % MAX) {
+                ACCESS_ONCE(b) = p;
+                do_something();
+        } else {
+                ACCESS_ONCE(b) = p;
+                do_something_else();
+        }
+Finally, control dependencies do -not- provide transitivity.  This is
+demonstrated by two related examples:
+        CPU 0                     CPU 1
+        =====================     =====================
+        r1 = ACCESS_ONCE(x);      r2 = ACCESS_ONCE(y);
+        if (r1 >= 0)              if (r2 >= 0)
+          ACCESS_ONCE(y) = 1;       ACCESS_ONCE(x) = 1;
+        assert(!(r1 == 1 && r2 == 1));
+The above two-CPU example will never trigger the assert().  However,
+if control dependencies guaranteed transitivity (which they do not),
+then adding the following two CPUs would guarantee a related assertion:
+        CPU 2                     CPU 3
+        =====================     =====================
+        ACCESS_ONCE(x) = 2;       ACCESS_ONCE(y) = 2;
+        assert(!(r1 == 2 && r2 == 2 && x == 1 && y == 1)); /* FAILS!!! */
+But because control dependencies do -not- provide transitivity, the
+above assertion can fail after the combined four-CPU example completes.
+If you need the four-CPU example to provide ordering, you will need
+smp_mb() between the loads and stores in the CPU 0 and CPU 1 code fragments.
+In summary:
+  (*) Control dependencies can order prior loads against later stores.
+      However, they do -not- guarantee any other sort of ordering:
+      Not prior loads against later loads, nor prior stores against
+      later anything.  If you need these other forms of ordering,
+      use smb_rmb(), smp_wmb(), or, in the case of prior stores and
+      later loads, smp_mb().
+  (*) Control dependencies require at least one run-time conditional
+      between the prior load and the subsequent store.  If the compiler
+      is able to optimize the conditional away, it will have also
+      optimized away the ordering.  Careful use of ACCESS_ONCE() can
+      help to preserve the needed conditional.
+  (*) Control dependencies require that the compiler avoid reordering the
+      dependency into nonexistence.  Careful use of ACCESS_ONCE() or
+      barrier() can help to preserve your control dependency.  Please
+      see the Compiler Barrier section for more information.
+  (*) Control dependencies do -not- provide transitivity.  If you
+      need transitivity, use smp_mb().
 SMP BARRIER PAIRING
@@ -561,23 +749,23 @@ barrier, though a general barrier would also be viable.  Similarly a read
 barrier or a data dependency barrier should always be paired with at least an
 write barrier, though, again, a general barrier is viable:
-        CPU 1           CPU 2
+        CPU 1                 CPU 2
-        =============== ===============
+        ===============       ===============
-        a = 1;
+        ACCESS_ONCE(a) = 1;
        <write barrier>
-        b = 2;          x = b;
+        ACCESS_ONCE(b) = 2;   x = ACCESS_ONCE(b);
-                        <read barrier>
+                              <read barrier>
-                        y = a;
+                              y = ACCESS_ONCE(a);
 Or:
-        CPU 1           CPU 2
+        CPU 1                 CPU 2
-        =============== ===============================
+        ===============       ===============================
        a = 1;
        <write barrier>
-        b = &a;         x = b;
+        ACCESS_ONCE(b) = &a;  x = ACCESS_ONCE(b);
-                        <data dependency barrier>
+                              <data dependency barrier>
-                        y = *x;
+                              y = *x;
 Basically, the read barrier always has to be there, even though it can be of
 the "weaker" type.
@@ -586,13 +774,13 @@ the "weaker" type.
 match the loads after the read barrier or the data dependency barrier, and vice
 versa:
-        CPU 1                           CPU 2
+        CPU 1                               CPU 2
-        ===============                 ===============
+        ===================                 ===================
-        a = 1;           }----   --->{  v = c
+        ACCESS_ONCE(a) = 1;  }----   --->{  v = ACCESS_ONCE(c);
-        b = 2;           }    \ /    {  w = d
+        ACCESS_ONCE(b) = 2;  }    \ /    {  w = ACCESS_ONCE(d);
-        <write barrier>        \        <read barrier>
+        <write barrier>            \        <read barrier>
-        c = 3;           }    / \    {  x = a;
+        ACCESS_ONCE(c) = 3;  }    / \    {  x = ACCESS_ONCE(a);
-        d = 4;           }----   --->{  y = b;
+        ACCESS_ONCE(d) = 4;  }----   --->{  y = ACCESS_ONCE(b);
 EXAMPLES OF MEMORY BARRIER SEQUENCES
@@ -882,12 +1070,12 @@ cache it for later use.
 Consider:
-        CPU 1                   CPU 2
+        CPU 1                   CPU 2
        ======================= =======================
-                                LOAD B
+                                LOAD B
-                                DIVIDE          } Divide instructions generally
+                                DIVIDE          } Divide instructions generally
-                                DIVIDE          } take a long time to perform
+                                DIVIDE          } take a long time to perform
-                                LOAD A
+                                LOAD A
 Which might appear as this:
@@ -910,13 +1098,13 @@ Which might appear as this:
 Placing a read barrier or a data dependency barrier just before the second
 load:
-        CPU 1                   CPU 2
+        CPU 1                   CPU 2
        ======================= =======================
-                                LOAD B
+                                LOAD B
-                                DIVIDE
+                                DIVIDE
-                                DIVIDE
+                                DIVIDE
                                <read barrier>
-                                LOAD A
+                                LOAD A
 will force any value speculatively obtained to be reconsidered to an extent
 dependent on the type of barrier used.  If there was no change made to the
@@ -1042,10 +1230,277 @@ compiler from moving the memory accesses either side of it to the other side:
        barrier();
-This is a general barrier - lesser varieties of compiler barrier do not exist.
+This is a general barrier -- there are no read-read or write-write variants
+of barrier().  However, ACCESS_ONCE() can be thought of as a weak form
+for barrier() that affects only the specific accesses flagged by the
+ACCESS_ONCE().
+The barrier() function has the following effects:
+ (*) Prevents the compiler from reordering accesses following the
+     barrier() to precede any accesses preceding the barrier().
+     One example use for this property is to ease communication between
+     interrupt-handler code and the code that was interrupted.
+ (*) Within a loop, forces the compiler to load the variables used
+     in that loop's conditional on each pass through that loop.
+The ACCESS_ONCE() function can prevent any number of optimizations that,
+while perfectly safe in single-threaded code, can be fatal in concurrent
+code.  Here are some examples of these sorts of optimizations:
+ (*) The compiler is within its rights to merge successive loads from
+     the same variable.  Such merging can cause the compiler to "optimize"
+     the following code:
+        while (tmp = a)
+                do_something_with(tmp);
+     into the following code, which, although in some sense legitimate
+     for single-threaded code, is almost certainly not what the developer
+     intended:
+        if (tmp = a)
+                for (;;)
+                        do_something_with(tmp);
+     Use ACCESS_ONCE() to prevent the compiler from doing this to you:
+        while (tmp = ACCESS_ONCE(a))
+                do_something_with(tmp);
+ (*) The compiler is within its rights to reload a variable, for example,
+     in cases where high register pressure prevents the compiler from
+     keeping all data of interest in registers.  The compiler might
+     therefore optimize the variable 'tmp' out of our previous example:
+        while (tmp = a)
+                do_something_with(tmp);
+     This could result in the following code, which is perfectly safe in
+     single-threaded code, but can be fatal in concurrent code:
+        while (a)
+                do_something_with(a);
+     For example, the optimized version of this code could result in
+     passing a zero to do_something_with() in the case where the variable
+     a was modified by some other CPU between the "while" statement and
+     the call to do_something_with().
+     Again, use ACCESS_ONCE() to prevent the compiler from doing this:
+        while (tmp = ACCESS_ONCE(a))
+                do_something_with(tmp);
+     Note that if the compiler runs short of registers, it might save
+     tmp onto the stack.  The overhead of this saving and later restoring
+     is why compilers reload variables.  Doing so is perfectly safe for
+     single-threaded code, so you need to tell the compiler about cases
+     where it is not safe.
+ (*) The compiler is within its rights to omit a load entirely if it knows
+     what the value will be.  For example, if the compiler can prove that
+     the value of variable 'a' is always zero, it can optimize this code:
+        while (tmp = a)
+                do_something_with(tmp);
-The compiler barrier has no direct effect on the CPU, which may then reorder
+     Into this:
-things however it wishes.
+        do { } while (0);
+     This transformation is a win for single-threaded code because it gets
+     rid of a load and a branch.  The problem is that the compiler will
+     carry out its proof assuming that the current CPU is the only one
+     updating variable 'a'.  If variable 'a' is shared, then the compiler's
+     proof will be erroneous.  Use ACCESS_ONCE() to tell the compiler
+     that it doesn't know as much as it thinks it does:
+        while (tmp = ACCESS_ONCE(a))
+                do_something_with(tmp);
+     But please note that the compiler is also closely watching what you
+     do with the value after the ACCESS_ONCE().  For example, suppose you
+     do the following and MAX is a preprocessor macro with the value 1:
+        while ((tmp = ACCESS_ONCE(a)) % MAX)
+                do_something_with(tmp);
+     Then the compiler knows that the result of the "%" operator applied
+     to MAX will always be zero, again allowing the compiler to optimize
+     the code into near-nonexistence.  (It will still load from the
+     variable 'a'.)
+ (*) Similarly, the compiler is within its rights to omit a store entirely
+     if it knows that the variable already has the value being stored.
+     Again, the compiler assumes that the current CPU is the only one
+     storing into the variable, which can cause the compiler to do the
+     wrong thing for shared variables.  For example, suppose you have
+     the following:
+        a = 0;
+        /* Code that does not store to variable a. */
+        a = 0;
+     The compiler sees that the value of variable 'a' is already zero, so
+     it might well omit the second store.  This would come as a fatal
+     surprise if some other CPU might have stored to variable 'a' in the
+     meantime.
+     Use ACCESS_ONCE() to prevent the compiler from making this sort of
+     wrong guess:
+        ACCESS_ONCE(a) = 0;
+        /* Code that does not store to variable a. */
+        ACCESS_ONCE(a) = 0;
+ (*) The compiler is within its rights to reorder memory accesses unless
+     you tell it not to.  For example, consider the following interaction
+     between process-level code and an interrupt handler:
+        void process_level(void)
+        {
+                msg = get_message();
+                flag = true;
+        }
+        void interrupt_handler(void)
+        {
+                if (flag)
+                        process_message(msg);
+        }
+     There is nothing to prevent the the compiler from transforming
+     process_level() to the following, in fact, this might well be a
+     win for single-threaded code:
+        void process_level(void)
+        {
+                flag = true;
+                msg = get_message();
+        }
+     If the interrupt occurs between these two statement, then
+     interrupt_handler() might be passed a garbled msg.  Use ACCESS_ONCE()
+     to prevent this as follows:
+        void process_level(void)
+        {
+                ACCESS_ONCE(msg) = get_message();
+                ACCESS_ONCE(flag) = true;
+        }
+        void interrupt_handler(void)
+        {
+                if (ACCESS_ONCE(flag))
+                        process_message(ACCESS_ONCE(msg));
+        }
+     Note that the ACCESS_ONCE() wrappers in interrupt_handler()
+     are needed if this interrupt handler can itself be interrupted
+     by something that also accesses 'flag' and 'msg', for example,
+     a nested interrupt or an NMI.  Otherwise, ACCESS_ONCE() is not
+     needed in interrupt_handler() other than for documentation purposes.
+     (Note also that nested interrupts do not typically occur in modern
+     Linux kernels, in fact, if an interrupt handler returns with
+     interrupts enabled, you will get a WARN_ONCE() splat.)
+     You should assume that the compiler can move ACCESS_ONCE() past
+     code not containing ACCESS_ONCE(), barrier(), or similar primitives.
+     This effect could also be achieved using barrier(), but ACCESS_ONCE()
+     is more selective:  With ACCESS_ONCE(), the compiler need only forget
+     the contents of the indicated memory locations, while with barrier()
+     the compiler must discard the value of all memory locations that
+     it has currented cached in any machine registers.  Of course,
+     the compiler must also respect the order in which the ACCESS_ONCE()s
+     occur, though the CPU of course need not do so.
+ (*) The compiler is within its rights to invent stores to a variable,
+     as in the following example:
+        if (a)
+                b = a;
+        else
+                b = 42;
+     The compiler might save a branch by optimizing this as follows:
+        b = 42;
+        if (a)
+                b = a;
+     In single-threaded code, this is not only safe, but also saves
+     a branch.  Unfortunately, in concurrent code, this optimization
+     could cause some other CPU to see a spurious value of 42 -- even
+     if variable 'a' was never zero -- when loading variable 'b'.
+     Use ACCESS_ONCE() to prevent this as follows:
+        if (a)
+                ACCESS_ONCE(b) = a;
+        else
+                ACCESS_ONCE(b) = 42;
+     The compiler can also invent loads.  These are usually less
+     damaging, but they can result in cache-line bouncing and thus in
+     poor performance and scalability.  Use ACCESS_ONCE() to prevent
+     invented loads.
+ (*) For aligned memory locations whose size allows them to be accessed
+     with a single memory-reference instruction, prevents "load tearing"
+     and "store tearing," in which a single large access is replaced by
+     multiple smaller accesses.  For example, given an architecture having
+     16-bit store instructions with 7-bit immediate fields, the compiler
+     might be tempted to use two 16-bit store-immediate instructions to
+     implement the following 32-bit store:
+        p = 0x00010002;
+     Please note that GCC really does use this sort of optimization,
+     which is not surprising given that it would likely take more
+     than two instructions to build the constant and then store it.
+     This optimization can therefore be a win in single-threaded code.
+     In fact, a recent bug (since fixed) caused GCC to incorrectly use
+     this optimization in a volatile store.  In the absence of such bugs,
+     use of ACCESS_ONCE() prevents store tearing in the following example:
+        ACCESS_ONCE(p) = 0x00010002;
+     Use of packed structures can also result in load and store tearing,
+     as in this example:
+        struct __attribute__((__packed__)) foo {
+                short a;
+                int b;
+                short c;
+        };
+        struct foo foo1, foo2;
+        ...
+        foo2.a = foo1.a;
+        foo2.b = foo1.b;
+        foo2.c = foo1.c;
+     Because there are no ACCESS_ONCE() wrappers and no volatile markings,
+     the compiler would be well within its rights to implement these three
+     assignment statements as a pair of 32-bit loads followed by a pair
+     of 32-bit stores.  This would result in load tearing on 'foo1.b'
+     and store tearing on 'foo2.b'.  ACCESS_ONCE() again prevents tearing
+     in this example:
+        foo2.a = foo1.a;
+        ACCESS_ONCE(foo2.b) = ACCESS_ONCE(foo1.b);
+        foo2.c = foo1.c;
+All that aside, it is never necessary to use ACCESS_ONCE() on a variable
+that has been marked volatile.  For example, because 'jiffies' is marked
+volatile, it is never necessary to say ACCESS_ONCE(jiffies).  The reason
+for this is that ACCESS_ONCE() is implemented as a volatile cast, which
+has no effect when its argument is already marked volatile.
+Please note that these compiler barriers have no direct effect on the CPU,
+which may then reorder things however it wishes.
 CPU MEMORY BARRIERS
@@ -1135,7 +1590,7 @@ There are some more advanced barrier functions:
        clear_bit( ... );
     This prevents memory operations before the clear leaking to after it.  See
-     the subsection on "Locking Functions" with reference to UNLOCK operation
+     the subsection on "Locking Functions" with reference to RELEASE operation
     implications.
     See Documentation/atomic_ops.txt for more information.  See the "Atomic
@@ -1169,8 +1624,8 @@ provide more substantial guarantees, but these may not be relied upon outside
 of arch specific code.
-LOCKING FUNCTIONS
+ACQUIRING FUNCTIONS
-----------------
+-------------------
 The Linux kernel has a number of locking constructs:
@@ -1181,65 +1636,107 @@ The Linux kernel has a number of locking constructs:
 (*) R/W semaphores
 (*) RCU
-In all cases there are variants on "LOCK" operations and "UNLOCK" operations
+In all cases there are variants on "ACQUIRE" operations and "RELEASE" operations
 for each construct.  These operations all imply certain barriers:
- (1) LOCK operation implication:
+ (1) ACQUIRE operation implication:
-     Memory operations issued after the LOCK will be completed after the LOCK
+     Memory operations issued after the ACQUIRE will be completed after the
-     operation has completed.
+     ACQUIRE operation has completed.
-     Memory operations issued before the LOCK may be completed after the LOCK
+     Memory operations issued before the ACQUIRE may be completed after the
-     operation has completed.
+     ACQUIRE operation has completed.  An smp_mb__before_spinlock(), combined
+     with a following ACQUIRE, orders prior loads against subsequent stores and
+     stores and prior stores against subsequent stores.  Note that this is
+     weaker than smp_mb()!  The smp_mb__before_spinlock() primitive is free on
+     many architectures.
- (2) UNLOCK operation implication:
+ (2) RELEASE operation implication:
-     Memory operations issued before the UNLOCK will be completed before the
+     Memory operations issued before the RELEASE will be completed before the
-     UNLOCK operation has completed.
+     RELEASE operation has completed.
-     Memory operations issued after the UNLOCK may be completed before the
+     Memory operations issued after the RELEASE may be completed before the
-     UNLOCK operation has completed.
+     RELEASE operation has completed.
- (3) LOCK vs LOCK implication:
+ (3) ACQUIRE vs ACQUIRE implication:
-     All LOCK operations issued before another LOCK operation will be completed
+     All ACQUIRE operations issued before another ACQUIRE operation will be
-     before that LOCK operation.
+     completed before that ACQUIRE operation.
- (4) LOCK vs UNLOCK implication:
+ (4) ACQUIRE vs RELEASE implication:
-     All LOCK operations issued before an UNLOCK operation will be completed
+     All ACQUIRE operations issued before a RELEASE operation will be
-     before the UNLOCK operation.
+     completed before the RELEASE operation.
-     All UNLOCK operations issued before a LOCK operation will be completed
+ (5) Failed conditional ACQUIRE implication:
-     before the LOCK operation.
- (5) Failed conditional LOCK implication:
+     Certain locking variants of the ACQUIRE operation may fail, either due to
+     being unable to get the lock immediately, or due to receiving an unblocked
-     Certain variants of the LOCK operation may fail, either due to being
-     unable to get the lock immediately, or due to receiving an unblocked
     signal whilst asleep waiting for the lock to become available.  Failed
     locks do not imply any sort of barrier.
-Therefore, from (1), (2) and (4) an UNLOCK followed by an unconditional LOCK is
+[!] Note: one of the consequences of lock ACQUIREs and RELEASEs being only
-equivalent to a full barrier, but a LOCK followed by an UNLOCK is not.
+one-way barriers is that the effects of instructions outside of a critical
+section may seep into the inside of the critical section.
-[!] Note: one of the consequences of LOCKs and UNLOCKs being only one-way
-    barriers is that the effects of instructions outside of a critical section
-    may seep into the inside of the critical section.
-A LOCK followed by an UNLOCK may not be assumed to be full memory barrier
+An ACQUIRE followed by a RELEASE may not be assumed to be full memory barrier
-because it is possible for an access preceding the LOCK to happen after the
+because it is possible for an access preceding the ACQUIRE to happen after the
-LOCK, and an access following the UNLOCK to happen before the UNLOCK, and the
+ACQUIRE, and an access following the RELEASE to happen before the RELEASE, and
-two accesses can themselves then cross:
+the two accesses can themselves then cross:
        *A = a;
-        LOCK
+        ACQUIRE M
-        UNLOCK
+        RELEASE M
        *B = b;
 may occur as:
-        LOCK, STORE *B, STORE *A, UNLOCK
+        ACQUIRE M, STORE *B, STORE *A, RELEASE M
+This same reordering can of course occur if the lock's ACQUIRE and RELEASE are
+to the same lock variable, but only from the perspective of another CPU not
+holding that lock.
+In short, a RELEASE followed by an ACQUIRE may -not- be assumed to be a full
+memory barrier because it is possible for a preceding RELEASE to pass a
+later ACQUIRE from the viewpoint of the CPU, but not from the viewpoint
+of the compiler.  Note that deadlocks cannot be introduced by this
+interchange because if such a deadlock threatened, the RELEASE would
+simply complete.
+If it is necessary for a RELEASE-ACQUIRE pair to produce a full barrier, the
+ACQUIRE can be followed by an smp_mb__after_unlock_lock() invocation.  This
+will produce a full barrier if either (a) the RELEASE and the ACQUIRE are
+executed by the same CPU or task, or (b) the RELEASE and ACQUIRE act on the
+same variable.  The smp_mb__after_unlock_lock() primitive is free on many
+architectures.  Without smp_mb__after_unlock_lock(), the critical sections
+corresponding to the RELEASE and the ACQUIRE can cross:
+        *A = a;
+        RELEASE M
+        ACQUIRE N
+        *B = b;
+could occur as:
+        ACQUIRE N, STORE *B, STORE *A, RELEASE M
+With smp_mb__after_unlock_lock(), they cannot, so that:
+        *A = a;
+        RELEASE M
+        ACQUIRE N
+        smp_mb__after_unlock_lock();
+        *B = b;
+will always occur as either of the following:
+        STORE *A, RELEASE, ACQUIRE, STORE *B
+        STORE *A, ACQUIRE, RELEASE, STORE *B
+If the RELEASE and ACQUIRE were instead both operating on the same lock
+variable, only the first of these two alternatives can occur.
 Locks and semaphores may not provide any guarantee of ordering on UP compiled
 systems, and so cannot be counted on in such a situation to actually achieve
@@ -1253,33 +1750,33 @@ As an example, consider the following:
        *A = a;
        *B = b;
-        LOCK
+        ACQUIRE
        *C = c;
        *D = d;
-        UNLOCK
+        RELEASE
        *E = e;
        *F = f;
 The following sequence of events is acceptable:
-        LOCK, {*F,*A}, *E, {*C,*D}, *B, UNLOCK
+        ACQUIRE, {*F,*A}, *E, {*C,*D}, *B, RELEASE
        [+] Note that {*F,*A} indicates a combined access.
 But none of the following are:
-        {*F,*A}, *B,    LOCK, *C, *D,   UNLOCK, *E
+        {*F,*A}, *B,    ACQUIRE, *C, *D,        RELEASE, *E
-        *A, *B, *C,     LOCK, *D,       UNLOCK, *E, *F
+        *A, *B, *C,     ACQUIRE, *D,            RELEASE, *E, *F
-        *A, *B,         LOCK, *C,       UNLOCK, *D, *E, *F
+        *A, *B,         ACQUIRE, *C,            RELEASE, *D, *E, *F
-        *B,             LOCK, *C, *D,   UNLOCK, {*F,*A}, *E
+        *B,             ACQUIRE, *C, *D,        RELEASE, {*F,*A}, *E
 INTERRUPT DISABLING FUNCTIONS
 -----------------------------
-Functions that disable interrupts (LOCK equivalent) and enable interrupts
+Functions that disable interrupts (ACQUIRE equivalent) and enable interrupts
-(UNLOCK equivalent) will act as compiler barriers only.  So if memory or I/O
+(RELEASE equivalent) will act as compiler barriers only.  So if memory or I/O
 barriers are required in such a situation, they must be provided from some
 other means.
@@ -1418,75 +1915,81 @@ Other functions that imply barriers:
 (*) schedule() and similar imply full memory barriers.
-=================================
+===================================
-INTER-CPU LOCKING BARRIER EFFECTS
+INTER-CPU ACQUIRING BARRIER EFFECTS
-=================================
+===================================
 On SMP systems locking primitives give a more substantial form of barrier: one
 that does affect memory access ordering on other CPUs, within the context of
 conflict on any particular lock.
-LOCKS VS MEMORY ACCESSES
+ACQUIRES VS MEMORY ACCESSES
------------------------
+---------------------------
 Consider the following: the system has a pair of spinlocks (M) and (Q), and
 three CPUs; then should the following sequence of events occur:
        CPU 1                           CPU 2
        =============================== ===============================
-        *A = a;                         *E = e;
+        ACCESS_ONCE(*A) = a;            ACCESS_ONCE(*E) = e;
-        LOCK M                          LOCK Q
+        ACQUIRE M                       ACQUIRE Q
-        *B = b;                         *F = f;
+        ACCESS_ONCE(*B) = b;            ACCESS_ONCE(*F) = f;
-        *C = c;                         *G = g;
+        ACCESS_ONCE(*C) = c;            ACCESS_ONCE(*G) = g;
-        UNLOCK M                        UNLOCK Q
+        RELEASE M                       RELEASE Q
-        *D = d;                         *H = h;
+        ACCESS_ONCE(*D) = d;            ACCESS_ONCE(*H) = h;
 Then there is no guarantee as to what order CPU 3 will see the accesses to *A
 through *H occur in, other than the constraints imposed by the separate locks
 on the separate CPUs. It might, for example, see:
-        *E, LOCK M, LOCK Q, *G, *C, *F, *A, *B, UNLOCK Q, *D, *H, UNLOCK M
+        *E, ACQUIRE M, ACQUIRE Q, *G, *C, *F, *A, *B, RELEASE Q, *D, *H, RELEASE M
 But it won't see any of:
-        *B, *C or *D preceding LOCK M
+        *B, *C or *D preceding ACQUIRE M
-        *A, *B or *C following UNLOCK M
+        *A, *B or *C following RELEASE M
-        *F, *G or *H preceding LOCK Q
+        *F, *G or *H preceding ACQUIRE Q
-        *E, *F or *G following UNLOCK Q
+        *E, *F or *G following RELEASE Q
 However, if the following occurs:
        CPU 1                           CPU 2
        =============================== ===============================
-        *A = a;
+        ACCESS_ONCE(*A) = a;
-        LOCK M          [1]
+        ACQUIRE M                    [1]
-        *B = b;
+        ACCESS_ONCE(*B) = b;
-        *C = c;
+        ACCESS_ONCE(*C) = c;
-        UNLOCK M        [1]
+        RELEASE M            [1]
-        *D = d;                         *E = e;
+        ACCESS_ONCE(*D) = d;            ACCESS_ONCE(*E) = e;
-                                        LOCK M          [2]
+                                        ACQUIRE M                    [2]
-                                        *F = f;
+                                        smp_mb__after_unlock_lock();
-                                        *G = g;
+                                        ACCESS_ONCE(*F) = f;
-                                        UNLOCK M        [2]
+                                        ACCESS_ONCE(*G) = g;
-                                        *H = h;
+                                        RELEASE M            [2]
+                                        ACCESS_ONCE(*H) = h;
 CPU 3 might see:
-        *E, LOCK M [1], *C, *B, *A, UNLOCK M [1],
+        *E, ACQUIRE M [1], *C, *B, *A, RELEASE M [1],
-                LOCK M [2], *H, *F, *G, UNLOCK M [2], *D
+                ACQUIRE M [2], *H, *F, *G, RELEASE M [2], *D
 But assuming CPU 1 gets the lock first, CPU 3 won't see any of:
-        *B, *C, *D, *F, *G or *H preceding LOCK M [1]
+        *B, *C, *D, *F, *G or *H preceding ACQUIRE M [1]
-        *A, *B or *C following UNLOCK M [1]
+        *A, *B or *C following RELEASE M [1]
-        *F, *G or *H preceding LOCK M [2]
+        *F, *G or *H preceding ACQUIRE M [2]
-        *A, *B, *C, *E, *F or *G following UNLOCK M [2]
+        *A, *B, *C, *E, *F or *G following RELEASE M [2]
+Note that the smp_mb__after_unlock_lock() is critically important
+here: Without it CPU 3 might see some of the above orderings.
+Without smp_mb__after_unlock_lock(), the accesses are not guaranteed
+to be seen in order unless CPU 3 holds lock M.
-LOCKS VS I/O ACCESSES
---------------------
+ACQUIRES VS I/O ACCESSES
+------------------------
 Under certain circumstances (especially involving NUMA), I/O accesses within
 two spinlocked sections on two different CPUs may be seen as interleaved by the
@@ -1687,28 +2190,30 @@ explicit lock operations, described later).  These include:
        xchg();
        cmpxchg();
-        atomic_xchg();
+        atomic_xchg();                  atomic_long_xchg();
-        atomic_cmpxchg();
+        atomic_cmpxchg();               atomic_long_cmpxchg();
-        atomic_inc_return();
+        atomic_inc_return();            atomic_long_inc_return();
-        atomic_dec_return();
+        atomic_dec_return();            atomic_long_dec_return();
-        atomic_add_return();
+        atomic_add_return();            atomic_long_add_return();
-        atomic_sub_return();
+        atomic_sub_return();            atomic_long_sub_return();
-        atomic_inc_and_test();
+        atomic_inc_and_test();          atomic_long_inc_and_test();
-        atomic_dec_and_test();
+        atomic_dec_and_test();          atomic_long_dec_and_test();
-        atomic_sub_and_test();
+        atomic_sub_and_test();          atomic_long_sub_and_test();
-        atomic_add_negative();
+        atomic_add_negative();          atomic_long_add_negative();
-        atomic_add_unless();    /* when succeeds (returns 1) */
        test_and_set_bit();
        test_and_clear_bit();
        test_and_change_bit();
-These are used for such things as implementing LOCK-class and UNLOCK-class
+        /* when succeeds (returns 1) */
+        atomic_add_unless();            atomic_long_add_unless();
+These are used for such things as implementing ACQUIRE-class and RELEASE-class
 operations and adjusting reference counters towards object destruction, and as
 such the implicit memory barrier effects are necessary.
 The following operations are potential problems as they do _not_ imply memory
-barriers, but might be used for implementing such things as UNLOCK-class
+barriers, but might be used for implementing such things as RELEASE-class
 operations:
        atomic_set();
@@ -1750,7 +2255,7 @@ The following operations are special locking primitives:
        clear_bit_unlock();
        __clear_bit_unlock();
-These implement LOCK-class and UNLOCK-class operations. These should be used in
+These implement ACQUIRE-class and RELEASE-class operations. These should be used in
 preference to other operations when implementing locking primitives, because
 their implementations can be optimised on many architectures.
@@ -1887,8 +2392,8 @@ functions:
     space should suffice for PCI.
     [*] NOTE! attempting to load from the same location as was written to may
-         cause a malfunction - consider the 16550 Rx/Tx serial registers for
+         cause a malfunction - consider the 16550 Rx/Tx serial registers for
-         example.
+         example.
     Used with prefetchable I/O memory, an mmiowb() barrier may be required to
     force stores to be ordered.
@@ -1955,19 +2460,19 @@ barriers for the most part act at the interface between the CPU and its cache
                                  :
        +--------+    +--------+  :   +--------+    +-----------+
        |        |    |        |  :   |        |    |           |    +--------+
-        |  CPU   |    | Memory |  :   | CPU    |    |           |    |        |
+        |  CPU   |    | Memory |  :   | CPU    |    |           |    |        |
-        |  Core  |--->| Access |----->| Cache  |<-->|           |    |        |
+        |  Core  |--->| Access |----->| Cache  |<-->|           |    |        |
        |        |    | Queue  |  :   |        |    |           |--->| Memory |
-        |        |    |        |  :   |        |    |           |    |        |
+        |        |    |        |  :   |        |    |           |    |        |
-        +--------+    +--------+  :   +--------+    |           |    |        |
+        +--------+    +--------+  :   +--------+    |           |    |        |
                                  :                 | Cache     |    +--------+
                                  :                 | Coherency |
                                  :                 | Mechanism |    +--------+
        +--------+    +--------+  :   +--------+    |           |    |        |
        |        |    |        |  :   |        |    |           |    |        |
        |  CPU   |    | Memory |  :   | CPU    |    |           |--->| Device |
-        |  Core  |--->| Access |----->| Cache  |<-->|           |    |        |
+        |  Core  |--->| Access |----->| Cache  |<-->|           |    |        |
-        |        |    | Queue  |  :   |        |    |           |    |        |
+        |        |    | Queue  |  :   |        |    |           |    |        |
        |        |    |        |  :   |        |    |           |    +--------+
        +--------+    +--------+  :   +--------+    +-----------+
                                  :
@@ -2090,7 +2595,7 @@ CPU's caches by some other cache event:
        p = &v;         q = p;
                        <D:request p>
        <B:modify p=&v> <D:commit p=&v>
-                        <D:read p>
+                        <D:read p>
                        x = *q;
                        <C:read *q>     Reads from v before v updated in cache
                        <C:unbusy>
@@ -2115,7 +2620,7 @@ queue before processing any further requests:
        p = &v;         q = p;
                        <D:request p>
        <B:modify p=&v> <D:commit p=&v>
-                        <D:read p>
+                        <D:read p>
                        smp_read_barrier_depends()
                        <C:unbusy>
                        <C:commit v=2>
@@ -2177,11 +2682,11 @@ A programmer might take it for granted that the CPU will perform memory
 operations in exactly the order specified, so that if the CPU is, for example,
 given the following piece of code to execute:
-        a = *A;
+        a = ACCESS_ONCE(*A);
-        *B = b;
+        ACCESS_ONCE(*B) = b;
-        c = *C;
+        c = ACCESS_ONCE(*C);
-        d = *D;
+        d = ACCESS_ONCE(*D);
-        *E = e;
+        ACCESS_ONCE(*E) = e;
 they would then expect that the CPU will complete the memory operation for each
 instruction before moving on to the next one, leading to a definite sequence of
@@ -2228,12 +2733,12 @@ However, it is guaranteed that a CPU will be self-consistent: it will see its
 _own_ accesses appear to be correctly ordered, without the need for a memory
 barrier.  For instance with the following code:
-        U = *A;
+        U = ACCESS_ONCE(*A);
-        *A = V;
+        ACCESS_ONCE(*A) = V;
-        *A = W;
+        ACCESS_ONCE(*A) = W;
-        X = *A;
+        X = ACCESS_ONCE(*A);
-        *A = Y;
+        ACCESS_ONCE(*A) = Y;
-        Z = *A;
+        Z = ACCESS_ONCE(*A);
 and assuming no intervention by an external influence, it can be assumed that
 the final result will appear to be:
@@ -2250,7 +2755,12 @@ accesses:
 in that order, but, without intervention, the sequence may have almost any
 combination of elements combined or discarded, provided the program's view of
-the world remains consistent.
+the world remains consistent.  Note that ACCESS_ONCE() is -not- optional
+in the above example, as there are architectures where a given CPU might
+interchange successive loads to the same location.  On such architectures,
+ACCESS_ONCE() does whatever is necessary to prevent this, for example, on
+Itanium the volatile casts used by ACCESS_ONCE() cause GCC to emit the
+special ld.acq and st.rel instructions that prevent such reordering.
 The compiler may also combine, discard or defer elements of the sequence before
 the CPU even sees them.
@@ -2264,13 +2774,13 @@ may be reduced to:
        *A = W;
-since, without a write barrier, it can be assumed that the effect of the
+since, without either a write barrier or an ACCESS_ONCE(), it can be
-storage of V to *A is lost.  Similarly:
+assumed that the effect of the storage of V to *A is lost.  Similarly:
        *A = Y;
        Z = *A;
-may, without a memory barrier, be reduced to:
+may, without a memory barrier or an ACCESS_ONCE(), be reduced to:
        *A = Y;
        Z = Y;
diff --git a/Documentation/misc-devices/mei/mei-amt-version.c b/Documentation/misc-devices/mei/mei-amt-version.c
index 49e4f770864a..57d0d871dcf7 100644
--- a/Documentation/misc-devices/mei/mei-amt-version.c
+++ b/Documentation/misc-devices/mei/mei-amt-version.c
@@ -115,8 +115,6 @@ static bool mei_init(struct mei *me, const uuid_le *guid,
        struct mei_client *cl;
        struct mei_connect_client_data data;
-        mei_deinit(me);
        me->verbose = verbose;
        me->fd = open("/dev/mei", O_RDWR);
diff --git a/Documentation/robust-futex-ABI.txt b/Documentation/robust-futex-ABI.txt
index fd1cd8aae4eb..16eb314f56cc 100644
--- a/Documentation/robust-futex-ABI.txt
+++ b/Documentation/robust-futex-ABI.txt
@@ -146,8 +146,8 @@ On removal:
 1) set the 'list_op_pending' word to the address of the 'lock entry'
    to be removed,
 2) remove the lock entry for this lock from the 'head' list,
- 2) release the futex lock, and
+ 3) release the futex lock, and
- 2) clear the 'lock_op_pending' word.
+ 4) clear the 'lock_op_pending' word.
 On exit, the kernel will consider the address stored in
 'list_op_pending' and the address of each 'lock word' found by walking
diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
index 26b7ee491df8..6d486404200e 100644
--- a/Documentation/sysctl/kernel.txt
+++ b/Documentation/sysctl/kernel.txt
@@ -428,11 +428,6 @@ rate for each task.
 numa_balancing_scan_size_mb is how many megabytes worth of pages are
 scanned for a given scan.
-numa_balancing_settle_count is how many scan periods must complete before
-the schedule balancer stops pushing the task towards a preferred node. This
-gives the scheduler a chance to place the task on an alternative node if the
-preferred node is overloaded.
 numa_balancing_migrate_deferred is how many page migrations get skipped
 unconditionally, after a page migration is skipped because a page is shared
 with other tasks. This reduces page migration overhead, and determines
diff --git a/Documentation/x86/boot.txt b/Documentation/x86/boot.txt
index f4f268c2b826..cb81741d3b0b 100644
--- a/Documentation/x86/boot.txt
+++ b/Documentation/x86/boot.txt
@@ -608,6 +608,9 @@ Protocol:       2.12+
        - If 1, the kernel supports the 64-bit EFI handoff entry point
          given at handover_offset + 0x200.
+  Bit 4 (read): XLF_EFI_KEXEC
+        - If 1, the kernel supports kexec EFI boot with EFI runtime support.
 Field name:     cmdline_size
 Type:           read
 Offset/size:    0x238/4
diff --git a/Documentation/x86/x86_64/mm.txt b/Documentation/x86/x86_64/mm.txt
index 881582f75c9c..c584a51add15 100644
--- a/Documentation/x86/x86_64/mm.txt
+++ b/Documentation/x86/x86_64/mm.txt
@@ -28,4 +28,11 @@ reference.
 Current X86-64 implementations only support 40 bits of address space,
 but we support up to 46 bits. This expands into MBZ space in the page tables.
+->trampoline_pgd:
+We map EFI runtime services in the aforementioned PGD in the virtual
+range of 64Gb (arbitrarily set, can be raised if needed)
+0xffffffef00000000 - 0xffffffff00000000
 -Andi Kleen, Jul 2004
diff --git a/Documentation/zh_CN/HOWTO b/Documentation/zh_CN/HOWTO
index 7fba5aab9ef9..6c914aa87e71 100644
--- a/Documentation/zh_CN/HOWTO
+++ b/Documentation/zh_CN/HOWTO
@@ -112,7 +112,7 @@ Linux内核代码中包含有大量的文档。这些文档对于学习如何与
    其他关于如何正确地生成补丁的优秀文档包括：
    "The Perfect Patch"
-        http://userweb.kernel.org/~akpm/stuff/tpp.txt
+        http://www.ozlabs.org/~akpm/stuff/tpp.txt
    "Linux kernel patch submission format"
        http://linux.yyz.us/patch-format.html
@@ -515,7 +515,7 @@ Linux内核社区并不喜欢一下接收大段的代码。修改需要被恰当
 想了解它具体应该看起来像什么，请查阅以下文档中的“ChangeLog”章节：
  “The Perfect Patch”
-         http://userweb.kernel.org/~akpm/stuff/tpp.txt
+         http://www.ozlabs.org/~akpm/stuff/tpp.txt
 这些事情有时候做起来很难。要在任何方面都做到完美可能需要好几年时间。这是
diff --git a/Documentation/zorro.txt b/Documentation/zorro.txt
index d5829d14774a..90a64d52bea2 100644
--- a/Documentation/zorro.txt
+++ b/Documentation/zorro.txt
@@ -95,8 +95,9 @@ The treatment of these regions depends on the type of Zorro space:
 -------------
 linux/include/linux/zorro.h
-linux/include/asm-{m68k,ppc}/zorro.h
+linux/include/uapi/linux/zorro.h
-linux/include/linux/zorro_ids.h
+linux/include/uapi/linux/zorro_ids.h
+linux/arch/m68k/include/asm/zorro.h
 linux/drivers/zorro
 /proc/bus/zorro
diff --git a/MAINTAINERS b/MAINTAINERS
index d5e4ff328cc7..12da4885e753 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -783,7 +783,7 @@ F:	arch/arm/boot/dts/sama*.dts
 F:      arch/arm/boot/dts/sama*.dtsi
 ARM/CALXEDA HIGHBANK ARCHITECTURE
-M:      Rob Herring <rob.herring@calxeda.com>
+M:      Rob Herring <robh@kernel.org>
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
 S:      Maintained
 F:      arch/arm/mach-highbank/
@@ -1368,6 +1368,9 @@ T:	git git://git.xilinx.com/linux-xlnx.git
 S:      Supported
 F:      arch/arm/mach-zynq/
 F:      drivers/cpuidle/cpuidle-zynq.c
+N:      zynq
+N:      xilinx
+F:      drivers/clocksource/cadence_ttc_timer.c
 ARM SMMU DRIVER
 M:      Will Deacon <will.deacon@arm.com>
@@ -2616,7 +2619,7 @@ S:	Maintained
 F:      drivers/platform/x86/dell-laptop.c
 DELL LAPTOP SMM DRIVER
-S:      Orphan
+M:      Guenter Roeck <linux@roeck-us.net>
 F:      drivers/char/i8k.c
 F:      include/uapi/linux/i8k.h
@@ -2825,8 +2828,10 @@ F:	include/uapi/drm/
 INTEL DRM DRIVERS (excluding Poulsbo, Moorestown and derivative chipsets)
 M:      Daniel Vetter <daniel.vetter@ffwll.ch>
+M:      Jani Nikula <jani.nikula@linux.intel.com>
 L:      intel-gfx@lists.freedesktop.org
 L:      dri-devel@lists.freedesktop.org
+Q:      http://patchwork.freedesktop.org/project/intel-gfx/
 T:      git git://people.freedesktop.org/~danvet/drm-intel
 S:      Supported
 F:      drivers/gpu/drm/i915/
@@ -3330,6 +3335,7 @@ EXTERNAL CONNECTOR SUBSYSTEM (EXTCON)
 M:      MyungJoo Ham <myungjoo.ham@samsung.com>
 M:      Chanwoo Choi <cw00.choi@samsung.com>
 L:      linux-kernel@vger.kernel.org
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/chanwoo/extcon.git
 S:      Maintained
 F:      drivers/extcon/
 F:      Documentation/extcon/
@@ -5136,6 +5142,11 @@ F:	drivers/lguest/
 F:      include/linux/lguest*.h
 F:      tools/lguest/
+LIBLOCKDEP
+M:      Sasha Levin <sasha.levin@oracle.com>
+S:      Maintained
+F:      tools/lib/lockdep/
 LINUX FOR IBM pSERIES (RS/6000)
 M:      Paul Mackerras <paulus@au.ibm.com>
 W:      http://www.ibm.com/linux/ltc/projects/ppc
@@ -6256,7 +6267,7 @@ F:	drivers/i2c/busses/i2c-ocores.c
 OPEN FIRMWARE AND FLATTENED DEVICE TREE
 M:      Grant Likely <grant.likely@linaro.org>
-M:      Rob Herring <rob.herring@calxeda.com>
+M:      Rob Herring <robh+dt@kernel.org>
 L:      devicetree@vger.kernel.org
 W:      http://fdt.secretlab.ca
 T:      git git://git.secretlab.ca/git/linux-2.6.git
@@ -6268,7 +6279,7 @@ K:	of_get_property
 K:      of_match_table
 OPEN FIRMWARE AND FLATTENED DEVICE TREE BINDINGS
-M:      Rob Herring <rob.herring@calxeda.com>
+M:      Rob Herring <robh+dt@kernel.org>
 M:      Pawel Moll <pawel.moll@arm.com>
 M:      Mark Rutland <mark.rutland@arm.com>
 M:      Ian Campbell <ijc+devicetree@hellion.org.uk>
@@ -7094,6 +7105,12 @@ T:	git git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu.git
 F:      Documentation/RCU/torture.txt
 F:      kernel/rcu/torture.c
+RCUTORTURE TEST FRAMEWORK
+M:      "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
+S:      Supported
+T:      git git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu.git
+F:      tools/testing/selftests/rcutorture
 RDC R-321X SoC
 M:      Florian Fainelli <florian@openwrt.org>
 S:      Maintained
@@ -9226,6 +9243,7 @@ F:	include/media/videobuf2-*
 VIRTIO CONSOLE DRIVER
 M:      Amit Shah <amit.shah@redhat.com>
+L:      virtio-dev@lists.oasis-open.org
 L:      virtualization@lists.linux-foundation.org
 S:      Maintained
 F:      drivers/char/virtio_console.c
@@ -9235,6 +9253,7 @@ F:	include/uapi/linux/virtio_console.h
 VIRTIO CORE, NET AND BLOCK DRIVERS
 M:      Rusty Russell <rusty@rustcorp.com.au>
 M:      "Michael S. Tsirkin" <mst@redhat.com>
+L:      virtio-dev@lists.oasis-open.org
 L:      virtualization@lists.linux-foundation.org
 S:      Maintained
 F:      drivers/virtio/
@@ -9247,6 +9266,7 @@ F:	include/uapi/linux/virtio_*.h
 VIRTIO HOST (VHOST)
 M:      "Michael S. Tsirkin" <mst@redhat.com>
 L:      kvm@vger.kernel.org
+L:      virtio-dev@lists.oasis-open.org
 L:      virtualization@lists.linux-foundation.org
 L:      netdev@vger.kernel.org
 S:      Maintained
diff --git a/Makefile b/Makefile
index 14d592cbbc5f..455fd484b20e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 13
 SUBLEVEL = 0
-EXTRAVERSION = -rc5
+EXTRAVERSION =
 NAME = One Giant Leap for Frogkind
 # *DOCUMENTATION*
@@ -595,10 +595,24 @@ ifneq ($(CONFIG_FRAME_WARN),0)
 KBUILD_CFLAGS += $(call cc-option,-Wframe-larger-than=${CONFIG_FRAME_WARN})
 endif
-# Force gcc to behave correct even for buggy distributions
+# Handle stack protector mode.
-ifndef CONFIG_CC_STACKPROTECTOR
+ifdef CONFIG_CC_STACKPROTECTOR_REGULAR
-KBUILD_CFLAGS += $(call cc-option, -fno-stack-protector)
+  stackp-flag := -fstack-protector
+  ifeq ($(call cc-option, $(stackp-flag)),)
+    $(warning Cannot use CONFIG_CC_STACKPROTECTOR: \
+              -fstack-protector not supported by compiler))
+  endif
+else ifdef CONFIG_CC_STACKPROTECTOR_STRONG
+  stackp-flag := -fstack-protector-strong
+  ifeq ($(call cc-option, $(stackp-flag)),)
+    $(warning Cannot use CONFIG_CC_STACKPROTECTOR_STRONG: \
+              -fstack-protector-strong not supported by compiler)
+  endif
+else
+  # Force off for distro compilers that enable stack protector by default.
+  stackp-flag := $(call cc-option, -fno-stack-protector)
 endif
+KBUILD_CFLAGS += $(stackp-flag)
 # This warning generated too much noise in a regular build.
 # Use make W=1 to enable this warning (see scripts/Makefile.build)
diff --git a/arch/Kconfig b/arch/Kconfig
index f1cf895c040f..80bbb8ccd0d1 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -336,6 +336,73 @@ config SECCOMP_FILTER
          See Documentation/prctl/seccomp_filter.txt for details.
+config HAVE_CC_STACKPROTECTOR
+        bool
+        help
+          An arch should select this symbol if:
+          - its compiler supports the -fstack-protector option
+          - it has implemented a stack canary (e.g. __stack_chk_guard)
+config CC_STACKPROTECTOR
+        def_bool n
+        help
+          Set when a stack-protector mode is enabled, so that the build
+          can enable kernel-side support for the GCC feature.
+choice
+        prompt "Stack Protector buffer overflow detection"
+        depends on HAVE_CC_STACKPROTECTOR
+        default CC_STACKPROTECTOR_NONE
+        help
+          This option turns on the "stack-protector" GCC feature. This
+          feature puts, at the beginning of functions, a canary value on
+          the stack just before the return address, and validates
+          the value just before actually returning.  Stack based buffer
+          overflows (that need to overwrite this return address) now also
+          overwrite the canary, which gets detected and the attack is then
+          neutralized via a kernel panic.
+config CC_STACKPROTECTOR_NONE
+        bool "None"
+        help
+          Disable "stack-protector" GCC feature.
+config CC_STACKPROTECTOR_REGULAR
+        bool "Regular"
+        select CC_STACKPROTECTOR
+        help
+          Functions will have the stack-protector canary logic added if they
+          have an 8-byte or larger character array on the stack.
+          This feature requires gcc version 4.2 or above, or a distribution
+          gcc with the feature backported ("-fstack-protector").
+          On an x86 "defconfig" build, this feature adds canary checks to
+          about 3% of all kernel functions, which increases kernel code size
+          by about 0.3%.
+config CC_STACKPROTECTOR_STRONG
+        bool "Strong"
+        select CC_STACKPROTECTOR
+        help
+          Functions will have the stack-protector canary logic added in any
+          of the following conditions:
+          - local variable's address used as part of the right hand side of an
+            assignment or function argument
+          - local variable is an array (or union containing an array),
+            regardless of array type or length
+          - uses register local variables
+          This feature requires gcc version 4.9 or above, or a distribution
+          gcc with the feature backported ("-fstack-protector-strong").
+          On an x86 "defconfig" build, this feature adds canary checks to
+          about 20% of all kernel functions, which increases the kernel code
+          size by about 2%.
+endchoice
 config HAVE_CONTEXT_TRACKING
        bool
        help
diff --git a/arch/alpha/include/asm/barrier.h b/arch/alpha/include/asm/barrier.h
index ce8860a0b32d..3832bdb794fe 100644
--- a/arch/alpha/include/asm/barrier.h
+++ b/arch/alpha/include/asm/barrier.h
@@ -3,33 +3,18 @@
 #include <asm/compiler.h>
-#define mb() \
+#define mb()    __asm__ __volatile__("mb": : :"memory")
-__asm__ __volatile__("mb": : :"memory")
+#define rmb()   __asm__ __volatile__("mb": : :"memory")
+#define wmb()   __asm__ __volatile__("wmb": : :"memory")
-#define rmb() \
+#define read_barrier_depends() __asm__ __volatile__("mb": : :"memory")
-__asm__ __volatile__("mb": : :"memory")
-#define wmb() \
-__asm__ __volatile__("wmb": : :"memory")
-#define read_barrier_depends() \
-__asm__ __volatile__("mb": : :"memory")
 #ifdef CONFIG_SMP
 #define __ASM_SMP_MB    "\tmb\n"
-#define smp_mb()        mb()
-#define smp_rmb()       rmb()
-#define smp_wmb()       wmb()
-#define smp_read_barrier_depends()      read_barrier_depends()
 #else
 #define __ASM_SMP_MB
-#define smp_mb()        barrier()
-#define smp_rmb()       barrier()
-#define smp_wmb()       barrier()
-#define smp_read_barrier_depends()      do { } while (0)
 #endif
-#define set_mb(var, value) \
+#include <asm-generic/barrier.h>
-do { var = value; mb(); } while (0)
 #endif          /* __BARRIER_H */
diff --git a/arch/arc/include/asm/Kbuild b/arch/arc/include/asm/Kbuild
index 5943f7f9d325..9ae21c198007 100644
--- a/arch/arc/include/asm/Kbuild
+++ b/arch/arc/include/asm/Kbuild
@@ -1,4 +1,5 @@
 generic-y += auxvec.h
+generic-y += barrier.h
 generic-y += bugs.h
 generic-y += bitsperlong.h
 generic-y += clkdev.h
diff --git a/arch/arc/include/asm/atomic.h b/arch/arc/include/asm/atomic.h
index 83f03ca6caf6..03e494f695d1 100644
--- a/arch/arc/include/asm/atomic.h
+++ b/arch/arc/include/asm/atomic.h
@@ -190,6 +190,11 @@ static inline void atomic_clear_mask(unsigned long mask, unsigned long *addr)
 #endif /* !CONFIG_ARC_HAS_LLSC */
+#define smp_mb__before_atomic_dec()     barrier()
+#define smp_mb__after_atomic_dec()      barrier()
+#define smp_mb__before_atomic_inc()     barrier()
+#define smp_mb__after_atomic_inc()      barrier()
 /**
 * __atomic_add_unless - add unless the number is a given value
 * @v: pointer of type atomic_t
diff --git a/arch/arc/include/asm/barrier.h b/arch/arc/include/asm/barrier.h
index f6cb7c4ffb35..c32245c3d1e9 100644
--- a/arch/arc/include/asm/barrier.h
+++ b/arch/arc/include/asm/barrier.h
@@ -30,11 +30,6 @@
 #define smp_wmb()       barrier()
 #endif
-#define smp_mb__before_atomic_dec()     barrier()
-#define smp_mb__after_atomic_dec()      barrier()
-#define smp_mb__before_atomic_inc()     barrier()
-#define smp_mb__after_atomic_inc()      barrier()
 #define smp_read_barrier_depends()      do { } while (0)
 #endif
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index c1f1a7eee953..9c909fc29272 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -30,6 +30,7 @@ config ARM
        select HAVE_BPF_JIT
        select HAVE_CONTEXT_TRACKING
        select HAVE_C_RECORDMCOUNT
+        select HAVE_CC_STACKPROTECTOR
        select HAVE_DEBUG_KMEMLEAK
        select HAVE_DMA_API_DEBUG
        select HAVE_DMA_ATTRS
@@ -1856,18 +1857,6 @@ config SECCOMP
          and the task is only allowed to execute a few safe syscalls
          defined by each seccomp mode.
-config CC_STACKPROTECTOR
-        bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
-        help
-          This option turns on the -fstack-protector GCC feature. This
-          feature puts, at the beginning of functions, a canary value on
-          the stack just before the return address, and validates
-          the value just before actually returning.  Stack based buffer
-          overflows (that need to overwrite this return address) now also
-          overwrite the canary, which gets detected and the attack is then
-          neutralized via a kernel panic.
-          This feature requires gcc version 4.2 or above.
 config SWIOTLB
        def_bool y
diff --git a/arch/arm/Makefile b/arch/arm/Makefile
index c99b1086d83d..55b4255ad6ed 100644
--- a/arch/arm/Makefile
+++ b/arch/arm/Makefile
@@ -40,10 +40,6 @@ ifeq ($(CONFIG_FRAME_POINTER),y)
 KBUILD_CFLAGS   +=-fno-omit-frame-pointer -mapcs -mno-sched-prolog
 endif
-ifeq ($(CONFIG_CC_STACKPROTECTOR),y)
-KBUILD_CFLAGS   +=-fstack-protector
-endif
 ifeq ($(CONFIG_CPU_BIG_ENDIAN),y)
 KBUILD_CPPFLAGS += -mbig-endian
 AS              += -EB
diff --git a/arch/arm/boot/compressed/misc.c b/arch/arm/boot/compressed/misc.c
index 31bd43b82095..d4f891f56996 100644
--- a/arch/arm/boot/compressed/misc.c
+++ b/arch/arm/boot/compressed/misc.c
@@ -127,6 +127,18 @@ asmlinkage void __div0(void)
        error("Attempting division by 0!");
 }
+unsigned long __stack_chk_guard;
+void __stack_chk_guard_setup(void)
+{
+        __stack_chk_guard = 0x000a0dff;
+}
+void __stack_chk_fail(void)
+{
+        error("stack-protector: Kernel stack is corrupted\n");
+}
 extern int do_decompress(u8 *input, int len, u8 *output, void (*error)(char *x));
@@ -137,6 +149,8 @@ decompress_kernel(unsigned long output_start, unsigned long free_mem_ptr_p,
 {
        int ret;
+        __stack_chk_guard_setup();
        output_data             = (unsigned char *)output_start;
        free_mem_ptr            = free_mem_ptr_p;
        free_mem_end_ptr        = free_mem_ptr_end_p;
diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi
index 9db5047812f3..177becde7a26 100644
--- a/arch/arm/boot/dts/exynos5250.dtsi
+++ b/arch/arm/boot/dts/exynos5250.dtsi
@@ -559,7 +559,7 @@
                        compatible = "arm,pl330", "arm,primecell";
                        reg = <0x10800000 0x1000>;
                        interrupts = <0 33 0>;
-                        clocks = <&clock 271>;
+                        clocks = <&clock 346>;
                        clock-names = "apb_pclk";
                        #dma-cells = <1>;
                        #dma-channels = <8>;
diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi
index 46e1d7ef163f..9987dd0e9c59 100644
--- a/arch/arm/boot/dts/r8a7790.dtsi
+++ b/arch/arm/boot/dts/r8a7790.dtsi
@@ -241,7 +241,7 @@
        sdhi0: sdhi@ee100000 {
                compatible = "renesas,sdhi-r8a7790";
-                reg = <0 0xee100000 0 0x100>;
+                reg = <0 0xee100000 0 0x200>;
                interrupt-parent = <&gic>;
                interrupts = <0 165 4>;
                cap-sd-highspeed;
@@ -250,7 +250,7 @@
        sdhi1: sdhi@ee120000 {
                compatible = "renesas,sdhi-r8a7790";
-                reg = <0 0xee120000 0 0x100>;
+                reg = <0 0xee120000 0 0x200>;
                interrupt-parent = <&gic>;
                interrupts = <0 166 4>;
                cap-sd-highspeed;
diff --git a/arch/arm/boot/dts/sun5i-a10s.dtsi b/arch/arm/boot/dts/sun5i-a10s.dtsi
index 52476742a104..e674c94c7206 100644
--- a/arch/arm/boot/dts/sun5i-a10s.dtsi
+++ b/arch/arm/boot/dts/sun5i-a10s.dtsi
@@ -332,5 +332,12 @@
                        clock-frequency = <100000>;
                        status = "disabled";
                };
+                timer@01c60000 {
+                        compatible = "allwinner,sun5i-a13-hstimer";
+                        reg = <0x01c60000 0x1000>;
+                        interrupts = <82>, <83>;
+                        clocks = <&ahb_gates 28>;
+                };
        };
 };
diff --git a/arch/arm/boot/dts/sun5i-a13.dtsi b/arch/arm/boot/dts/sun5i-a13.dtsi
index ce8ef2a45be0..1ccd75d37f49 100644
--- a/arch/arm/boot/dts/sun5i-a13.dtsi
+++ b/arch/arm/boot/dts/sun5i-a13.dtsi
@@ -273,5 +273,12 @@
                        clock-frequency = <100000>;
                        status = "disabled";
                };
+                timer@01c60000 {
+                        compatible = "allwinner,sun5i-a13-hstimer";
+                        reg = <0x01c60000 0x1000>;
+                        interrupts = <82>, <83>;
+                        clocks = <&ahb_gates 28>;
+                };
        };
 };
diff --git a/arch/arm/boot/dts/sun7i-a20.dtsi b/arch/arm/boot/dts/sun7i-a20.dtsi
index 367611a0730b..0135039eff96 100644
--- a/arch/arm/boot/dts/sun7i-a20.dtsi
+++ b/arch/arm/boot/dts/sun7i-a20.dtsi
@@ -395,6 +395,16 @@
                        status = "disabled";
                };
+                hstimer@01c60000 {
+                        compatible = "allwinner,sun7i-a20-hstimer";
+                        reg = <0x01c60000 0x1000>;
+                        interrupts = <0 81 1>,
+                                     <0 82 1>,
+                                     <0 83 1>,
+                                     <0 84 1>;
+                        clocks = <&ahb_gates 28>;
+                };
                gic: interrupt-controller@01c81000 {
                        compatible = "arm,cortex-a7-gic", "arm,cortex-a15-gic";
                        reg = <0x01c81000 0x1000>,
diff --git a/arch/arm/crypto/aesbs-core.S_shipped b/arch/arm/crypto/aesbs-core.S_shipped
index 64205d453260..71e5fc7cfb18 100644
--- a/arch/arm/crypto/aesbs-core.S_shipped
+++ b/arch/arm/crypto/aesbs-core.S_shipped
@@ -58,7 +58,7 @@
 # define VFP_ABI_FRAME  0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_ARCH__   7
 #endif
 #ifdef __thumb__
diff --git a/arch/arm/crypto/bsaes-armv7.pl b/arch/arm/crypto/bsaes-armv7.pl
index f3d96d932573..be068db960ee 100644
--- a/arch/arm/crypto/bsaes-armv7.pl
+++ b/arch/arm/crypto/bsaes-armv7.pl
@@ -701,7 +701,7 @@ $code.=<<___;
 # define VFP_ABI_FRAME  0
 # define BSAES_ASM_EXTENDED_KEY
 # define XTS_CHAIN_TWEAK
-# define __ARM_ARCH__ __LINUX_ARM_ARCH__
+# define __ARM_ARCH__   7
 #endif
 #ifdef __thumb__
diff --git a/arch/arm/include/asm/barrier.h b/arch/arm/include/asm/barrier.h
index 60f15e274e6d..2f59f7443396 100644
--- a/arch/arm/include/asm/barrier.h
+++ b/arch/arm/include/asm/barrier.h
@@ -59,6 +59,21 @@
 #define smp_wmb()       dmb(ishst)
 #endif
+#define smp_store_release(p, v)                                         \
+do {                                                                    \
+        compiletime_assert_atomic_type(*p);                             \
+        smp_mb();                                                       \
+        ACCESS_ONCE(*p) = (v);                                          \
+} while (0)
+#define smp_load_acquire(p)                                             \
+({                                                                      \
+        typeof(*p) ___p1 = ACCESS_ONCE(*p);                             \
+        compiletime_assert_atomic_type(*p);                             \
+        smp_mb();                                                       \
+        ___p1;                                                          \
+})
 #define read_barrier_depends()          do { } while(0)
 #define smp_read_barrier_depends()      do { } while(0)
diff --git a/arch/arm/include/asm/io.h b/arch/arm/include/asm/io.h
index 3c597c222ef2..fbeb39c869e9 100644
--- a/arch/arm/include/asm/io.h
+++ b/arch/arm/include/asm/io.h
@@ -329,7 +329,7 @@ extern void _memset_io(volatile void __iomem *, int, size_t);
 */
 #define ioremap(cookie,size)            __arm_ioremap((cookie), (size), MT_DEVICE)
 #define ioremap_nocache(cookie,size)    __arm_ioremap((cookie), (size), MT_DEVICE)
-#define ioremap_cached(cookie,size)     __arm_ioremap((cookie), (size), MT_DEVICE_CACHED)
+#define ioremap_cache(cookie,size)      __arm_ioremap((cookie), (size), MT_DEVICE_CACHED)
 #define ioremap_wc(cookie,size)         __arm_ioremap((cookie), (size), MT_DEVICE_WC)
 #define iounmap                         __arm_iounmap
diff --git a/arch/arm/include/asm/memory.h b/arch/arm/include/asm/memory.h
index 6976b03e5213..8756e4bcdba0 100644
--- a/arch/arm/include/asm/memory.h
+++ b/arch/arm/include/asm/memory.h
@@ -347,7 +347,8 @@ static inline __deprecated void *bus_to_virt(unsigned long x)
 #define ARCH_PFN_OFFSET         PHYS_PFN_OFFSET
 #define virt_to_page(kaddr)     pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
-#define virt_addr_valid(kaddr)  ((unsigned long)(kaddr) >= PAGE_OFFSET && (unsigned long)(kaddr) < (unsigned long)high_memory)
+#define virt_addr_valid(kaddr)  (((unsigned long)(kaddr) >= PAGE_OFFSET && (unsigned long)(kaddr) < (unsigned long)high_memory) \
+                                        && pfn_valid(__pa(kaddr) >> PAGE_SHIFT) )
 #endif
diff --git a/arch/arm/include/asm/unistd.h b/arch/arm/include/asm/unistd.h
index 141baa3f9a72..acabef1a75df 100644
--- a/arch/arm/include/asm/unistd.h
+++ b/arch/arm/include/asm/unistd.h
@@ -15,7 +15,7 @@
 #include <uapi/asm/unistd.h>
-#define __NR_syscalls  (380)
+#define __NR_syscalls  (384)
 #define __ARM_NR_cmpxchg                (__ARM_NR_BASE+0x00fff0)
 #define __ARCH_WANT_STAT64
diff --git a/arch/arm/include/asm/xen/page.h b/arch/arm/include/asm/xen/page.h
index 75579a9d6f76..3759cacdd7f8 100644
--- a/arch/arm/include/asm/xen/page.h
+++ b/arch/arm/include/asm/xen/page.h
@@ -117,6 +117,6 @@ static inline bool set_phys_to_machine(unsigned long pfn, unsigned long mfn)
        return __set_phys_to_machine(pfn, mfn);
 }
-#define xen_remap(cookie, size) ioremap_cached((cookie), (size));
+#define xen_remap(cookie, size) ioremap_cache((cookie), (size));
 #endif /* _ASM_ARM_XEN_PAGE_H */
diff --git a/arch/arm/include/uapi/asm/unistd.h b/arch/arm/include/uapi/asm/unistd.h
index af33b44990ed..fb5584d0cc05 100644
--- a/arch/arm/include/uapi/asm/unistd.h
+++ b/arch/arm/include/uapi/asm/unistd.h
@@ -406,6 +406,8 @@
 #define __NR_process_vm_writev          (__NR_SYSCALL_BASE+377)
 #define __NR_kcmp                       (__NR_SYSCALL_BASE+378)
 #define __NR_finit_module               (__NR_SYSCALL_BASE+379)
+#define __NR_sched_setattr              (__NR_SYSCALL_BASE+380)
+#define __NR_sched_getattr              (__NR_SYSCALL_BASE+381)
 /*
 * This may need to be greater than __NR_last_syscall+1 in order to
diff --git a/arch/arm/kernel/calls.S b/arch/arm/kernel/calls.S
index c6ca7e376773..166e945de832 100644
--- a/arch/arm/kernel/calls.S
+++ b/arch/arm/kernel/calls.S
@@ -389,6 +389,8 @@
                CALL(sys_process_vm_writev)
                CALL(sys_kcmp)
                CALL(sys_finit_module)
+/* 380 */       CALL(sys_sched_setattr)
+                CALL(sys_sched_getattr)
 #ifndef syscalls_counted
 .equ syscalls_padding, ((NR_syscalls + 3) & ~3) - NR_syscalls
 #define syscalls_counted
diff --git a/arch/arm/kernel/devtree.c b/arch/arm/kernel/devtree.c
index 739c3dfc1da2..34d5fd585bbb 100644
--- a/arch/arm/kernel/devtree.c
+++ b/arch/arm/kernel/devtree.c
@@ -171,7 +171,7 @@ void __init arm_dt_init_cpu_maps(void)
 bool arch_match_cpu_phys_id(int cpu, u64 phys_id)
 {
-        return (phys_id & MPIDR_HWID_BITMASK) == cpu_logical_map(cpu);
+        return phys_id == cpu_logical_map(cpu);
 }
 static const void * __init arch_get_next_mach(const char *const **match)
diff --git a/arch/arm/kernel/perf_event.c b/arch/arm/kernel/perf_event.c
index bc3f2efa0d86..789d846a9184 100644
--- a/arch/arm/kernel/perf_event.c
+++ b/arch/arm/kernel/perf_event.c
@@ -99,10 +99,6 @@ int armpmu_event_set_period(struct perf_event *event)
        s64 period = hwc->sample_period;
        int ret = 0;
-        /* The period may have been changed by PERF_EVENT_IOC_PERIOD */
-        if (unlikely(period != hwc->last_period))
-                left = period - (hwc->last_period - left);
        if (unlikely(left <= -period)) {
                left = period;
                local64_set(&hwc->period_left, left);
diff --git a/arch/arm/kernel/perf_event_cpu.c b/arch/arm/kernel/perf_event_cpu.c
index d85055cd24ba..20d553c9f5e2 100644
--- a/arch/arm/kernel/perf_event_cpu.c
+++ b/arch/arm/kernel/perf_event_cpu.c
@@ -254,7 +254,7 @@ static int probe_current_pmu(struct arm_pmu *pmu)
 static int cpu_pmu_device_probe(struct platform_device *pdev)
 {
        const struct of_device_id *of_id;
-        int (*init_fn)(struct arm_pmu *);
+        const int (*init_fn)(struct arm_pmu *);
        struct device_node *node = pdev->dev.of_node;
        struct arm_pmu *pmu;
        int ret = -ENODEV;
diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c
index 7940241f0576..4636d56af2db 100644
--- a/arch/arm/kernel/traps.c
+++ b/arch/arm/kernel/traps.c
@@ -36,7 +36,13 @@
 #include <asm/system_misc.h>
 #include <asm/opcodes.h>
-static const char *handler[]= { "prefetch abort", "data abort", "address exception", "interrupt" };
+static const char *handler[]= {
+        "prefetch abort",
+        "data abort",
+        "address exception",
+        "interrupt",
+        "undefined instruction",
+};
 void *vectors_page;
@@ -425,9 +431,10 @@ asmlinkage void __exception do_undefinstr(struct pt_regs *regs)
                        instr2 = __mem_to_opcode_thumb16(instr2);
                        instr = __opcode_thumb32_compose(instr, instr2);
                }
-        } else if (get_user(instr, (u32 __user *)pc)) {
+        } else {
+                if (get_user(instr, (u32 __user *)pc))
+                        goto die_sig;
                instr = __mem_to_opcode_arm(instr);
-                goto die_sig;
        }
        if (call_undef_hook(regs, instr) == 0)
diff --git a/arch/arm/kvm/arm.c b/arch/arm/kvm/arm.c
index 2a700e00528d..b18165ca1d38 100644
--- a/arch/arm/kvm/arm.c
+++ b/arch/arm/kvm/arm.c
@@ -17,6 +17,7 @@
 */
 #include <linux/cpu.h>
+#include <linux/cpu_pm.h>
 #include <linux/errno.h>
 #include <linux/err.h>
 #include <linux/kvm_host.h>
@@ -853,6 +854,33 @@ static struct notifier_block hyp_init_cpu_nb = {
        .notifier_call = hyp_init_cpu_notify,
 };
+#ifdef CONFIG_CPU_PM
+static int hyp_init_cpu_pm_notifier(struct notifier_block *self,
+                                    unsigned long cmd,
+                                    void *v)
+{
+        if (cmd == CPU_PM_EXIT) {
+                cpu_init_hyp_mode(NULL);
+                return NOTIFY_OK;
+        }
+        return NOTIFY_DONE;
+}
+static struct notifier_block hyp_init_cpu_pm_nb = {
+        .notifier_call = hyp_init_cpu_pm_notifier,
+};
+static void __init hyp_cpu_pm_init(void)
+{
+        cpu_pm_register_notifier(&hyp_init_cpu_pm_nb);
+}
+#else
+static inline void hyp_cpu_pm_init(void)
+{
+}
+#endif
 /**
 * Inits Hyp-mode on all online CPUs
 */
@@ -1013,6 +1041,8 @@ int kvm_arch_init(void *opaque)
                goto out_err;
        }
+        hyp_cpu_pm_init();
        kvm_coproc_table_init();
        return 0;
 out_err:
diff --git a/arch/arm/mach-footbridge/dc21285-timer.c b/arch/arm/mach-footbridge/dc21285-timer.c
index 9ee78f7b4990..782f6c71fa0a 100644
--- a/arch/arm/mach-footbridge/dc21285-timer.c
+++ b/arch/arm/mach-footbridge/dc21285-timer.c
@@ -96,11 +96,12 @@ static struct irqaction footbridge_timer_irq = {
 void __init footbridge_timer_init(void)
 {
        struct clock_event_device *ce = &ckevt_dc21285;
+        unsigned rate = DIV_ROUND_CLOSEST(mem_fclk_21285, 16);
-        clocksource_register_hz(&cksrc_dc21285, (mem_fclk_21285 + 8) / 16);
+        clocksource_register_hz(&cksrc_dc21285, rate);
        setup_irq(ce->irq, &footbridge_timer_irq);
        ce->cpumask = cpumask_of(smp_processor_id());
-        clockevents_config_and_register(ce, mem_fclk_21285, 0x4, 0xffffff);
+        clockevents_config_and_register(ce, rate, 0x4, 0xffffff);
 }
diff --git a/arch/arm/mach-highbank/highbank.c b/arch/arm/mach-highbank/highbank.c
index bd3bf66ce344..c7de89b263dd 100644
--- a/arch/arm/mach-highbank/highbank.c
+++ b/arch/arm/mach-highbank/highbank.c
@@ -53,6 +53,7 @@ static void __init highbank_scu_map_io(void)
 static void highbank_l2x0_disable(void)
 {
+        outer_flush_all();
        /* Disable PL310 L2 Cache controller */
        highbank_smc1(0x102, 0x0);
 }
diff --git a/arch/arm/mach-omap2/board-ldp.c b/arch/arm/mach-omap2/board-ldp.c
index 4ec8d82b0492..44a59c3abfb0 100644
--- a/arch/arm/mach-omap2/board-ldp.c
+++ b/arch/arm/mach-omap2/board-ldp.c
@@ -242,12 +242,18 @@ static void __init ldp_display_init(void)
 static int ldp_twl_gpio_setup(struct device *dev, unsigned gpio, unsigned ngpio)
 {
+        int res;
        /* LCD enable GPIO */
        ldp_lcd_pdata.enable_gpio = gpio + 7;
        /* Backlight enable GPIO */
        ldp_lcd_pdata.backlight_gpio = gpio + 15;
+        res = platform_device_register(&ldp_lcd_device);
+        if (res)
+                pr_err("Unable to register LCD: %d\n", res);
        return 0;
 }
@@ -346,7 +352,6 @@ static struct omap2_hsmmc_info mmc[] __initdata = {
 static struct platform_device *ldp_devices[] __initdata = {
        &ldp_gpio_keys_device,
-        &ldp_lcd_device,
 };
 #ifdef CONFIG_OMAP_MUX
diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c
index b39efd46abf9..c0ab9b26be3d 100644
--- a/arch/arm/mach-omap2/omap4-common.c
+++ b/arch/arm/mach-omap2/omap4-common.c
@@ -162,6 +162,7 @@ void __iomem *omap4_get_l2cache_base(void)
 static void omap4_l2x0_disable(void)
 {
+        outer_flush_all();
        /* Disable PL310 L2 Cache controller */
        omap_smc1(0x102, 0x0);
 }
diff --git a/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c
index 56cebb05509e..d23c77fadb31 100644
--- a/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_2xxx_ipblock_data.c
@@ -796,7 +796,7 @@ struct omap_hwmod omap2xxx_counter_32k_hwmod = {
 /* gpmc */
 static struct omap_hwmod_irq_info omap2xxx_gpmc_irqs[] = {
-        { .irq = 20 },
+        { .irq = 20 + OMAP_INTC_START, },
        { .irq = -1 }
 };
@@ -841,7 +841,7 @@ static struct omap_hwmod_class omap2_rng_hwmod_class = {
 };
 static struct omap_hwmod_irq_info omap2_rng_mpu_irqs[] = {
-        { .irq = 52 },
+        { .irq = 52 + OMAP_INTC_START, },
        { .irq = -1 }
 };
diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
index d33742908f97..4c3b1e6df508 100644
--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c
@@ -2165,7 +2165,7 @@ static struct omap_hwmod_class omap3xxx_gpmc_hwmod_class = {
 };
 static struct omap_hwmod_irq_info omap3xxx_gpmc_irqs[] = {
-        { .irq = 20 },
+        { .irq = 20 + OMAP_INTC_START, },
        { .irq = -1 }
 };
@@ -2999,7 +2999,7 @@ static struct omap_mmu_dev_attr mmu_isp_dev_attr = {
 static struct omap_hwmod omap3xxx_mmu_isp_hwmod;
 static struct omap_hwmod_irq_info omap3xxx_mmu_isp_irqs[] = {
-        { .irq = 24 },
+        { .irq = 24 + OMAP_INTC_START, },
        { .irq = -1 }
 };
@@ -3041,7 +3041,7 @@ static struct omap_mmu_dev_attr mmu_iva_dev_attr = {
 static struct omap_hwmod omap3xxx_mmu_iva_hwmod;
 static struct omap_hwmod_irq_info omap3xxx_mmu_iva_irqs[] = {
-        { .irq = 28 },
+        { .irq = 28 + OMAP_INTC_START, },
        { .irq = -1 }
 };
diff --git a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
index db32d5380b11..18f333c440db 100644
--- a/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
+++ b/arch/arm/mach-omap2/omap_hwmod_7xx_data.c
@@ -1637,7 +1637,7 @@ static struct omap_hwmod dra7xx_uart1_hwmod = {
        .class          = &dra7xx_uart_hwmod_class,
        .clkdm_name     = "l4per_clkdm",
        .main_clk       = "uart1_gfclk_mux",
-        .flags          = HWMOD_SWSUP_SIDLE_ACT,
+        .flags          = HWMOD_SWSUP_SIDLE_ACT | DEBUG_OMAP2UART1_FLAGS,
        .prcm = {
                .omap4 = {
                        .clkctrl_offs = DRA7XX_CM_L4PER_UART1_CLKCTRL_OFFSET,
diff --git a/arch/arm/mach-pxa/include/mach/lubbock.h b/arch/arm/mach-pxa/include/mach/lubbock.h
index 2a086e8373eb..958cd6af9384 100644
--- a/arch/arm/mach-pxa/include/mach/lubbock.h
+++ b/arch/arm/mach-pxa/include/mach/lubbock.h
@@ -10,6 +10,8 @@
 * published by the Free Software Foundation.
 */
+#include <mach/irqs.h>
 #define LUBBOCK_ETH_PHYS        PXA_CS3_PHYS
 #define LUBBOCK_FPGA_PHYS       PXA_CS2_PHYS
diff --git a/arch/arm/mach-shmobile/board-armadillo800eva.c b/arch/arm/mach-shmobile/board-armadillo800eva.c
index 958e3cbf0ac2..8ea87bd45c33 100644
--- a/arch/arm/mach-shmobile/board-armadillo800eva.c
+++ b/arch/arm/mach-shmobile/board-armadillo800eva.c
@@ -483,7 +483,7 @@ static struct platform_device lcdc0_device = {
        .id             = 0,
        .dev    = {
                .platform_data  = &lcdc0_info,
-                .coherent_dma_mask = ~0,
+                .coherent_dma_mask = DMA_BIT_MASK(32),
        },
 };
@@ -580,7 +580,7 @@ static struct platform_device hdmi_lcdc_device = {
        .id             = 1,
        .dev    = {
                .platform_data  = &hdmi_lcdc_info,
-                .coherent_dma_mask = ~0,
+                .coherent_dma_mask = DMA_BIT_MASK(32),
        },
 };
@@ -614,6 +614,11 @@ static struct regulator_consumer_supply fixed3v3_power_consumers[] = {
        REGULATOR_SUPPLY("vqmmc", "sh_mmcif"),
 };
+/* Fixed 3.3V regulator used by LCD backlight */
+static struct regulator_consumer_supply fixed5v0_power_consumers[] = {
+        REGULATOR_SUPPLY("power", "pwm-backlight.0"),
+};
 /* Fixed 3.3V regulator to be used by SDHI0 */
 static struct regulator_consumer_supply vcc_sdhi0_consumers[] = {
        REGULATOR_SUPPLY("vmmc", "sh_mobile_sdhi.0"),
@@ -1196,6 +1201,8 @@ static void __init eva_init(void)
        regulator_register_always_on(0, "fixed-3.3V", fixed3v3_power_consumers,
                                     ARRAY_SIZE(fixed3v3_power_consumers), 3300000);
+        regulator_register_always_on(3, "fixed-5.0V", fixed5v0_power_consumers,
+                                     ARRAY_SIZE(fixed5v0_power_consumers), 5000000);
        pinctrl_register_mappings(eva_pinctrl_map, ARRAY_SIZE(eva_pinctrl_map));
        pwm_add_table(pwm_lookup, ARRAY_SIZE(pwm_lookup));
diff --git a/arch/arm/mach-shmobile/board-bockw.c b/arch/arm/mach-shmobile/board-bockw.c
index 38611526fe9a..3c4995aebd22 100644
--- a/arch/arm/mach-shmobile/board-bockw.c
+++ b/arch/arm/mach-shmobile/board-bockw.c
@@ -679,7 +679,7 @@ static void __init bockw_init(void)
                        .id             = i,
                        .data           = &rsnd_card_info[i],
                        .size_data      = sizeof(struct asoc_simple_card_info),
-                        .dma_mask       = ~0,
+                        .dma_mask       = DMA_BIT_MASK(32),
                };
                platform_device_register_full(&cardinfo);
diff --git a/arch/arm/mach-shmobile/board-kzm9g.c b/arch/arm/mach-shmobile/board-kzm9g.c
index fe689b7fdc9e..bc40b853ffd3 100644
--- a/arch/arm/mach-shmobile/board-kzm9g.c
+++ b/arch/arm/mach-shmobile/board-kzm9g.c
@@ -334,7 +334,7 @@ static struct platform_device lcdc_device = {
        .resource       = lcdc_resources,
        .dev    = {
                .platform_data  = &lcdc_info,
-                .coherent_dma_mask = ~0,
+                .coherent_dma_mask = DMA_BIT_MASK(32),
        },
 };
diff --git a/arch/arm/mach-shmobile/board-mackerel.c b/arch/arm/mach-shmobile/board-mackerel.c
index af06753eb809..e721d2ccceae 100644
--- a/arch/arm/mach-shmobile/board-mackerel.c
+++ b/arch/arm/mach-shmobile/board-mackerel.c
@@ -409,7 +409,7 @@ static struct platform_device lcdc_device = {
        .resource       = lcdc_resources,
        .dev    = {
                .platform_data  = &lcdc_info,
-                .coherent_dma_mask = ~0,
+                .coherent_dma_mask = DMA_BIT_MASK(32),
        },
 };
@@ -499,7 +499,7 @@ static struct platform_device hdmi_lcdc_device = {
        .id             = 1,
        .dev    = {
                .platform_data  = &hdmi_lcdc_info,
-                .coherent_dma_mask = ~0,
+                .coherent_dma_mask = DMA_BIT_MASK(32),
        },
 };
diff --git a/arch/arm/mach-sunxi/Kconfig b/arch/arm/mach-sunxi/Kconfig
index c9e72c89066a..bce0d4277f71 100644
--- a/arch/arm/mach-sunxi/Kconfig
+++ b/arch/arm/mach-sunxi/Kconfig
@@ -12,3 +12,4 @@ config ARCH_SUNXI
        select PINCTRL_SUNXI
        select SPARSE_IRQ
        select SUN4I_TIMER
+        select SUN5I_HSTIMER
diff --git a/arch/arm/mm/flush.c b/arch/arm/mm/flush.c
index 6d5ba9afb16a..3387e60e4ea3 100644
--- a/arch/arm/mm/flush.c
+++ b/arch/arm/mm/flush.c
@@ -175,16 +175,16 @@ void __flush_dcache_page(struct address_space *mapping, struct page *page)
                unsigned long i;
                if (cache_is_vipt_nonaliasing()) {
                        for (i = 0; i < (1 << compound_order(page)); i++) {
-                                void *addr = kmap_atomic(page);
+                                void *addr = kmap_atomic(page + i);
                                __cpuc_flush_dcache_area(addr, PAGE_SIZE);
                                kunmap_atomic(addr);
                        }
                } else {
                        for (i = 0; i < (1 << compound_order(page)); i++) {
-                                void *addr = kmap_high_get(page);
+                                void *addr = kmap_high_get(page + i);
                                if (addr) {
                                        __cpuc_flush_dcache_area(addr, PAGE_SIZE);
-                                        kunmap_high(page);
+                                        kunmap_high(page + i);
                                }
                        }
                }
diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c
index 1f7b19a47060..3e8f106ee5fe 100644
--- a/arch/arm/mm/init.c
+++ b/arch/arm/mm/init.c
@@ -229,7 +229,7 @@ void __init setup_dma_zone(const struct machine_desc *mdesc)
 #ifdef CONFIG_ZONE_DMA
        if (mdesc->dma_zone_size) {
                arm_dma_zone_size = mdesc->dma_zone_size;
-                arm_dma_limit = __pv_phys_offset + arm_dma_zone_size - 1;
+                arm_dma_limit = PHYS_OFFSET + arm_dma_zone_size - 1;
        } else
                arm_dma_limit = 0xffffffff;
        arm_dma_pfn_limit = arm_dma_limit >> PAGE_SHIFT;
diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index 9ed155ad0f97..271b5e971568 100644
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -641,10 +641,10 @@ load_ind:
                        emit(ARM_MUL(r_A, r_A, r_X), ctx);
                        break;
                case BPF_S_ALU_DIV_K:
-                        /* current k == reciprocal_value(userspace k) */
+                        if (k == 1)
+                                break;
                        emit_mov_i(r_scratch, k, ctx);
-                        /* A = top 32 bits of the product */
+                        emit_udiv(r_A, r_A, r_scratch, ctx);
-                        emit(ARM_UMULL(r_scratch, r_A, r_A, r_scratch), ctx);
                        break;
                case BPF_S_ALU_DIV_X:
                        update_on_xread(ctx);
diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index 6d4dd22ee4b7..dd4327f09ba4 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig
@@ -2,6 +2,7 @@ config ARM64
        def_bool y
        select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE
        select ARCH_USE_CMPXCHG_LOCKREF
+        select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
        select ARCH_WANT_OPTIONAL_GPIOLIB
        select ARCH_WANT_COMPAT_IPC_PARSE_VERSION
        select ARCH_WANT_FRAME_POINTERS
@@ -11,19 +12,27 @@ config ARM64
        select BUILDTIME_EXTABLE_SORT
        select CLONE_BACKWARDS
        select COMMON_CLK
+        select CPU_PM if (SUSPEND || CPU_IDLE)
+        select DCACHE_WORD_ACCESS
        select GENERIC_CLOCKEVENTS
+        select GENERIC_CLOCKEVENTS_BROADCAST if SMP
        select GENERIC_IOMAP
        select GENERIC_IRQ_PROBE
        select GENERIC_IRQ_SHOW
        select GENERIC_SCHED_CLOCK
        select GENERIC_SMP_IDLE_THREAD
+        select GENERIC_STRNCPY_FROM_USER
+        select GENERIC_STRNLEN_USER
        select GENERIC_TIME_VSYSCALL
        select HARDIRQS_SW_RESEND
+        select HAVE_ARCH_JUMP_LABEL
        select HAVE_ARCH_TRACEHOOK
        select HAVE_DEBUG_BUGVERBOSE
        select HAVE_DEBUG_KMEMLEAK
        select HAVE_DMA_API_DEBUG
        select HAVE_DMA_ATTRS
+        select HAVE_DMA_CONTIGUOUS
+        select HAVE_EFFICIENT_UNALIGNED_ACCESS
        select HAVE_GENERIC_DMA_COHERENT
        select HAVE_HW_BREAKPOINT if PERF_EVENTS
        select HAVE_MEMBLOCK
@@ -275,6 +284,24 @@ config SYSVIPC_COMPAT
 endmenu
+menu "Power management options"
+source "kernel/power/Kconfig"
+config ARCH_SUSPEND_POSSIBLE
+        def_bool y
+config ARM64_CPU_SUSPEND
+        def_bool PM_SLEEP
+endmenu
+menu "CPU Power Management"
+source "drivers/cpuidle/Kconfig"
+endmenu
 source "net/Kconfig"
 source "drivers/Kconfig"
diff --git a/arch/arm64/boot/dts/foundation-v8.dts b/arch/arm64/boot/dts/foundation-v8.dts
index 519c4b2c0687..4a060906809d 100644
--- a/arch/arm64/boot/dts/foundation-v8.dts
+++ b/arch/arm64/boot/dts/foundation-v8.dts
@@ -224,7 +224,7 @@
                        virtio_block@0130000 {
                                compatible = "virtio,mmio";
-                                reg = <0x130000 0x1000>;
+                                reg = <0x130000 0x200>;
                                interrupts = <42>;
                        };
                };
diff --git a/arch/arm64/boot/dts/rtsm_ve-motherboard.dtsi b/arch/arm64/boot/dts/rtsm_ve-motherboard.dtsi
index b45e5f39f577..2f2ecd217363 100644
--- a/arch/arm64/boot/dts/rtsm_ve-motherboard.dtsi
+++ b/arch/arm64/boot/dts/rtsm_ve-motherboard.dtsi
@@ -183,6 +183,12 @@
                                clocks = <&v2m_oscclk1>, <&v2m_clk24mhz>;
                                clock-names = "clcdclk", "apb_pclk";
                        };
+                        virtio_block@0130000 {
+                                compatible = "virtio,mmio";
+                                reg = <0x130000 0x200>;
+                                interrupts = <42>;
+                        };
                };
                v2m_fixed_3v3: fixedregulator@0 {
diff --git a/arch/arm64/include/asm/Kbuild b/arch/arm64/include/asm/Kbuild
index 519f89f5b6a3..d0ff25de67ca 100644
--- a/arch/arm64/include/asm/Kbuild
+++ b/arch/arm64/include/asm/Kbuild
@@ -26,7 +26,6 @@ generic-y += mman.h
 generic-y += msgbuf.h
 generic-y += mutex.h
 generic-y += pci.h
-generic-y += percpu.h
 generic-y += poll.h
 generic-y += posix_types.h
 generic-y += resource.h
diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h
index d4a63338a53c..78e20ba8806b 100644
--- a/arch/arm64/include/asm/barrier.h
+++ b/arch/arm64/include/asm/barrier.h
@@ -35,10 +35,60 @@
 #define smp_mb()        barrier()
 #define smp_rmb()       barrier()
 #define smp_wmb()       barrier()
+#define smp_store_release(p, v)                                         \
+do {                                                                    \
+        compiletime_assert_atomic_type(*p);                             \
+        smp_mb();                                                       \
+        ACCESS_ONCE(*p) = (v);                                          \
+} while (0)
+#define smp_load_acquire(p)                                             \
+({                                                                      \
+        typeof(*p) ___p1 = ACCESS_ONCE(*p);                             \
+        compiletime_assert_atomic_type(*p);                             \
+        smp_mb();                                                       \
+        ___p1;                                                          \
+})
 #else
 #define smp_mb()        asm volatile("dmb ish" : : : "memory")
 #define smp_rmb()       asm volatile("dmb ishld" : : : "memory")
 #define smp_wmb()       asm volatile("dmb ishst" : : : "memory")
+#define smp_store_release(p, v)                                         \
+do {                                                                    \
+        compiletime_assert_atomic_type(*p);                             \
+        switch (sizeof(*p)) {                                           \
+        case 4:                                                         \
+                asm volatile ("stlr %w1, %0"                            \
+                                : "=Q" (*p) : "r" (v) : "memory");      \
+                break;                                                  \
+        case 8:                                                         \
+                asm volatile ("stlr %1, %0"                             \
+                                : "=Q" (*p) : "r" (v) : "memory");      \
+                break;                                                  \
+        }                                                               \
+} while (0)
+#define smp_load_acquire(p)                                             \
+({                                                                      \
+        typeof(*p) ___p1;                                               \
+        compiletime_assert_atomic_type(*p);                             \
+        switch (sizeof(*p)) {                                           \
+        case 4:                                                         \
+                asm volatile ("ldar %w0, %1"                            \
+                        : "=r" (___p1) : "Q" (*p) : "memory");          \
+                break;                                                  \
+        case 8:                                                         \
+                asm volatile ("ldar %0, %1"                             \
+                        : "=r" (___p1) : "Q" (*p) : "memory");          \
+                break;                                                  \
+        }                                                               \
+        ___p1;                                                          \
+})
 #endif
 #define read_barrier_depends()          do { } while(0)
diff --git a/arch/arm64/include/asm/cmpxchg.h b/arch/arm64/include/asm/cmpxchg.h
index 3914c0dcd09c..56166d7f4a25 100644
--- a/arch/arm64/include/asm/cmpxchg.h
+++ b/arch/arm64/include/asm/cmpxchg.h
@@ -158,17 +158,23 @@ static inline unsigned long __cmpxchg_mb(volatile void *ptr, unsigned long old,
        return ret;
 }
-#define cmpxchg(ptr,o,n)                                                \
+#define cmpxchg(ptr, o, n) \
-        ((__typeof__(*(ptr)))__cmpxchg_mb((ptr),                        \
+({ \
-                                          (unsigned long)(o),           \
+        __typeof__(*(ptr)) __ret; \
-                                          (unsigned long)(n),           \
+        __ret = (__typeof__(*(ptr))) \
-                                          sizeof(*(ptr))))
+                __cmpxchg_mb((ptr), (unsigned long)(o), (unsigned long)(n), \
+                             sizeof(*(ptr))); \
-#define cmpxchg_local(ptr,o,n)                                          \
+        __ret; \
-        ((__typeof__(*(ptr)))__cmpxchg((ptr),                           \
+})
-                                       (unsigned long)(o),              \
-                                       (unsigned long)(n),              \
+#define cmpxchg_local(ptr, o, n) \
-                                       sizeof(*(ptr))))
+({ \
+        __typeof__(*(ptr)) __ret; \
+        __ret = (__typeof__(*(ptr))) \
+                __cmpxchg((ptr), (unsigned long)(o), \
+                          (unsigned long)(n), sizeof(*(ptr))); \
+        __ret; \
+})
 #define cmpxchg64(ptr,o,n)              cmpxchg((ptr),(o),(n))
 #define cmpxchg64_local(ptr,o,n)        cmpxchg_local((ptr),(o),(n))
diff --git a/arch/arm64/include/asm/cpu_ops.h b/arch/arm64/include/asm/cpu_ops.h
index c4cdb5e5b73d..152413076503 100644
--- a/arch/arm64/include/asm/cpu_ops.h
+++ b/arch/arm64/include/asm/cpu_ops.h
@@ -39,6 +39,9 @@ struct device_node;
 *              from the cpu to be killed.
 * @cpu_die:    Makes a cpu leave the kernel. Must not fail. Called from the
 *              cpu being killed.
+ * @cpu_suspend: Suspends a cpu and saves the required context. May fail owing
+ *               to wrong parameters or error conditions. Called from the
+ *               CPU being suspended. Must be called with IRQs disabled.
 */
 struct cpu_operations {
        const char      *name;
@@ -50,6 +53,9 @@ struct cpu_operations {
        int             (*cpu_disable)(unsigned int cpu);
        void            (*cpu_die)(unsigned int cpu);
 #endif
+#ifdef CONFIG_ARM64_CPU_SUSPEND
+        int             (*cpu_suspend)(unsigned long);
+#endif
 };
 extern const struct cpu_operations *cpu_ops[NR_CPUS];
diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h
index 5fe138e0b828..c404fb0df3a6 100644
--- a/arch/arm64/include/asm/cputype.h
+++ b/arch/arm64/include/asm/cputype.h
@@ -16,23 +16,23 @@
 #ifndef __ASM_CPUTYPE_H
 #define __ASM_CPUTYPE_H
-#define ID_MIDR_EL1             "midr_el1"
-#define ID_MPIDR_EL1            "mpidr_el1"
-#define ID_CTR_EL0              "ctr_el0"
-#define ID_AA64PFR0_EL1         "id_aa64pfr0_el1"
-#define ID_AA64DFR0_EL1         "id_aa64dfr0_el1"
-#define ID_AA64AFR0_EL1         "id_aa64afr0_el1"
-#define ID_AA64ISAR0_EL1        "id_aa64isar0_el1"
-#define ID_AA64MMFR0_EL1        "id_aa64mmfr0_el1"
 #define INVALID_HWID            ULONG_MAX
 #define MPIDR_HWID_BITMASK      0xff00ffffff
+#define MPIDR_LEVEL_BITS_SHIFT  3
+#define MPIDR_LEVEL_BITS        (1 << MPIDR_LEVEL_BITS_SHIFT)
+#define MPIDR_LEVEL_MASK        ((1 << MPIDR_LEVEL_BITS) - 1)
+#define MPIDR_LEVEL_SHIFT(level) \
+        (((1 << level) >> 1) << MPIDR_LEVEL_BITS_SHIFT)
+#define MPIDR_AFFINITY_LEVEL(mpidr, level) \
+        ((mpidr >> MPIDR_LEVEL_SHIFT(level)) & MPIDR_LEVEL_MASK)
 #define read_cpuid(reg) ({                                              \
        u64 __val;                                                      \
-        asm("mrs        %0, " reg : "=r" (__val));                      \
+        asm("mrs        %0, " #reg : "=r" (__val));                     \
        __val;                                                          \
 })
@@ -54,12 +54,12 @@
 */
 static inline u32 __attribute_const__ read_cpuid_id(void)
 {
-        return read_cpuid(ID_MIDR_EL1);
+        return read_cpuid(MIDR_EL1);
 }
 static inline u64 __attribute_const__ read_cpuid_mpidr(void)
 {
-        return read_cpuid(ID_MPIDR_EL1);
+        return read_cpuid(MPIDR_EL1);
 }
 static inline unsigned int __attribute_const__ read_cpuid_implementor(void)
@@ -74,7 +74,7 @@ static inline unsigned int __attribute_const__ read_cpuid_part_number(void)
 static inline u32 __attribute_const__ read_cpuid_cachetype(void)
 {
-        return read_cpuid(ID_CTR_EL0);
+        return read_cpuid(CTR_EL0);
 }
 #endif /* __ASSEMBLY__ */
diff --git a/arch/arm64/include/asm/debug-monitors.h b/arch/arm64/include/asm/debug-monitors.h
index a2232d07be9d..62314791570c 100644
--- a/arch/arm64/include/asm/debug-monitors.h
+++ b/arch/arm64/include/asm/debug-monitors.h
@@ -62,6 +62,27 @@ struct task_struct;
 #define DBG_ARCH_ID_RESERVED    0       /* In case of ptrace ABI updates. */
+#define DBG_HOOK_HANDLED        0
+#define DBG_HOOK_ERROR          1
+struct step_hook {
+        struct list_head node;
+        int (*fn)(struct pt_regs *regs, unsigned int esr);
+};
+void register_step_hook(struct step_hook *hook);
+void unregister_step_hook(struct step_hook *hook);
+struct break_hook {
+        struct list_head node;
+        u32 esr_val;
+        u32 esr_mask;
+        int (*fn)(struct pt_regs *regs, unsigned int esr);
+};
+void register_break_hook(struct break_hook *hook);
+void unregister_break_hook(struct break_hook *hook);
 u8 debug_monitors_arch(void);
 void enable_debug_monitors(enum debug_el el);
diff --git a/arch/arm64/include/asm/dma-contiguous.h b/arch/arm64/include/asm/dma-contiguous.h
new file mode 100644
index 000000000000..d6aacb61ff4a
--- /dev/null
+++ b/arch/arm64/include/asm/dma-contiguous.h
@@ -0,0 +1,29 @@
+/*
+ * Copyright (c) 2013, The Linux Foundation. All rights reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 and
+ * only version 2 as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#ifndef _ASM_DMA_CONTIGUOUS_H
+#define _ASM_DMA_CONTIGUOUS_H
+#ifdef __KERNEL__
+#ifdef CONFIG_DMA_CMA
+#include <linux/types.h>
+#include <asm-generic/dma-contiguous.h>
+static inline void
+dma_contiguous_early_fixup(phys_addr_t base, unsigned long size) { }
+#endif
+#endif
+#endif
diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
index c582fa316366..78cc3aba5d69 100644
--- a/arch/arm64/include/asm/futex.h
+++ b/arch/arm64/include/asm/futex.h
@@ -30,6 +30,7 @@
 "       cbnz    %w3, 1b\n"                                              \
 "3:\n"                                                                  \
 "       .pushsection .fixup,\"ax\"\n"                                   \
+"       .align  2\n"                                                    \
 "4:     mov     %w0, %w5\n"                                             \
 "       b       3b\n"                                                   \
 "       .popsection\n"                                                  \
diff --git a/arch/arm64/include/asm/hardirq.h b/arch/arm64/include/asm/hardirq.h
index 990c051e7829..ae4801d77514 100644
--- a/arch/arm64/include/asm/hardirq.h
+++ b/arch/arm64/include/asm/hardirq.h
@@ -20,7 +20,7 @@
 #include <linux/threads.h>
 #include <asm/irq.h>
-#define NR_IPI  4
+#define NR_IPI  5
 typedef struct {
        unsigned int __softirq_pending;
diff --git a/arch/arm64/include/asm/insn.h b/arch/arm64/include/asm/insn.h
new file mode 100644
index 000000000000..c44ad39ed310
--- /dev/null
+++ b/arch/arm64/include/asm/insn.h
@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2013 Huawei Ltd.
+ * Author: Jiang Liu <liuj97@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __ASM_INSN_H
+#define __ASM_INSN_H
+#include <linux/types.h>
+/* A64 instructions are always 32 bits. */
+#define AARCH64_INSN_SIZE               4
+/*
+ * ARM Architecture Reference Manual for ARMv8 Profile-A, Issue A.a
+ * Section C3.1 "A64 instruction index by encoding":
+ * AArch64 main encoding table
+ *  Bit position
+ *   28 27 26 25        Encoding Group
+ *   0  0  -  -         Unallocated
+ *   1  0  0  -         Data processing, immediate
+ *   1  0  1  -         Branch, exception generation and system instructions
+ *   -  1  -  0         Loads and stores
+ *   -  1  0  1         Data processing - register
+ *   0  1  1  1         Data processing - SIMD and floating point
+ *   1  1  1  1         Data processing - SIMD and floating point
+ * "-" means "don't care"
+ */
+enum aarch64_insn_encoding_class {
+        AARCH64_INSN_CLS_UNKNOWN,       /* UNALLOCATED */
+        AARCH64_INSN_CLS_DP_IMM,        /* Data processing - immediate */
+        AARCH64_INSN_CLS_DP_REG,        /* Data processing - register */
+        AARCH64_INSN_CLS_DP_FPSIMD,     /* Data processing - SIMD and FP */
+        AARCH64_INSN_CLS_LDST,          /* Loads and stores */
+        AARCH64_INSN_CLS_BR_SYS,        /* Branch, exception generation and
+                                         * system instructions */
+};
+enum aarch64_insn_hint_op {
+        AARCH64_INSN_HINT_NOP   = 0x0 << 5,
+        AARCH64_INSN_HINT_YIELD = 0x1 << 5,
+        AARCH64_INSN_HINT_WFE   = 0x2 << 5,
+        AARCH64_INSN_HINT_WFI   = 0x3 << 5,
+        AARCH64_INSN_HINT_SEV   = 0x4 << 5,
+        AARCH64_INSN_HINT_SEVL  = 0x5 << 5,
+};
+enum aarch64_insn_imm_type {
+        AARCH64_INSN_IMM_ADR,
+        AARCH64_INSN_IMM_26,
+        AARCH64_INSN_IMM_19,
+        AARCH64_INSN_IMM_16,
+        AARCH64_INSN_IMM_14,
+        AARCH64_INSN_IMM_12,
+        AARCH64_INSN_IMM_9,
+        AARCH64_INSN_IMM_MAX
+};
+enum aarch64_insn_branch_type {
+        AARCH64_INSN_BRANCH_NOLINK,
+        AARCH64_INSN_BRANCH_LINK,
+};
+#define __AARCH64_INSN_FUNCS(abbr, mask, val)   \
+static __always_inline bool aarch64_insn_is_##abbr(u32 code) \
+{ return (code & (mask)) == (val); } \
+static __always_inline u32 aarch64_insn_get_##abbr##_value(void) \
+{ return (val); }
+__AARCH64_INSN_FUNCS(b,         0xFC000000, 0x14000000)
+__AARCH64_INSN_FUNCS(bl,        0xFC000000, 0x94000000)
+__AARCH64_INSN_FUNCS(svc,       0xFFE0001F, 0xD4000001)
+__AARCH64_INSN_FUNCS(hvc,       0xFFE0001F, 0xD4000002)
+__AARCH64_INSN_FUNCS(smc,       0xFFE0001F, 0xD4000003)
+__AARCH64_INSN_FUNCS(brk,       0xFFE0001F, 0xD4200000)
+__AARCH64_INSN_FUNCS(hint,      0xFFFFF01F, 0xD503201F)
+#undef  __AARCH64_INSN_FUNCS
+bool aarch64_insn_is_nop(u32 insn);
+int aarch64_insn_read(void *addr, u32 *insnp);
+int aarch64_insn_write(void *addr, u32 insn);
+enum aarch64_insn_encoding_class aarch64_get_insn_class(u32 insn);
+u32 aarch64_insn_encode_immediate(enum aarch64_insn_imm_type type,
+                                  u32 insn, u64 imm);
+u32 aarch64_insn_gen_branch_imm(unsigned long pc, unsigned long addr,
+                                enum aarch64_insn_branch_type type);
+u32 aarch64_insn_gen_hint(enum aarch64_insn_hint_op op);
+u32 aarch64_insn_gen_nop(void);
+bool aarch64_insn_hotpatch_safe(u32 old_insn, u32 new_insn);
+int aarch64_insn_patch_text_nosync(void *addr, u32 insn);
+int aarch64_insn_patch_text_sync(void *addrs[], u32 insns[], int cnt);
+int aarch64_insn_patch_text(void *addrs[], u32 insns[], int cnt);
+#endif  /* __ASM_INSN_H */
diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h
index 572769727227..4cc813eddacb 100644
--- a/arch/arm64/include/asm/io.h
+++ b/arch/arm64/include/asm/io.h
@@ -229,7 +229,7 @@ extern void __iomem *__ioremap(phys_addr_t phys_addr, size_t size, pgprot_t prot
 extern void __iounmap(volatile void __iomem *addr);
 extern void __iomem *ioremap_cache(phys_addr_t phys_addr, size_t size);
-#define PROT_DEFAULT            (pgprot_default | PTE_DIRTY)
+#define PROT_DEFAULT            (PTE_TYPE_PAGE | PTE_AF | PTE_DIRTY)
 #define PROT_DEVICE_nGnRE       (PROT_DEFAULT | PTE_PXN | PTE_UXN | PTE_ATTRINDX(MT_DEVICE_nGnRE))
 #define PROT_NORMAL_NC          (PROT_DEFAULT | PTE_ATTRINDX(MT_NORMAL_NC))
 #define PROT_NORMAL             (PROT_DEFAULT | PTE_ATTRINDX(MT_NORMAL))
diff --git a/arch/arm64/include/asm/jump_label.h b/arch/arm64/include/asm/jump_label.h
new file mode 100644
index 000000000000..076a1c714049
--- /dev/null
+++ b/arch/arm64/include/asm/jump_label.h
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2013 Huawei Ltd.
+ * Author: Jiang Liu <liuj97@gmail.com>
+ *
+ * Based on arch/arm/include/asm/jump_label.h
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __ASM_JUMP_LABEL_H
+#define __ASM_JUMP_LABEL_H
+#include <linux/types.h>
+#include <asm/insn.h>
+#ifdef __KERNEL__
+#define JUMP_LABEL_NOP_SIZE             AARCH64_INSN_SIZE
+static __always_inline bool arch_static_branch(struct static_key *key)
+{
+        asm goto("1: nop\n\t"
+                 ".pushsection __jump_table,  \"aw\"\n\t"
+                 ".align 3\n\t"
+                 ".quad 1b, %l[l_yes], %c0\n\t"
+                 ".popsection\n\t"
+                 :  :  "i"(key) :  : l_yes);
+        return false;
+l_yes:
+        return true;
+}
+#endif /* __KERNEL__ */
+typedef u64 jump_label_t;
+struct jump_entry {
+        jump_label_t code;
+        jump_label_t target;
+        jump_label_t key;
+};
+#endif  /* __ASM_JUMP_LABEL_H */
diff --git a/arch/arm64/include/asm/memory.h b/arch/arm64/include/asm/memory.h
index 37762175896f..9dc5dc39fded 100644
--- a/arch/arm64/include/asm/memory.h
+++ b/arch/arm64/include/asm/memory.h
@@ -146,8 +146,7 @@ static inline void *phys_to_virt(phys_addr_t x)
 #define ARCH_PFN_OFFSET         PHYS_PFN_OFFSET
 #define virt_to_page(kaddr)     pfn_to_page(__pa(kaddr) >> PAGE_SHIFT)
-#define virt_addr_valid(kaddr)  (((void *)(kaddr) >= (void *)PAGE_OFFSET) && \
+#define virt_addr_valid(kaddr)  pfn_valid(__pa(kaddr) >> PAGE_SHIFT)
-                                 ((void *)(kaddr) < (void *)high_memory))
 #endif
diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h
new file mode 100644
index 000000000000..13fb0b3efc5f
--- /dev/null
+++ b/arch/arm64/include/asm/percpu.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2013 ARM Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __ASM_PERCPU_H
+#define __ASM_PERCPU_H
+static inline void set_my_cpu_offset(unsigned long off)
+{
+        asm volatile("msr tpidr_el1, %0" :: "r" (off) : "memory");
+}
+static inline unsigned long __my_cpu_offset(void)
+{
+        unsigned long off;
+        register unsigned long *sp asm ("sp");
+        /*
+         * We want to allow caching the value, so avoid using volatile and
+         * instead use a fake stack read to hazard against barrier().
+         */
+        asm("mrs %0, tpidr_el1" : "=r" (off) : "Q" (*sp));
+        return off;
+}
+#define __my_cpu_offset __my_cpu_offset()
+#include <asm-generic/percpu.h>
+#endif /* __ASM_PERCPU_H */
diff --git a/arch/arm64/include/asm/proc-fns.h b/arch/arm64/include/asm/proc-fns.h
index 7cdf466fd0c5..0c657bb54597 100644
--- a/arch/arm64/include/asm/proc-fns.h
+++ b/arch/arm64/include/asm/proc-fns.h
@@ -26,11 +26,14 @@
 #include <asm/page.h>
 struct mm_struct;
+struct cpu_suspend_ctx;
 extern void cpu_cache_off(void);
 extern void cpu_do_idle(void);
 extern void cpu_do_switch_mm(unsigned long pgd_phys, struct mm_struct *mm);
 extern void cpu_reset(unsigned long addr) __attribute__((noreturn));
+extern void cpu_do_suspend(struct cpu_suspend_ctx *ptr);
+extern u64 cpu_do_resume(phys_addr_t ptr, u64 idmap_ttbr);
 #include <asm/memory.h>
diff --git a/arch/arm64/include/asm/smp_plat.h b/arch/arm64/include/asm/smp_plat.h
index ed43a0d2b1b2..59e282311b58 100644
--- a/arch/arm64/include/asm/smp_plat.h
+++ b/arch/arm64/include/asm/smp_plat.h
@@ -21,6 +21,19 @@
 #include <asm/types.h>
+struct mpidr_hash {
+        u64     mask;
+        u32     shift_aff[4];
+        u32     bits;
+};
+extern struct mpidr_hash mpidr_hash;
+static inline u32 mpidr_hash_size(void)
+{
+        return 1 << mpidr_hash.bits;
+}
 /*
 * Logical CPU mapping.
 */
diff --git a/arch/arm64/include/asm/suspend.h b/arch/arm64/include/asm/suspend.h
new file mode 100644
index 000000000000..e9c149c042e0
--- /dev/null
+++ b/arch/arm64/include/asm/suspend.h
@@ -0,0 +1,27 @@
+#ifndef __ASM_SUSPEND_H
+#define __ASM_SUSPEND_H
+#define NR_CTX_REGS 11
+/*
+ * struct cpu_suspend_ctx must be 16-byte aligned since it is allocated on
+ * the stack, which must be 16-byte aligned on v8
+ */
+struct cpu_suspend_ctx {
+        /*
+         * This struct must be kept in sync with
+         * cpu_do_{suspend/resume} in mm/proc.S
+         */
+        u64 ctx_regs[NR_CTX_REGS];
+        u64 sp;
+} __aligned(16);
+struct sleep_save_sp {
+        phys_addr_t *save_ptr_stash;
+        phys_addr_t save_ptr_stash_phys;
+};
+extern void cpu_resume(void);
+extern int cpu_suspend(unsigned long);
+#endif
diff --git a/arch/arm64/include/asm/uaccess.h b/arch/arm64/include/asm/uaccess.h
index 7ecc2b23882e..6c0f684aca81 100644
--- a/arch/arm64/include/asm/uaccess.h
+++ b/arch/arm64/include/asm/uaccess.h
@@ -100,6 +100,7 @@ static inline void set_fs(mm_segment_t fs)
 })
 #define access_ok(type, addr, size)     __range_ok(addr, size)
+#define user_addr_max                   get_fs
 /*
 * The "__xxx" versions of the user access functions do not verify the address
@@ -240,9 +241,6 @@ extern unsigned long __must_check __copy_to_user(void __user *to, const void *fr
 extern unsigned long __must_check __copy_in_user(void __user *to, const void __user *from, unsigned long n);
 extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
-extern unsigned long __must_check __strncpy_from_user(char *to, const char __user *from, unsigned long count);
-extern unsigned long __must_check __strnlen_user(const char __user *s, long n);
 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
 {
        if (access_ok(VERIFY_READ, from, n))
@@ -276,24 +274,9 @@ static inline unsigned long __must_check clear_user(void __user *to, unsigned lo
        return n;
 }
-static inline long __must_check strncpy_from_user(char *dst, const char __user *src, long count)
+extern long strncpy_from_user(char *dest, const char __user *src, long count);
-{
-        long res = -EFAULT;
-        if (access_ok(VERIFY_READ, src, 1))
-                res = __strncpy_from_user(dst, src, count);
-        return res;
-}
-#define strlen_user(s)  strnlen_user(s, ~0UL >> 1)
-static inline long __must_check strnlen_user(const char __user *s, long n)
+extern __must_check long strlen_user(const char __user *str);
-{
+extern __must_check long strnlen_user(const char __user *str, long n);
-        unsigned long res = 0;
-        if (__addr_ok(s))
-                res = __strnlen_user(s, n);
-        return res;
-}
 #endif /* __ASM_UACCESS_H */
diff --git a/arch/arm64/include/asm/word-at-a-time.h b/arch/arm64/include/asm/word-at-a-time.h
new file mode 100644
index 000000000000..aab5bf09e9d9
--- /dev/null
+++ b/arch/arm64/include/asm/word-at-a-time.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2013 ARM Ltd.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#ifndef __ASM_WORD_AT_A_TIME_H
+#define __ASM_WORD_AT_A_TIME_H
+#ifndef __AARCH64EB__
+#include <linux/kernel.h>
+struct word_at_a_time {
+        const unsigned long one_bits, high_bits;
+};
+#define WORD_AT_A_TIME_CONSTANTS { REPEAT_BYTE(0x01), REPEAT_BYTE(0x80) }
+static inline unsigned long has_zero(unsigned long a, unsigned long *bits,
+                                     const struct word_at_a_time *c)
+{
+        unsigned long mask = ((a - c->one_bits) & ~a) & c->high_bits;
+        *bits = mask;
+        return mask;
+}
+#define prep_zero_mask(a, bits, c) (bits)
+static inline unsigned long create_zero_mask(unsigned long bits)
+{
+        bits = (bits - 1) & ~bits;
+        return bits >> 7;
+}
+static inline unsigned long find_zero(unsigned long mask)
+{
+        return fls64(mask) >> 3;
+}
+#define zero_bytemask(mask) (mask)
+#else   /* __AARCH64EB__ */
+#include <asm-generic/word-at-a-time.h>
+#endif
+/*
+ * Load an unaligned word from kernel space.
+ *
+ * In the (very unlikely) case of the word being a page-crosser
+ * and the next page not being mapped, take the exception and
+ * return zeroes in the non-existing part.
+ */
+static inline unsigned long load_unaligned_zeropad(const void *addr)
+{
+        unsigned long ret, offset;
+        /* Load word from unaligned pointer addr */
+        asm(
+        "1:     ldr     %0, %3\n"
+        "2:\n"
+        "       .pushsection .fixup,\"ax\"\n"
+        "       .align 2\n"
+        "3:     and     %1, %2, #0x7\n"
+        "       bic     %2, %2, #0x7\n"
+        "       ldr     %0, [%2]\n"
+        "       lsl     %1, %1, #0x3\n"
+#ifndef __AARCH64EB__
+        "       lsr     %0, %0, %1\n"
+#else
+        "       lsl     %0, %0, %1\n"
+#endif
+        "       b       2b\n"
+        "       .popsection\n"
+        "       .pushsection __ex_table,\"a\"\n"
+        "       .align  3\n"
+        "       .quad   1b, 3b\n"
+        "       .popsection"
+        : "=&r" (ret), "=&r" (offset)
+        : "r" (addr), "Q" (*(unsigned long *)addr));
+        return ret;
+}
+#endif /* __ASM_WORD_AT_A_TIME_H */
diff --git a/arch/arm64/include/uapi/asm/hwcap.h b/arch/arm64/include/uapi/asm/hwcap.h
index 9b12476e9c85..73cf0f54d57c 100644
--- a/arch/arm64/include/uapi/asm/hwcap.h
+++ b/arch/arm64/include/uapi/asm/hwcap.h
@@ -22,6 +22,10 @@
 #define HWCAP_FP                (1 << 0)
 #define HWCAP_ASIMD             (1 << 1)
 #define HWCAP_EVTSTRM           (1 << 2)
+#define HWCAP_AES               (1 << 3)
+#define HWCAP_PMULL             (1 << 4)
+#define HWCAP_SHA1              (1 << 5)
+#define HWCAP_SHA2              (1 << 6)
+#define HWCAP_CRC32             (1 << 7)
 #endif /* _UAPI__ASM_HWCAP_H */
diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile
index 5ba2fd43a75b..2d4554b13410 100644
--- a/arch/arm64/kernel/Makefile
+++ b/arch/arm64/kernel/Makefile
@@ -9,7 +9,7 @@ AFLAGS_head.o		:= -DTEXT_OFFSET=$(TEXT_OFFSET)
 arm64-obj-y             := cputable.o debug-monitors.o entry.o irq.o fpsimd.o   \
                           entry-fpsimd.o process.o ptrace.o setup.o signal.o   \
                           sys.o stacktrace.o time.o traps.o io.o vdso.o        \
-                           hyp-stub.o psci.o cpu_ops.o
+                           hyp-stub.o psci.o cpu_ops.o insn.o
 arm64-obj-$(CONFIG_COMPAT)              += sys32.o kuser32.o signal32.o         \
                                           sys_compat.o
@@ -18,6 +18,8 @@ arm64-obj-$(CONFIG_SMP)			+= smp.o smp_spin_table.o
 arm64-obj-$(CONFIG_HW_PERF_EVENTS)      += perf_event.o
 arm64-obj-$(CONFIG_HAVE_HW_BREAKPOINT)+= hw_breakpoint.o
 arm64-obj-$(CONFIG_EARLY_PRINTK)        += early_printk.o
+arm64-obj-$(CONFIG_ARM64_CPU_SUSPEND)   += sleep.o suspend.o
+arm64-obj-$(CONFIG_JUMP_LABEL)          += jump_label.o
 obj-y                                   += $(arm64-obj-y) vdso/
 obj-m                                   += $(arm64-obj-m)
diff --git a/arch/arm64/kernel/arm64ksyms.c b/arch/arm64/kernel/arm64ksyms.c
index e7ee770c0697..338b568cd8ae 100644
--- a/arch/arm64/kernel/arm64ksyms.c
+++ b/arch/arm64/kernel/arm64ksyms.c
@@ -29,13 +29,10 @@
 #include <asm/checksum.h>
-        /* user mem (segment) */
-EXPORT_SYMBOL(__strnlen_user);
-EXPORT_SYMBOL(__strncpy_from_user);
 EXPORT_SYMBOL(copy_page);
 EXPORT_SYMBOL(clear_page);
+        /* user mem (segment) */
 EXPORT_SYMBOL(__copy_from_user);
 EXPORT_SYMBOL(__copy_to_user);
 EXPORT_SYMBOL(__clear_user);
diff --git a/arch/arm64/kernel/asm-offsets.c b/arch/arm64/kernel/asm-offsets.c
index 666e231d410b..646f888387cd 100644
--- a/arch/arm64/kernel/asm-offsets.c
+++ b/arch/arm64/kernel/asm-offsets.c
@@ -25,6 +25,8 @@
 #include <asm/thread_info.h>
 #include <asm/memory.h>
 #include <asm/cputable.h>
+#include <asm/smp_plat.h>
+#include <asm/suspend.h>
 #include <asm/vdso_datapage.h>
 #include <linux/kbuild.h>
@@ -138,5 +140,14 @@ int main(void)
  DEFINE(KVM_VTTBR,             offsetof(struct kvm, arch.vttbr));
  DEFINE(KVM_VGIC_VCTRL,        offsetof(struct kvm, arch.vgic.vctrl_base));
 #endif
+#ifdef CONFIG_ARM64_CPU_SUSPEND
+  DEFINE(CPU_SUSPEND_SZ,        sizeof(struct cpu_suspend_ctx));
+  DEFINE(CPU_CTX_SP,            offsetof(struct cpu_suspend_ctx, sp));
+  DEFINE(MPIDR_HASH_MASK,       offsetof(struct mpidr_hash, mask));
+  DEFINE(MPIDR_HASH_SHIFTS,     offsetof(struct mpidr_hash, shift_aff));
+  DEFINE(SLEEP_SAVE_SP_SZ,      sizeof(struct sleep_save_sp));
+  DEFINE(SLEEP_SAVE_SP_PHYS,    offsetof(struct sleep_save_sp, save_ptr_stash_phys));
+  DEFINE(SLEEP_SAVE_SP_VIRT,    offsetof(struct sleep_save_sp, save_ptr_stash));
+#endif
  return 0;
 }
diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
index 4ae68579031d..636ba8b6240b 100644
--- a/arch/arm64/kernel/debug-monitors.c
+++ b/arch/arm64/kernel/debug-monitors.c
@@ -187,6 +187,48 @@ static void clear_regs_spsr_ss(struct pt_regs *regs)
        regs->pstate = spsr;
 }
+/* EL1 Single Step Handler hooks */
+static LIST_HEAD(step_hook);
+DEFINE_RWLOCK(step_hook_lock);
+void register_step_hook(struct step_hook *hook)
+{
+        write_lock(&step_hook_lock);
+        list_add(&hook->node, &step_hook);
+        write_unlock(&step_hook_lock);
+}
+void unregister_step_hook(struct step_hook *hook)
+{
+        write_lock(&step_hook_lock);
+        list_del(&hook->node);
+        write_unlock(&step_hook_lock);
+}
+/*
+ * Call registered single step handers
+ * There is no Syndrome info to check for determining the handler.
+ * So we call all the registered handlers, until the right handler is
+ * found which returns zero.
+ */
+static int call_step_hook(struct pt_regs *regs, unsigned int esr)
+{
+        struct step_hook *hook;
+        int retval = DBG_HOOK_ERROR;
+        read_lock(&step_hook_lock);
+        list_for_each_entry(hook, &step_hook, node)     {
+                retval = hook->fn(regs, esr);
+                if (retval == DBG_HOOK_HANDLED)
+                        break;
+        }
+        read_unlock(&step_hook_lock);
+        return retval;
+}
 static int single_step_handler(unsigned long addr, unsigned int esr,
                               struct pt_regs *regs)
 {
@@ -214,7 +256,9 @@ static int single_step_handler(unsigned long addr, unsigned int esr,
                 */
                user_rewind_single_step(current);
        } else {
-                /* TODO: route to KGDB */
+                if (call_step_hook(regs, esr) == DBG_HOOK_HANDLED)
+                        return 0;
                pr_warning("Unexpected kernel single-step exception at EL1\n");
                /*
                 * Re-enable stepping since we know that we will be
@@ -226,11 +270,53 @@ static int single_step_handler(unsigned long addr, unsigned int esr,
        return 0;
 }
+/*
+ * Breakpoint handler is re-entrant as another breakpoint can
+ * hit within breakpoint handler, especically in kprobes.
+ * Use reader/writer locks instead of plain spinlock.
+ */
+static LIST_HEAD(break_hook);
+DEFINE_RWLOCK(break_hook_lock);
+void register_break_hook(struct break_hook *hook)
+{
+        write_lock(&break_hook_lock);
+        list_add(&hook->node, &break_hook);
+        write_unlock(&break_hook_lock);
+}
+void unregister_break_hook(struct break_hook *hook)
+{
+        write_lock(&break_hook_lock);
+        list_del(&hook->node);
+        write_unlock(&break_hook_lock);
+}
+static int call_break_hook(struct pt_regs *regs, unsigned int esr)
+{
+        struct break_hook *hook;
+        int (*fn)(struct pt_regs *regs, unsigned int esr) = NULL;
+        read_lock(&break_hook_lock);
+        list_for_each_entry(hook, &break_hook, node)
+                if ((esr & hook->esr_mask) == hook->esr_val)
+                        fn = hook->fn;
+        read_unlock(&break_hook_lock);
+        return fn ? fn(regs, esr) : DBG_HOOK_ERROR;
+}
 static int brk_handler(unsigned long addr, unsigned int esr,
                       struct pt_regs *regs)
 {
        siginfo_t info;
+        if (call_break_hook(regs, esr) == DBG_HOOK_HANDLED)
+                return 0;
+        pr_warn("unexpected brk exception at %lx, esr=0x%x\n",
+                        (long)instruction_pointer(regs), esr);
        if (!user_mode(regs))
                return -EFAULT;
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 4d2c6f3f0c41..39ac630d83de 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -288,6 +288,8 @@ el1_dbg:
        /*
         * Debug exception handling
         */
+        cmp     x24, #ESR_EL1_EC_BRK64          // if BRK64
+        cinc    x24, x24, eq                    // set bit '0'
        tbz     x24, #0, el1_inv                // EL1 only
        mrs     x0, far_el1
        mov     x2, sp                          // struct pt_regs
@@ -314,7 +316,7 @@ el1_irq:
 #ifdef CONFIG_PREEMPT
        get_thread_info tsk
-        ldr     w24, [tsk, #TI_PREEMPT]         // restore preempt count
+        ldr     w24, [tsk, #TI_PREEMPT]         // get preempt count
        cbnz    w24, 1f                         // preempt count != 0
        ldr     x0, [tsk, #TI_FLAGS]            // get flags
        tbz     x0, #TIF_NEED_RESCHED, 1f       // needs rescheduling?
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index bb785d23dbde..4aef42a04bdc 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -17,6 +17,7 @@
 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
 */
+#include <linux/cpu_pm.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/sched.h>
@@ -113,6 +114,39 @@ EXPORT_SYMBOL(kernel_neon_end);
 #endif /* CONFIG_KERNEL_MODE_NEON */
+#ifdef CONFIG_CPU_PM
+static int fpsimd_cpu_pm_notifier(struct notifier_block *self,
+                                  unsigned long cmd, void *v)
+{
+        switch (cmd) {
+        case CPU_PM_ENTER:
+                if (current->mm)
+                        fpsimd_save_state(&current->thread.fpsimd_state);
+                break;
+        case CPU_PM_EXIT:
+                if (current->mm)
+                        fpsimd_load_state(&current->thread.fpsimd_state);
+                break;
+        case CPU_PM_ENTER_FAILED:
+        default:
+                return NOTIFY_DONE;
+        }
+        return NOTIFY_OK;
+}
+static struct notifier_block fpsimd_cpu_pm_notifier_block = {
+        .notifier_call = fpsimd_cpu_pm_notifier,
+};
+static void fpsimd_pm_init(void)
+{
+        cpu_pm_register_notifier(&fpsimd_cpu_pm_notifier_block);
+}
+#else
+static inline void fpsimd_pm_init(void) { }
+#endif /* CONFIG_CPU_PM */
 /*
 * FP/SIMD support code initialisation.
 */
@@ -131,6 +165,8 @@ static int __init fpsimd_init(void)
        else
                elf_hwcap |= HWCAP_ASIMD;
+        fpsimd_pm_init();
        return 0;
 }
 late_initcall(fpsimd_init);
diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S
index c68cca5c3523..0b281fffda51 100644
--- a/arch/arm64/kernel/head.S
+++ b/arch/arm64/kernel/head.S
@@ -482,8 +482,6 @@ ENDPROC(__create_page_tables)
        .type   __switch_data, %object
 __switch_data:
        .quad   __mmap_switched
-        .quad   __data_loc                      // x4
-        .quad   _data                           // x5
        .quad   __bss_start                     // x6
        .quad   _end                            // x7
        .quad   processor_id                    // x4
@@ -498,15 +496,7 @@ __switch_data:
 __mmap_switched:
        adr     x3, __switch_data + 8
-        ldp     x4, x5, [x3], #16
        ldp     x6, x7, [x3], #16
-        cmp     x4, x5                          // Copy data segment if needed
-1:      ccmp    x5, x6, #4, ne
-        b.eq    2f
-        ldr     x16, [x4], #8
-        str     x16, [x5], #8
-        b       1b
-2:
 1:      cmp     x6, x7
        b.hs    2f
        str     xzr, [x6], #8                   // Clear BSS
diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c
index ff516f6691e4..f17f581116fc 100644
--- a/arch/arm64/kernel/hw_breakpoint.c
+++ b/arch/arm64/kernel/hw_breakpoint.c
@@ -20,6 +20,7 @@
 #define pr_fmt(fmt) "hw-breakpoint: " fmt
+#include <linux/cpu_pm.h>
 #include <linux/errno.h>
 #include <linux/hw_breakpoint.h>
 #include <linux/perf_event.h>
@@ -169,15 +170,68 @@ static enum debug_el debug_exception_level(int privilege)
        }
 }
-/*
+enum hw_breakpoint_ops {
- * Install a perf counter breakpoint.
+        HW_BREAKPOINT_INSTALL,
+        HW_BREAKPOINT_UNINSTALL,
+        HW_BREAKPOINT_RESTORE
+};
+/**
+ * hw_breakpoint_slot_setup - Find and setup a perf slot according to
+ *                            operations
+ *
+ * @slots: pointer to array of slots
+ * @max_slots: max number of slots
+ * @bp: perf_event to setup
+ * @ops: operation to be carried out on the slot
+ *
+ * Return:
+ *      slot index on success
+ *      -ENOSPC if no slot is available/matches
+ *      -EINVAL on wrong operations parameter
 */
-int arch_install_hw_breakpoint(struct perf_event *bp)
+static int hw_breakpoint_slot_setup(struct perf_event **slots, int max_slots,
+                                    struct perf_event *bp,
+                                    enum hw_breakpoint_ops ops)
+{
+        int i;
+        struct perf_event **slot;
+        for (i = 0; i < max_slots; ++i) {
+                slot = &slots[i];
+                switch (ops) {
+                case HW_BREAKPOINT_INSTALL:
+                        if (!*slot) {
+                                *slot = bp;
+                                return i;
+                        }
+                        break;
+                case HW_BREAKPOINT_UNINSTALL:
+                        if (*slot == bp) {
+                                *slot = NULL;
+                                return i;
+                        }
+                        break;
+                case HW_BREAKPOINT_RESTORE:
+                        if (*slot == bp)
+                                return i;
+                        break;
+                default:
+                        pr_warn_once("Unhandled hw breakpoint ops %d\n", ops);
+                        return -EINVAL;
+                }
+        }
+        return -ENOSPC;
+}
+static int hw_breakpoint_control(struct perf_event *bp,
+                                 enum hw_breakpoint_ops ops)
 {
        struct arch_hw_breakpoint *info = counter_arch_bp(bp);
-        struct perf_event **slot, **slots;
+        struct perf_event **slots;
        struct debug_info *debug_info = &current->thread.debug;
        int i, max_slots, ctrl_reg, val_reg, reg_enable;
+        enum debug_el dbg_el = debug_exception_level(info->ctrl.privilege);
        u32 ctrl;
        if (info->ctrl.type == ARM_BREAKPOINT_EXECUTE) {
@@ -196,67 +250,54 @@ int arch_install_hw_breakpoint(struct perf_event *bp)
                reg_enable = !debug_info->wps_disabled;
        }
-        for (i = 0; i < max_slots; ++i) {
+        i = hw_breakpoint_slot_setup(slots, max_slots, bp, ops);
-                slot = &slots[i];
-                if (!*slot) {
-                        *slot = bp;
-                        break;
-                }
-        }
-        if (WARN_ONCE(i == max_slots, "Can't find any breakpoint slot"))
-                return -ENOSPC;
-        /* Ensure debug monitors are enabled at the correct exception level.  */
+        if (WARN_ONCE(i < 0, "Can't find any breakpoint slot"))
-        enable_debug_monitors(debug_exception_level(info->ctrl.privilege));
+                return i;
-        /* Setup the address register. */
+        switch (ops) {
-        write_wb_reg(val_reg, i, info->address);
+        case HW_BREAKPOINT_INSTALL:
+                /*
+                 * Ensure debug monitors are enabled at the correct exception
+                 * level.
+                 */
+                enable_debug_monitors(dbg_el);
+                /* Fall through */
+        case HW_BREAKPOINT_RESTORE:
+                /* Setup the address register. */
+                write_wb_reg(val_reg, i, info->address);
+                /* Setup the control register. */
+                ctrl = encode_ctrl_reg(info->ctrl);
+                write_wb_reg(ctrl_reg, i,
+                             reg_enable ? ctrl | 0x1 : ctrl & ~0x1);
+                break;
+        case HW_BREAKPOINT_UNINSTALL:
+                /* Reset the control register. */
+                write_wb_reg(ctrl_reg, i, 0);
-        /* Setup the control register. */
+                /*
-        ctrl = encode_ctrl_reg(info->ctrl);
+                 * Release the debug monitors for the correct exception
-        write_wb_reg(ctrl_reg, i, reg_enable ? ctrl | 0x1 : ctrl & ~0x1);
+                 * level.
+                 */
+                disable_debug_monitors(dbg_el);
+                break;
+        }
        return 0;
 }
-void arch_uninstall_hw_breakpoint(struct perf_event *bp)
+/*
+ * Install a perf counter breakpoint.
+ */
+int arch_install_hw_breakpoint(struct perf_event *bp)
 {
-        struct arch_hw_breakpoint *info = counter_arch_bp(bp);
+        return hw_breakpoint_control(bp, HW_BREAKPOINT_INSTALL);
-        struct perf_event **slot, **slots;
+}
-        int i, max_slots, base;
-        if (info->ctrl.type == ARM_BREAKPOINT_EXECUTE) {
-                /* Breakpoint */
-                base = AARCH64_DBG_REG_BCR;
-                slots = this_cpu_ptr(bp_on_reg);
-                max_slots = core_num_brps;
-        } else {
-                /* Watchpoint */
-                base = AARCH64_DBG_REG_WCR;
-                slots = this_cpu_ptr(wp_on_reg);
-                max_slots = core_num_wrps;
-        }
-        /* Remove the breakpoint. */
-        for (i = 0; i < max_slots; ++i) {
-                slot = &slots[i];
-                if (*slot == bp) {
-                        *slot = NULL;
-                        break;
-                }
-        }
-        if (WARN_ONCE(i == max_slots, "Can't find any breakpoint slot"))
-                return;
-        /* Reset the control register. */
-        write_wb_reg(base, i, 0);
-        /* Release the debug monitors for the correct exception level.  */
+void arch_uninstall_hw_breakpoint(struct perf_event *bp)
-        disable_debug_monitors(debug_exception_level(info->ctrl.privilege));
+{
+        hw_breakpoint_control(bp, HW_BREAKPOINT_UNINSTALL);
 }
 static int get_hbp_len(u8 hbp_len)
@@ -806,18 +847,36 @@ void hw_breakpoint_thread_switch(struct task_struct *next)
 /*
 * CPU initialisation.
 */
-static void reset_ctrl_regs(void *unused)
+static void hw_breakpoint_reset(void *unused)
 {
        int i;
+        struct perf_event **slots;
-        for (i = 0; i < core_num_brps; ++i) {
+        /*
-                write_wb_reg(AARCH64_DBG_REG_BCR, i, 0UL);
+         * When a CPU goes through cold-boot, it does not have any installed
-                write_wb_reg(AARCH64_DBG_REG_BVR, i, 0UL);
+         * slot, so it is safe to share the same function for restoring and
+         * resetting breakpoints; when a CPU is hotplugged in, it goes
+         * through the slots, which are all empty, hence it just resets control
+         * and value for debug registers.
+         * When this function is triggered on warm-boot through a CPU PM
+         * notifier some slots might be initialized; if so they are
+         * reprogrammed according to the debug slots content.
+         */
+        for (slots = this_cpu_ptr(bp_on_reg), i = 0; i < core_num_brps; ++i) {
+                if (slots[i]) {
+                        hw_breakpoint_control(slots[i], HW_BREAKPOINT_RESTORE);
+                } else {
+                        write_wb_reg(AARCH64_DBG_REG_BCR, i, 0UL);
+                        write_wb_reg(AARCH64_DBG_REG_BVR, i, 0UL);
+                }
        }
-        for (i = 0; i < core_num_wrps; ++i) {
+        for (slots = this_cpu_ptr(wp_on_reg), i = 0; i < core_num_wrps; ++i) {
-                write_wb_reg(AARCH64_DBG_REG_WCR, i, 0UL);
+                if (slots[i]) {
-                write_wb_reg(AARCH64_DBG_REG_WVR, i, 0UL);
+                        hw_breakpoint_control(slots[i], HW_BREAKPOINT_RESTORE);
+                } else {
+                        write_wb_reg(AARCH64_DBG_REG_WCR, i, 0UL);
+                        write_wb_reg(AARCH64_DBG_REG_WVR, i, 0UL);
+                }
        }
 }
@@ -827,7 +886,7 @@ static int hw_breakpoint_reset_notify(struct notifier_block *self,
 {
        int cpu = (long)hcpu;
        if (action == CPU_ONLINE)
-                smp_call_function_single(cpu, reset_ctrl_regs, NULL, 1);
+                smp_call_function_single(cpu, hw_breakpoint_reset, NULL, 1);
        return NOTIFY_OK;
 }
@@ -835,6 +894,14 @@ static struct notifier_block hw_breakpoint_reset_nb = {
        .notifier_call = hw_breakpoint_reset_notify,
 };
+#ifdef CONFIG_ARM64_CPU_SUSPEND
+extern void cpu_suspend_set_dbg_restorer(void (*hw_bp_restore)(void *));
+#else
+static inline void cpu_suspend_set_dbg_restorer(void (*hw_bp_restore)(void *))
+{
+}
+#endif
 /*
 * One-time initialisation.
 */
@@ -850,8 +917,8 @@ static int __init arch_hw_breakpoint_init(void)
         * Reset the breakpoint resources. We assume that a halting
         * debugger will leave the world in a nice state for us.
         */
-        smp_call_function(reset_ctrl_regs, NULL, 1);
+        smp_call_function(hw_breakpoint_reset, NULL, 1);
-        reset_ctrl_regs(NULL);
+        hw_breakpoint_reset(NULL);
        /* Register debug fault handlers. */
        hook_debug_fault_code(DBG_ESR_EVT_HWBP, breakpoint_handler, SIGTRAP,
@@ -861,6 +928,8 @@ static int __init arch_hw_breakpoint_init(void)
        /* Register hotplug notifier. */
        register_cpu_notifier(&hw_breakpoint_reset_nb);
+        /* Register cpu_suspend hw breakpoint restore hook */
+        cpu_suspend_set_dbg_restorer(hw_breakpoint_reset);
        return 0;
 }
diff --git a/arch/arm64/kernel/insn.c b/arch/arm64/kernel/insn.c
new file mode 100644
index 000000000000..92f36835486b
--- /dev/null
+++ b/arch/arm64/kernel/insn.c
@@ -0,0 +1,304 @@
+/*
+ * Copyright (C) 2013 Huawei Ltd.
+ * Author: Jiang Liu <liuj97@gmail.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/bitops.h>
+#include <linux/compiler.h>
+#include <linux/kernel.h>
+#include <linux/smp.h>
+#include <linux/stop_machine.h>
+#include <linux/uaccess.h>
+#include <asm/cacheflush.h>
+#include <asm/insn.h>
+static int aarch64_insn_encoding_class[] = {
+        AARCH64_INSN_CLS_UNKNOWN,
+        AARCH64_INSN_CLS_UNKNOWN,
+        AARCH64_INSN_CLS_UNKNOWN,
+        AARCH64_INSN_CLS_UNKNOWN,
+        AARCH64_INSN_CLS_LDST,
+        AARCH64_INSN_CLS_DP_REG,
+        AARCH64_INSN_CLS_LDST,
+        AARCH64_INSN_CLS_DP_FPSIMD,
+        AARCH64_INSN_CLS_DP_IMM,
+        AARCH64_INSN_CLS_DP_IMM,
+        AARCH64_INSN_CLS_BR_SYS,
+        AARCH64_INSN_CLS_BR_SYS,
+        AARCH64_INSN_CLS_LDST,
+        AARCH64_INSN_CLS_DP_REG,
+        AARCH64_INSN_CLS_LDST,
+        AARCH64_INSN_CLS_DP_FPSIMD,
+};
+enum aarch64_insn_encoding_class __kprobes aarch64_get_insn_class(u32 insn)
+{
+        return aarch64_insn_encoding_class[(insn >> 25) & 0xf];
+}
+/* NOP is an alias of HINT */
+bool __kprobes aarch64_insn_is_nop(u32 insn)
+{
+        if (!aarch64_insn_is_hint(insn))
+                return false;
+        switch (insn & 0xFE0) {
+        case AARCH64_INSN_HINT_YIELD:
+        case AARCH64_INSN_HINT_WFE:
+        case AARCH64_INSN_HINT_WFI:
+        case AARCH64_INSN_HINT_SEV:
+        case AARCH64_INSN_HINT_SEVL:
+                return false;
+        default:
+                return true;
+        }
+}
+/*
+ * In ARMv8-A, A64 instructions have a fixed length of 32 bits and are always
+ * little-endian.
+ */
+int __kprobes aarch64_insn_read(void *addr, u32 *insnp)
+{
+        int ret;
+        u32 val;
+        ret = probe_kernel_read(&val, addr, AARCH64_INSN_SIZE);
+        if (!ret)
+                *insnp = le32_to_cpu(val);
+        return ret;
+}
+int __kprobes aarch64_insn_write(void *addr, u32 insn)
+{
+        insn = cpu_to_le32(insn);
+        return probe_kernel_write(addr, &insn, AARCH64_INSN_SIZE);
+}
+static bool __kprobes __aarch64_insn_hotpatch_safe(u32 insn)
+{
+        if (aarch64_get_insn_class(insn) != AARCH64_INSN_CLS_BR_SYS)
+                return false;
+        return  aarch64_insn_is_b(insn) ||
+                aarch64_insn_is_bl(insn) ||
+                aarch64_insn_is_svc(insn) ||
+                aarch64_insn_is_hvc(insn) ||
+                aarch64_insn_is_smc(insn) ||
+                aarch64_insn_is_brk(insn) ||
+                aarch64_insn_is_nop(insn);
+}
+/*
+ * ARM Architecture Reference Manual for ARMv8 Profile-A, Issue A.a
+ * Section B2.6.5 "Concurrent modification and execution of instructions":
+ * Concurrent modification and execution of instructions can lead to the
+ * resulting instruction performing any behavior that can be achieved by
+ * executing any sequence of instructions that can be executed from the
+ * same Exception level, except where the instruction before modification
+ * and the instruction after modification is a B, BL, NOP, BKPT, SVC, HVC,
+ * or SMC instruction.
+ */
+bool __kprobes aarch64_insn_hotpatch_safe(u32 old_insn, u32 new_insn)
+{
+        return __aarch64_insn_hotpatch_safe(old_insn) &&
+               __aarch64_insn_hotpatch_safe(new_insn);
+}
+int __kprobes aarch64_insn_patch_text_nosync(void *addr, u32 insn)
+{
+        u32 *tp = addr;
+        int ret;
+        /* A64 instructions must be word aligned */
+        if ((uintptr_t)tp & 0x3)
+                return -EINVAL;
+        ret = aarch64_insn_write(tp, insn);
+        if (ret == 0)
+                flush_icache_range((uintptr_t)tp,
+                                   (uintptr_t)tp + AARCH64_INSN_SIZE);
+        return ret;
+}
+struct aarch64_insn_patch {
+        void            **text_addrs;
+        u32             *new_insns;
+        int             insn_cnt;
+        atomic_t        cpu_count;
+};
+static int __kprobes aarch64_insn_patch_text_cb(void *arg)
+{
+        int i, ret = 0;
+        struct aarch64_insn_patch *pp = arg;
+        /* The first CPU becomes master */
+        if (atomic_inc_return(&pp->cpu_count) == 1) {
+                for (i = 0; ret == 0 && i < pp->insn_cnt; i++)
+                        ret = aarch64_insn_patch_text_nosync(pp->text_addrs[i],
+                                                             pp->new_insns[i]);
+                /*
+                 * aarch64_insn_patch_text_nosync() calls flush_icache_range(),
+                 * which ends with "dsb; isb" pair guaranteeing global
+                 * visibility.
+                 */
+                atomic_set(&pp->cpu_count, -1);
+        } else {
+                while (atomic_read(&pp->cpu_count) != -1)
+                        cpu_relax();
+                isb();
+        }
+        return ret;
+}
+int __kprobes aarch64_insn_patch_text_sync(void *addrs[], u32 insns[], int cnt)
+{
+        struct aarch64_insn_patch patch = {
+                .text_addrs = addrs,
+                .new_insns = insns,
+                .insn_cnt = cnt,
+                .cpu_count = ATOMIC_INIT(0),
+        };
+        if (cnt <= 0)
+                return -EINVAL;
+        return stop_machine(aarch64_insn_patch_text_cb, &patch,
+                            cpu_online_mask);
+}
+int __kprobes aarch64_insn_patch_text(void *addrs[], u32 insns[], int cnt)
+{
+        int ret;
+        u32 insn;
+        /* Unsafe to patch multiple instructions without synchronizaiton */
+        if (cnt == 1) {
+                ret = aarch64_insn_read(addrs[0], &insn);
+                if (ret)
+                        return ret;
+                if (aarch64_insn_hotpatch_safe(insn, insns[0])) {
+                        /*
+                         * ARMv8 architecture doesn't guarantee all CPUs see
+                         * the new instruction after returning from function
+                         * aarch64_insn_patch_text_nosync(). So send IPIs to
+                         * all other CPUs to achieve instruction
+                         * synchronization.
+                         */
+                        ret = aarch64_insn_patch_text_nosync(addrs[0], insns[0]);
+                        kick_all_cpus_sync();
+                        return ret;
+                }
+        }
+        return aarch64_insn_patch_text_sync(addrs, insns, cnt);
+}
+u32 __kprobes aarch64_insn_encode_immediate(enum aarch64_insn_imm_type type,
+                                  u32 insn, u64 imm)
+{
+        u32 immlo, immhi, lomask, himask, mask;
+        int shift;
+        switch (type) {
+        case AARCH64_INSN_IMM_ADR:
+                lomask = 0x3;
+                himask = 0x7ffff;
+                immlo = imm & lomask;
+                imm >>= 2;
+                immhi = imm & himask;
+                imm = (immlo << 24) | (immhi);
+                mask = (lomask << 24) | (himask);
+                shift = 5;
+                break;
+        case AARCH64_INSN_IMM_26:
+                mask = BIT(26) - 1;
+                shift = 0;
+                break;
+        case AARCH64_INSN_IMM_19:
+                mask = BIT(19) - 1;
+                shift = 5;
+                break;
+        case AARCH64_INSN_IMM_16:
+                mask = BIT(16) - 1;
+                shift = 5;
+                break;
+        case AARCH64_INSN_IMM_14:
+                mask = BIT(14) - 1;
+                shift = 5;
+                break;
+        case AARCH64_INSN_IMM_12:
+                mask = BIT(12) - 1;
+                shift = 10;
+                break;
+        case AARCH64_INSN_IMM_9:
+                mask = BIT(9) - 1;
+                shift = 12;
+                break;
+        default:
+                pr_err("aarch64_insn_encode_immediate: unknown immediate encoding %d\n",
+                        type);
+                return 0;
+        }
+        /* Update the immediate field. */
+        insn &= ~(mask << shift);
+        insn |= (imm & mask) << shift;
+        return insn;
+}
+u32 __kprobes aarch64_insn_gen_branch_imm(unsigned long pc, unsigned long addr,
+                                          enum aarch64_insn_branch_type type)
+{
+        u32 insn;
+        long offset;
+        /*
+         * PC: A 64-bit Program Counter holding the address of the current
+         * instruction. A64 instructions must be word-aligned.
+         */
+        BUG_ON((pc & 0x3) || (addr & 0x3));
+        /*
+         * B/BL support [-128M, 128M) offset
+         * ARM64 virtual address arrangement guarantees all kernel and module
+         * texts are within +/-128M.
+         */
+        offset = ((long)addr - (long)pc);
+        BUG_ON(offset < -SZ_128M || offset >= SZ_128M);
+        if (type == AARCH64_INSN_BRANCH_LINK)
+                insn = aarch64_insn_get_bl_value();
+        else
+                insn = aarch64_insn_get_b_value();
+        return aarch64_insn_encode_immediate(AARCH64_INSN_IMM_26, insn,
+                                             offset >> 2);
+}
+u32 __kprobes aarch64_insn_gen_hint(enum aarch64_insn_hint_op op)
+{
+        return aarch64_insn_get_hint_value() | op;
+}
+u32 __kprobes aarch64_insn_gen_nop(void)
+{
+        return aarch64_insn_gen_hint(AARCH64_INSN_HINT_NOP);
+}
diff --git a/arch/arm64/kernel/jump_label.c b/arch/arm64/kernel/jump_label.c
new file mode 100644
index 000000000000..263a166291fb
--- /dev/null
+++ b/arch/arm64/kernel/jump_label.c
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2013 Huawei Ltd.
+ * Author: Jiang Liu <liuj97@gmail.com>
+ *
+ * Based on arch/arm/kernel/jump_label.c
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+#include <linux/kernel.h>
+#include <linux/jump_label.h>
+#include <asm/insn.h>
+#ifdef HAVE_JUMP_LABEL
+static void __arch_jump_label_transform(struct jump_entry *entry,
+                                        enum jump_label_type type,
+                                        bool is_static)
+{
+        void *addr = (void *)entry->code;
+        u32 insn;
+        if (type == JUMP_LABEL_ENABLE) {
+                insn = aarch64_insn_gen_branch_imm(entry->code,
+                                                   entry->target,
+                                                   AARCH64_INSN_BRANCH_NOLINK);
+        } else {
+                insn = aarch64_insn_gen_nop();
+        }
+        if (is_static)
+                aarch64_insn_patch_text_nosync(addr, insn);
+        else
+                aarch64_insn_patch_text(&addr, &insn, 1);
+}
+void arch_jump_label_transform(struct jump_entry *entry,
+                               enum jump_label_type type)
+{
+        __arch_jump_label_transform(entry, type, false);
+}
+void arch_jump_label_transform_static(struct jump_entry *entry,
+                                      enum jump_label_type type)
+{
+        __arch_jump_label_transform(entry, type, true);
+}
+#endif  /* HAVE_JUMP_LABEL */
diff --git a/arch/arm64/kernel/module.c b/arch/arm64/kernel/module.c
index e2ad0d87721f..1eb1cc955139 100644
--- a/arch/arm64/kernel/module.c
+++ b/arch/arm64/kernel/module.c
@@ -25,6 +25,10 @@
 #include <linux/mm.h>
 #include <linux/moduleloader.h>
 #include <linux/vmalloc.h>
+#include <asm/insn.h>
+#define AARCH64_INSN_IMM_MOVNZ          AARCH64_INSN_IMM_MAX
+#define AARCH64_INSN_IMM_MOVK           AARCH64_INSN_IMM_16
 void *module_alloc(unsigned long size)
 {
@@ -94,28 +98,18 @@ static int reloc_data(enum aarch64_reloc_op op, void *place, u64 val, int len)
        return 0;
 }
-enum aarch64_imm_type {
+static int reloc_insn_movw(enum aarch64_reloc_op op, void *place, u64 val,
-        INSN_IMM_MOVNZ,
+                           int lsb, enum aarch64_insn_imm_type imm_type)
-        INSN_IMM_MOVK,
-        INSN_IMM_ADR,
-        INSN_IMM_26,
-        INSN_IMM_19,
-        INSN_IMM_16,
-        INSN_IMM_14,
-        INSN_IMM_12,
-        INSN_IMM_9,
-};
-static u32 encode_insn_immediate(enum aarch64_imm_type type, u32 insn, u64 imm)
 {
-        u32 immlo, immhi, lomask, himask, mask;
+        u64 imm, limit = 0;
-        int shift;
+        s64 sval;
+        u32 insn = le32_to_cpu(*(u32 *)place);
-        /* The instruction stream is always little endian. */
+        sval = do_reloc(op, place, val);
-        insn = le32_to_cpu(insn);
+        sval >>= lsb;
+        imm = sval & 0xffff;
-        switch (type) {
+        if (imm_type == AARCH64_INSN_IMM_MOVNZ) {
-        case INSN_IMM_MOVNZ:
                /*
                 * For signed MOVW relocations, we have to manipulate the
                 * instruction encoding depending on whether or not the
@@ -134,70 +128,12 @@ static u32 encode_insn_immediate(enum aarch64_imm_type type, u32 insn, u64 imm)
                         */
                        imm = ~imm;
                }
-        case INSN_IMM_MOVK:
+                imm_type = AARCH64_INSN_IMM_MOVK;
-                mask = BIT(16) - 1;
-                shift = 5;
-                break;
-        case INSN_IMM_ADR:
-                lomask = 0x3;
-                himask = 0x7ffff;
-                immlo = imm & lomask;
-                imm >>= 2;
-                immhi = imm & himask;
-                imm = (immlo << 24) | (immhi);
-                mask = (lomask << 24) | (himask);
-                shift = 5;
-                break;
-        case INSN_IMM_26:
-                mask = BIT(26) - 1;
-                shift = 0;
-                break;
-        case INSN_IMM_19:
-                mask = BIT(19) - 1;
-                shift = 5;
-                break;
-        case INSN_IMM_16:
-                mask = BIT(16) - 1;
-                shift = 5;
-                break;
-        case INSN_IMM_14:
-                mask = BIT(14) - 1;
-                shift = 5;
-                break;
-        case INSN_IMM_12:
-                mask = BIT(12) - 1;
-                shift = 10;
-                break;
-        case INSN_IMM_9:
-                mask = BIT(9) - 1;
-                shift = 12;
-                break;
-        default:
-                pr_err("encode_insn_immediate: unknown immediate encoding %d\n",
-                        type);
-                return 0;
        }
-        /* Update the immediate field. */
-        insn &= ~(mask << shift);
-        insn |= (imm & mask) << shift;
-        return cpu_to_le32(insn);
-}
-static int reloc_insn_movw(enum aarch64_reloc_op op, void *place, u64 val,
-                           int lsb, enum aarch64_imm_type imm_type)
-{
-        u64 imm, limit = 0;
-        s64 sval;
-        u32 insn = *(u32 *)place;
-        sval = do_reloc(op, place, val);
-        sval >>= lsb;
-        imm = sval & 0xffff;
        /* Update the instruction with the new encoding. */
-        *(u32 *)place = encode_insn_immediate(imm_type, insn, imm);
+        insn = aarch64_insn_encode_immediate(imm_type, insn, imm);
+        *(u32 *)place = cpu_to_le32(insn);
        /* Shift out the immediate field. */
        sval >>= 16;
@@ -206,9 +142,9 @@ static int reloc_insn_movw(enum aarch64_reloc_op op, void *place, u64 val,
         * For unsigned immediates, the overflow check is straightforward.
         * For signed immediates, the sign bit is actually the bit past the
         * most significant bit of the field.
-         * The INSN_IMM_16 immediate type is unsigned.
+         * The AARCH64_INSN_IMM_16 immediate type is unsigned.
         */
-        if (imm_type != INSN_IMM_16) {
+        if (imm_type != AARCH64_INSN_IMM_16) {
                sval++;
                limit++;
        }
@@ -221,11 +157,11 @@ static int reloc_insn_movw(enum aarch64_reloc_op op, void *place, u64 val,
 }
 static int reloc_insn_imm(enum aarch64_reloc_op op, void *place, u64 val,
-                          int lsb, int len, enum aarch64_imm_type imm_type)
+                          int lsb, int len, enum aarch64_insn_imm_type imm_type)
 {
        u64 imm, imm_mask;
        s64 sval;
-        u32 insn = *(u32 *)place;
+        u32 insn = le32_to_cpu(*(u32 *)place);
        /* Calculate the relocation value. */
        sval = do_reloc(op, place, val);
@@ -236,7 +172,8 @@ static int reloc_insn_imm(enum aarch64_reloc_op op, void *place, u64 val,
        imm = sval & imm_mask;
        /* Update the instruction's immediate field. */
-        *(u32 *)place = encode_insn_immediate(imm_type, insn, imm);
+        insn = aarch64_insn_encode_immediate(imm_type, insn, imm);
+        *(u32 *)place = cpu_to_le32(insn);
        /*
         * Extract the upper value bits (including the sign bit) and
@@ -318,125 +255,125 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
                        overflow_check = false;
                case R_AARCH64_MOVW_UABS_G0:
                        ovf = reloc_insn_movw(RELOC_OP_ABS, loc, val, 0,
-                                              INSN_IMM_16);
+                                              AARCH64_INSN_IMM_16);
                        break;
                case R_AARCH64_MOVW_UABS_G1_NC:
                        overflow_check = false;
                case R_AARCH64_MOVW_UABS_G1:
                        ovf = reloc_insn_movw(RELOC_OP_ABS, loc, val, 16,
-                                              INSN_IMM_16);
+                                              AARCH64_INSN_IMM_16);
                        break;
                case R_AARCH64_MOVW_UABS_G2_NC:
                        overflow_check = false;
                case R_AARCH64_MOVW_UABS_G2:
                        ovf = reloc_insn_movw(RELOC_OP_ABS, loc, val, 32,
-                                              INSN_IMM_16);
+                                              AARCH64_INSN_IMM_16);
                        break;
                case R_AARCH64_MOVW_UABS_G3:
                        /* We're using the top bits so we can't overflow. */
                        overflow_check = false;
                        ovf = reloc_insn_movw(RELOC_OP_ABS, loc, val, 48,
-                                              INSN_IMM_16);
+                                              AARCH64_INSN_IMM_16);
                        break;
                case R_AARCH64_MOVW_SABS_G0:
                        ovf = reloc_insn_movw(RELOC_OP_ABS, loc, val, 0,
-                                              INSN_IMM_MOVNZ);
+                                              AARCH64_INSN_IMM_MOVNZ);
                        break;
                case R_AARCH64_MOVW_SABS_G1:
                        ovf = reloc_insn_movw(RELOC_OP_ABS, loc, val, 16,
-                                              INSN_IMM_MOVNZ);
+                                              AARCH64_INSN_IMM_MOVNZ);
                        break;
                case R_AARCH64_MOVW_SABS_G2:
                        ovf = reloc_insn_movw(RELOC_OP_ABS, loc, val, 32,
-                                              INSN_IMM_MOVNZ);
+                                              AARCH64_INSN_IMM_MOVNZ);
                        break;
                case R_AARCH64_MOVW_PREL_G0_NC:
                        overflow_check = false;
                        ovf = reloc_insn_movw(RELOC_OP_PREL, loc, val, 0,
-                                              INSN_IMM_MOVK);
+                                              AARCH64_INSN_IMM_MOVK);
                        break;
                case R_AARCH64_MOVW_PREL_G0:
                        ovf = reloc_insn_movw(RELOC_OP_PREL, loc, val, 0,
-                                              INSN_IMM_MOVNZ);
+                                              AARCH64_INSN_IMM_MOVNZ);
                        break;
                case R_AARCH64_MOVW_PREL_G1_NC:
                        overflow_check = false;
                        ovf = reloc_insn_movw(RELOC_OP_PREL, loc, val, 16,
-                                              INSN_IMM_MOVK);
+                                              AARCH64_INSN_IMM_MOVK);
                        break;
                case R_AARCH64_MOVW_PREL_G1:
                        ovf = reloc_insn_movw(RELOC_OP_PREL, loc, val, 16,
-                                              INSN_IMM_MOVNZ);
+                                              AARCH64_INSN_IMM_MOVNZ);
                        break;
                case R_AARCH64_MOVW_PREL_G2_NC:
                        overflow_check = false;
                        ovf = reloc_insn_movw(RELOC_OP_PREL, loc, val, 32,
-                                              INSN_IMM_MOVK);
+                                              AARCH64_INSN_IMM_MOVK);
                        break;
                case R_AARCH64_MOVW_PREL_G2:
                        ovf = reloc_insn_movw(RELOC_OP_PREL, loc, val, 32,
-                                              INSN_IMM_MOVNZ);
+                                              AARCH64_INSN_IMM_MOVNZ);
                        break;
                case R_AARCH64_MOVW_PREL_G3:
                        /* We're using the top bits so we can't overflow. */
                        overflow_check = false;
                        ovf = reloc_insn_movw(RELOC_OP_PREL, loc, val, 48,
-                                              INSN_IMM_MOVNZ);
+                                              AARCH64_INSN_IMM_MOVNZ);
                        break;
                /* Immediate instruction relocations. */
                case R_AARCH64_LD_PREL_LO19:
                        ovf = reloc_insn_imm(RELOC_OP_PREL, loc, val, 2, 19,
-                                             INSN_IMM_19);
+                                             AARCH64_INSN_IMM_19);
                        break;
                case R_AARCH64_ADR_PREL_LO21:
                        ovf = reloc_insn_imm(RELOC_OP_PREL, loc, val, 0, 21,
-                                             INSN_IMM_ADR);
+                                             AARCH64_INSN_IMM_ADR);
                        break;
                case R_AARCH64_ADR_PREL_PG_HI21_NC:
                        overflow_check = false;
                case R_AARCH64_ADR_PREL_PG_HI21:
                        ovf = reloc_insn_imm(RELOC_OP_PAGE, loc, val, 12, 21,
-                                             INSN_IMM_ADR);
+                                             AARCH64_INSN_IMM_ADR);
                        break;
                case R_AARCH64_ADD_ABS_LO12_NC:
                case R_AARCH64_LDST8_ABS_LO12_NC:
                        overflow_check = false;
                        ovf = reloc_insn_imm(RELOC_OP_ABS, loc, val, 0, 12,
-                                             INSN_IMM_12);
+                                             AARCH64_INSN_IMM_12);
                        break;
                case R_AARCH64_LDST16_ABS_LO12_NC:
                        overflow_check = false;
                        ovf = reloc_insn_imm(RELOC_OP_ABS, loc, val, 1, 11,
-                                             INSN_IMM_12);
+                                             AARCH64_INSN_IMM_12);
                        break;
                case R_AARCH64_LDST32_ABS_LO12_NC:
                        overflow_check = false;
                        ovf = reloc_insn_imm(RELOC_OP_ABS, loc, val, 2, 10,
-                                             INSN_IMM_12);
+                                             AARCH64_INSN_IMM_12);
                        break;
                case R_AARCH64_LDST64_ABS_LO12_NC:
                        overflow_check = false;
                        ovf = reloc_insn_imm(RELOC_OP_ABS, loc, val, 3, 9,
-                                             INSN_IMM_12);
+                                             AARCH64_INSN_IMM_12);
                        break;
                case R_AARCH64_LDST128_ABS_LO12_NC:
                        overflow_check = false;
                        ovf = reloc_insn_imm(RELOC_OP_ABS, loc, val, 4, 8,
-                                             INSN_IMM_12);
+                                             AARCH64_INSN_IMM_12);
                        break;
                case R_AARCH64_TSTBR14:
                        ovf = reloc_insn_imm(RELOC_OP_PREL, loc, val, 2, 14,
-                                             INSN_IMM_14);
+                                             AARCH64_INSN_IMM_14);
                        break;
                case R_AARCH64_CONDBR19:
                        ovf = reloc_insn_imm(RELOC_OP_PREL, loc, val, 2, 19,
-                                             INSN_IMM_19);
+                                             AARCH64_INSN_IMM_19);
                        break;
                case R_AARCH64_JUMP26:
                case R_AARCH64_CALL26:
                        ovf = reloc_insn_imm(RELOC_OP_PREL, loc, val, 2, 26,
-                                             INSN_IMM_26);
+                                             AARCH64_INSN_IMM_26);
                        break;
                default:
diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c
index 0e63c98d224c..5b1cd792274a 100644
--- a/arch/arm64/kernel/perf_event.c
+++ b/arch/arm64/kernel/perf_event.c
@@ -22,6 +22,7 @@
 #include <linux/bitmap.h>
 #include <linux/interrupt.h>
+#include <linux/irq.h>
 #include <linux/kernel.h>
 #include <linux/export.h>
 #include <linux/perf_event.h>
@@ -363,26 +364,53 @@ validate_group(struct perf_event *event)
 }
 static void
+armpmu_disable_percpu_irq(void *data)
+{
+        unsigned int irq = *(unsigned int *)data;
+        disable_percpu_irq(irq);
+}
+static void
 armpmu_release_hardware(struct arm_pmu *armpmu)
 {
-        int i, irq, irqs;
+        int irq;
+        unsigned int i, irqs;
        struct platform_device *pmu_device = armpmu->plat_device;
        irqs = min(pmu_device->num_resources, num_possible_cpus());
+        if (!irqs)
+                return;
-        for (i = 0; i < irqs; ++i) {
+        irq = platform_get_irq(pmu_device, 0);
-                if (!cpumask_test_and_clear_cpu(i, &armpmu->active_irqs))
+        if (irq <= 0)
-                        continue;
+                return;
-                irq = platform_get_irq(pmu_device, i);
-                if (irq >= 0)
+        if (irq_is_percpu(irq)) {
-                        free_irq(irq, armpmu);
+                on_each_cpu(armpmu_disable_percpu_irq, &irq, 1);
+                free_percpu_irq(irq, &cpu_hw_events);
+        } else {
+                for (i = 0; i < irqs; ++i) {
+                        if (!cpumask_test_and_clear_cpu(i, &armpmu->active_irqs))
+                                continue;
+                        irq = platform_get_irq(pmu_device, i);
+                        if (irq > 0)
+                                free_irq(irq, armpmu);
+                }
        }
 }
+static void
+armpmu_enable_percpu_irq(void *data)
+{
+        unsigned int irq = *(unsigned int *)data;
+        enable_percpu_irq(irq, IRQ_TYPE_NONE);
+}
 static int
 armpmu_reserve_hardware(struct arm_pmu *armpmu)
 {
-        int i, err, irq, irqs;
+        int err, irq;
+        unsigned int i, irqs;
        struct platform_device *pmu_device = armpmu->plat_device;
        if (!pmu_device) {
@@ -391,39 +419,59 @@ armpmu_reserve_hardware(struct arm_pmu *armpmu)
        }
        irqs = min(pmu_device->num_resources, num_possible_cpus());
-        if (irqs < 1) {
+        if (!irqs) {
                pr_err("no irqs for PMUs defined\n");
                return -ENODEV;
        }
-        for (i = 0; i < irqs; ++i) {
+        irq = platform_get_irq(pmu_device, 0);
-                err = 0;
+        if (irq <= 0) {
-                irq = platform_get_irq(pmu_device, i);
+                pr_err("failed to get valid irq for PMU device\n");
-                if (irq < 0)
+                return -ENODEV;
-                        continue;
+        }
-                /*
+        if (irq_is_percpu(irq)) {
-                 * If we have a single PMU interrupt that we can't shift,
+                err = request_percpu_irq(irq, armpmu->handle_irq,
-                 * assume that we're running on a uniprocessor machine and
+                                "arm-pmu", &cpu_hw_events);
-                 * continue. Otherwise, continue without this interrupt.
-                 */
-                if (irq_set_affinity(irq, cpumask_of(i)) && irqs > 1) {
-                        pr_warning("unable to set irq affinity (irq=%d, cpu=%u)\n",
-                                    irq, i);
-                        continue;
-                }
-                err = request_irq(irq, armpmu->handle_irq,
-                                  IRQF_NOBALANCING,
-                                  "arm-pmu", armpmu);
                if (err) {
-                        pr_err("unable to request IRQ%d for ARM PMU counters\n",
+                        pr_err("unable to request percpu IRQ%d for ARM PMU counters\n",
-                                irq);
+                                        irq);
                        armpmu_release_hardware(armpmu);
                        return err;
                }
-                cpumask_set_cpu(i, &armpmu->active_irqs);
+                on_each_cpu(armpmu_enable_percpu_irq, &irq, 1);
+        } else {
+                for (i = 0; i < irqs; ++i) {
+                        err = 0;
+                        irq = platform_get_irq(pmu_device, i);
+                        if (irq <= 0)
+                                continue;
+                        /*
+                         * If we have a single PMU interrupt that we can't shift,
+                         * assume that we're running on a uniprocessor machine and
+                         * continue. Otherwise, continue without this interrupt.
+                         */
+                        if (irq_set_affinity(irq, cpumask_of(i)) && irqs > 1) {
+                                pr_warning("unable to set irq affinity (irq=%d, cpu=%u)\n",
+                                                irq, i);
+                                continue;
+                        }
+                        err = request_irq(irq, armpmu->handle_irq,
+                                        IRQF_NOBALANCING,
+                                        "arm-pmu", armpmu);
+                        if (err) {
+                                pr_err("unable to request IRQ%d for ARM PMU counters\n",
+                                                irq);
+                                armpmu_release_hardware(armpmu);
+                                return err;
+                        }
+                        cpumask_set_cpu(i, &armpmu->active_irqs);
+                }
        }
        return 0;
diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c
index de17c89985db..248a15db37f2 100644
--- a/arch/arm64/kernel/process.c
+++ b/arch/arm64/kernel/process.c
@@ -33,6 +33,7 @@
 #include <linux/kallsyms.h>
 #include <linux/init.h>
 #include <linux/cpu.h>
+#include <linux/cpuidle.h>
 #include <linux/elfcore.h>
 #include <linux/pm.h>
 #include <linux/tick.h>
@@ -98,8 +99,10 @@ void arch_cpu_idle(void)
         * This should do all the clock switching and wait for interrupt
         * tricks
         */
-        cpu_do_idle();
+        if (cpuidle_idle_call()) {
-        local_irq_enable();
+                cpu_do_idle();
+                local_irq_enable();
+        }
 }
 #ifdef CONFIG_HOTPLUG_CPU
@@ -308,6 +311,7 @@ struct task_struct *__switch_to(struct task_struct *prev,
 unsigned long get_wchan(struct task_struct *p)
 {
        struct stackframe frame;
+        unsigned long stack_page;
        int count = 0;
        if (!p || p == current || p->state == TASK_RUNNING)
                return 0;
@@ -315,9 +319,11 @@ unsigned long get_wchan(struct task_struct *p)
        frame.fp = thread_saved_fp(p);
        frame.sp = thread_saved_sp(p);
        frame.pc = thread_saved_pc(p);
+        stack_page = (unsigned long)task_stack_page(p);
        do {
-                int ret = unwind_frame(&frame);
+                if (frame.sp < stack_page ||
-                if (ret < 0)
+                    frame.sp >= stack_page + THREAD_SIZE ||
+                    unwind_frame(&frame))
                        return 0;
                if (!in_sched_functions(frame.pc))
                        return frame.pc;
diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c
index bd9bbd0e44ed..c8e9effe52e1 100644
--- a/arch/arm64/kernel/setup.c
+++ b/arch/arm64/kernel/setup.c
@@ -108,20 +108,95 @@ void __init early_print(const char *str, ...)
        printk("%s", buf);
 }
+void __init smp_setup_processor_id(void)
+{
+        /*
+         * clear __my_cpu_offset on boot CPU to avoid hang caused by
+         * using percpu variable early, for example, lockdep will
+         * access percpu variable inside lock_release
+         */
+        set_my_cpu_offset(0);
+}
 bool arch_match_cpu_phys_id(int cpu, u64 phys_id)
 {
        return phys_id == cpu_logical_map(cpu);
 }
+struct mpidr_hash mpidr_hash;
+#ifdef CONFIG_SMP
+/**
+ * smp_build_mpidr_hash - Pre-compute shifts required at each affinity
+ *                        level in order to build a linear index from an
+ *                        MPIDR value. Resulting algorithm is a collision
+ *                        free hash carried out through shifting and ORing
+ */
+static void __init smp_build_mpidr_hash(void)
+{
+        u32 i, affinity, fs[4], bits[4], ls;
+        u64 mask = 0;
+        /*
+         * Pre-scan the list of MPIDRS and filter out bits that do
+         * not contribute to affinity levels, ie they never toggle.
+         */
+        for_each_possible_cpu(i)
+                mask |= (cpu_logical_map(i) ^ cpu_logical_map(0));
+        pr_debug("mask of set bits %#llx\n", mask);
+        /*
+         * Find and stash the last and first bit set at all affinity levels to
+         * check how many bits are required to represent them.
+         */
+        for (i = 0; i < 4; i++) {
+                affinity = MPIDR_AFFINITY_LEVEL(mask, i);
+                /*
+                 * Find the MSB bit and LSB bits position
+                 * to determine how many bits are required
+                 * to express the affinity level.
+                 */
+                ls = fls(affinity);
+                fs[i] = affinity ? ffs(affinity) - 1 : 0;
+                bits[i] = ls - fs[i];
+        }
+        /*
+         * An index can be created from the MPIDR_EL1 by isolating the
+         * significant bits at each affinity level and by shifting
+         * them in order to compress the 32 bits values space to a
+         * compressed set of values. This is equivalent to hashing
+         * the MPIDR_EL1 through shifting and ORing. It is a collision free
+         * hash though not minimal since some levels might contain a number
+         * of CPUs that is not an exact power of 2 and their bit
+         * representation might contain holes, eg MPIDR_EL1[7:0] = {0x2, 0x80}.
+         */
+        mpidr_hash.shift_aff[0] = MPIDR_LEVEL_SHIFT(0) + fs[0];
+        mpidr_hash.shift_aff[1] = MPIDR_LEVEL_SHIFT(1) + fs[1] - bits[0];
+        mpidr_hash.shift_aff[2] = MPIDR_LEVEL_SHIFT(2) + fs[2] -
+                                                (bits[1] + bits[0]);
+        mpidr_hash.shift_aff[3] = MPIDR_LEVEL_SHIFT(3) +
+                                  fs[3] - (bits[2] + bits[1] + bits[0]);
+        mpidr_hash.mask = mask;
+        mpidr_hash.bits = bits[3] + bits[2] + bits[1] + bits[0];
+        pr_debug("MPIDR hash: aff0[%u] aff1[%u] aff2[%u] aff3[%u] mask[%#llx] bits[%u]\n",
+                mpidr_hash.shift_aff[0],
+                mpidr_hash.shift_aff[1],
+                mpidr_hash.shift_aff[2],
+                mpidr_hash.shift_aff[3],
+                mpidr_hash.mask,
+                mpidr_hash.bits);
+        /*
+         * 4x is an arbitrary value used to warn on a hash table much bigger
+         * than expected on most systems.
+         */
+        if (mpidr_hash_size() > 4 * num_possible_cpus())
+                pr_warn("Large number of MPIDR hash buckets detected\n");
+        __flush_dcache_area(&mpidr_hash, sizeof(struct mpidr_hash));
+}
+#endif
 static void __init setup_processor(void)
 {
        struct cpu_info *cpu_info;
+        u64 features, block;
-        /*
-         * locate processor in the list of supported processor
-         * types.  The linker builds this table for us from the
-         * entries in arch/arm/mm/proc.S
-         */
        cpu_info = lookup_processor_type(read_cpuid_id());
        if (!cpu_info) {
                printk("CPU configuration botched (ID %08x), unable to continue.\n",
@@ -136,6 +211,37 @@ static void __init setup_processor(void)
        sprintf(init_utsname()->machine, ELF_PLATFORM);
        elf_hwcap = 0;
+        /*
+         * ID_AA64ISAR0_EL1 contains 4-bit wide signed feature blocks.
+         * The blocks we test below represent incremental functionality
+         * for non-negative values. Negative values are reserved.
+         */
+        features = read_cpuid(ID_AA64ISAR0_EL1);
+        block = (features >> 4) & 0xf;
+        if (!(block & 0x8)) {
+                switch (block) {
+                default:
+                case 2:
+                        elf_hwcap |= HWCAP_PMULL;
+                case 1:
+                        elf_hwcap |= HWCAP_AES;
+                case 0:
+                        break;
+                }
+        }
+        block = (features >> 8) & 0xf;
+        if (block && !(block & 0x8))
+                elf_hwcap |= HWCAP_SHA1;
+        block = (features >> 12) & 0xf;
+        if (block && !(block & 0x8))
+                elf_hwcap |= HWCAP_SHA2;
+        block = (features >> 16) & 0xf;
+        if (block && !(block & 0x8))
+                elf_hwcap |= HWCAP_CRC32;
 }
 static void __init setup_machine_fdt(phys_addr_t dt_phys)
@@ -236,6 +342,7 @@ void __init setup_arch(char **cmdline_p)
        cpu_read_bootcpu_ops();
 #ifdef CONFIG_SMP
        smp_init_cpus();
+        smp_build_mpidr_hash();
 #endif
 #ifdef CONFIG_VT
@@ -275,6 +382,11 @@ static const char *hwcap_str[] = {
        "fp",
        "asimd",
        "evtstrm",
+        "aes",
+        "pmull",
+        "sha1",
+        "sha2",
+        "crc32",
        NULL
 };
diff --git a/arch/arm64/kernel/sleep.S b/arch/arm64/kernel/sleep.S
new file mode 100644
index 000000000000..b1925729c692
--- /dev/null
+++ b/arch/arm64/kernel/sleep.S
@@ -0,0 +1,184 @@
+#include <linux/errno.h>
+#include <linux/linkage.h>
+#include <asm/asm-offsets.h>
+#include <asm/assembler.h>
+        .text
+/*
+ * Implementation of MPIDR_EL1 hash algorithm through shifting
+ * and OR'ing.
+ *
+ * @dst: register containing hash result
+ * @rs0: register containing affinity level 0 bit shift
+ * @rs1: register containing affinity level 1 bit shift
+ * @rs2: register containing affinity level 2 bit shift
+ * @rs3: register containing affinity level 3 bit shift
+ * @mpidr: register containing MPIDR_EL1 value
+ * @mask: register containing MPIDR mask
+ *
+ * Pseudo C-code:
+ *
+ *u32 dst;
+ *
+ *compute_mpidr_hash(u32 rs0, u32 rs1, u32 rs2, u32 rs3, u64 mpidr, u64 mask) {
+ *      u32 aff0, aff1, aff2, aff3;
+ *      u64 mpidr_masked = mpidr & mask;
+ *      aff0 = mpidr_masked & 0xff;
+ *      aff1 = mpidr_masked & 0xff00;
+ *      aff2 = mpidr_masked & 0xff0000;
+ *      aff2 = mpidr_masked & 0xff00000000;
+ *      dst = (aff0 >> rs0 | aff1 >> rs1 | aff2 >> rs2 | aff3 >> rs3);
+ *}
+ * Input registers: rs0, rs1, rs2, rs3, mpidr, mask
+ * Output register: dst
+ * Note: input and output registers must be disjoint register sets
+         (eg: a macro instance with mpidr = x1 and dst = x1 is invalid)
+ */
+        .macro compute_mpidr_hash dst, rs0, rs1, rs2, rs3, mpidr, mask
+        and     \mpidr, \mpidr, \mask           // mask out MPIDR bits
+        and     \dst, \mpidr, #0xff             // mask=aff0
+        lsr     \dst ,\dst, \rs0                // dst=aff0>>rs0
+        and     \mask, \mpidr, #0xff00          // mask = aff1
+        lsr     \mask ,\mask, \rs1
+        orr     \dst, \dst, \mask               // dst|=(aff1>>rs1)
+        and     \mask, \mpidr, #0xff0000        // mask = aff2
+        lsr     \mask ,\mask, \rs2
+        orr     \dst, \dst, \mask               // dst|=(aff2>>rs2)
+        and     \mask, \mpidr, #0xff00000000    // mask = aff3
+        lsr     \mask ,\mask, \rs3
+        orr     \dst, \dst, \mask               // dst|=(aff3>>rs3)
+        .endm
+/*
+ * Save CPU state for a suspend.  This saves callee registers, and allocates
+ * space on the kernel stack to save the CPU specific registers + some
+ * other data for resume.
+ *
+ *  x0 = suspend finisher argument
+ */
+ENTRY(__cpu_suspend)
+        stp     x29, lr, [sp, #-96]!
+        stp     x19, x20, [sp,#16]
+        stp     x21, x22, [sp,#32]
+        stp     x23, x24, [sp,#48]
+        stp     x25, x26, [sp,#64]
+        stp     x27, x28, [sp,#80]
+        mov     x2, sp
+        sub     sp, sp, #CPU_SUSPEND_SZ // allocate cpu_suspend_ctx
+        mov     x1, sp
+        /*
+         * x1 now points to struct cpu_suspend_ctx allocated on the stack
+         */
+        str     x2, [x1, #CPU_CTX_SP]
+        ldr     x2, =sleep_save_sp
+        ldr     x2, [x2, #SLEEP_SAVE_SP_VIRT]
+#ifdef CONFIG_SMP
+        mrs     x7, mpidr_el1
+        ldr     x9, =mpidr_hash
+        ldr     x10, [x9, #MPIDR_HASH_MASK]
+        /*
+         * Following code relies on the struct mpidr_hash
+         * members size.
+         */
+        ldp     w3, w4, [x9, #MPIDR_HASH_SHIFTS]
+        ldp     w5, w6, [x9, #(MPIDR_HASH_SHIFTS + 8)]
+        compute_mpidr_hash x8, x3, x4, x5, x6, x7, x10
+        add     x2, x2, x8, lsl #3
+#endif
+        bl      __cpu_suspend_finisher
+        /*
+         * Never gets here, unless suspend fails.
+         * Successful cpu_suspend should return from cpu_resume, returning
+         * through this code path is considered an error
+         * If the return value is set to 0 force x0 = -EOPNOTSUPP
+         * to make sure a proper error condition is propagated
+         */
+        cmp     x0, #0
+        mov     x3, #-EOPNOTSUPP
+        csel    x0, x3, x0, eq
+        add     sp, sp, #CPU_SUSPEND_SZ // rewind stack pointer
+        ldp     x19, x20, [sp, #16]
+        ldp     x21, x22, [sp, #32]
+        ldp     x23, x24, [sp, #48]
+        ldp     x25, x26, [sp, #64]
+        ldp     x27, x28, [sp, #80]
+        ldp     x29, lr, [sp], #96
+        ret
+ENDPROC(__cpu_suspend)
+        .ltorg
+/*
+ * x0 must contain the sctlr value retrieved from restored context
+ */
+ENTRY(cpu_resume_mmu)
+        ldr     x3, =cpu_resume_after_mmu
+        msr     sctlr_el1, x0           // restore sctlr_el1
+        isb
+        br      x3                      // global jump to virtual address
+ENDPROC(cpu_resume_mmu)
+cpu_resume_after_mmu:
+        mov     x0, #0                  // return zero on success
+        ldp     x19, x20, [sp, #16]
+        ldp     x21, x22, [sp, #32]
+        ldp     x23, x24, [sp, #48]
+        ldp     x25, x26, [sp, #64]
+        ldp     x27, x28, [sp, #80]
+        ldp     x29, lr, [sp], #96
+        ret
+ENDPROC(cpu_resume_after_mmu)
+        .data
+ENTRY(cpu_resume)
+        bl      el2_setup               // if in EL2 drop to EL1 cleanly
+#ifdef CONFIG_SMP
+        mrs     x1, mpidr_el1
+        adr     x4, mpidr_hash_ptr
+        ldr     x5, [x4]
+        add     x8, x4, x5              // x8 = struct mpidr_hash phys address
+        /* retrieve mpidr_hash members to compute the hash */
+        ldr     x2, [x8, #MPIDR_HASH_MASK]
+        ldp     w3, w4, [x8, #MPIDR_HASH_SHIFTS]
+        ldp     w5, w6, [x8, #(MPIDR_HASH_SHIFTS + 8)]
+        compute_mpidr_hash x7, x3, x4, x5, x6, x1, x2
+        /* x7 contains hash index, let's use it to grab context pointer */
+#else
+        mov     x7, xzr
+#endif
+        adr     x0, sleep_save_sp
+        ldr     x0, [x0, #SLEEP_SAVE_SP_PHYS]
+        ldr     x0, [x0, x7, lsl #3]
+        /* load sp from context */
+        ldr     x2, [x0, #CPU_CTX_SP]
+        adr     x1, sleep_idmap_phys
+        /* load physical address of identity map page table in x1 */
+        ldr     x1, [x1]
+        mov     sp, x2
+        /*
+         * cpu_do_resume expects x0 to contain context physical address
+         * pointer and x1 to contain physical address of 1:1 page tables
+         */
+        bl      cpu_do_resume           // PC relative jump, MMU off
+        b       cpu_resume_mmu          // Resume MMU, never returns
+ENDPROC(cpu_resume)
+        .align 3
+mpidr_hash_ptr:
+        /*
+         * offset of mpidr_hash symbol from current location
+         * used to obtain run-time mpidr_hash address with MMU off
+         */
+        .quad   mpidr_hash - .
+/*
+ * physical address of identity mapped page tables
+ */
+        .type   sleep_idmap_phys, #object
+ENTRY(sleep_idmap_phys)
+        .quad   0
+/*
+ * struct sleep_save_sp {
+ *      phys_addr_t *save_ptr_stash;
+ *      phys_addr_t save_ptr_stash_phys;
+ * };
+ */
+        .type   sleep_save_sp, #object
+ENTRY(sleep_save_sp)
+        .space  SLEEP_SAVE_SP_SZ        // struct sleep_save_sp
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index a0c2ca602cf8..1b7617ab499b 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -61,6 +61,7 @@ enum ipi_msg_type {
        IPI_CALL_FUNC,
        IPI_CALL_FUNC_SINGLE,
        IPI_CPU_STOP,
+        IPI_TIMER,
 };
 /*
@@ -122,8 +123,6 @@ asmlinkage void secondary_start_kernel(void)
        struct mm_struct *mm = &init_mm;
        unsigned int cpu = smp_processor_id();
-        printk("CPU%u: Booted secondary processor\n", cpu);
        /*
         * All kernel threads share the same mm context; grab a
         * reference and switch to it.
@@ -132,6 +131,9 @@ asmlinkage void secondary_start_kernel(void)
        current->active_mm = mm;
        cpumask_set_cpu(cpu, mm_cpumask(mm));
+        set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
+        printk("CPU%u: Booted secondary processor\n", cpu);
        /*
         * TTBR0 is only used for the identity mapping at this stage. Make it
         * point to zero page to avoid speculatively fetching new entries.
@@ -271,6 +273,7 @@ void __init smp_cpus_done(unsigned int max_cpus)
 void __init smp_prepare_boot_cpu(void)
 {
+        set_my_cpu_offset(per_cpu_offset(smp_processor_id()));
 }
 static void (*smp_cross_call)(const struct cpumask *, unsigned int);
@@ -447,6 +450,7 @@ static const char *ipi_types[NR_IPI] = {
        S(IPI_CALL_FUNC, "Function call interrupts"),
        S(IPI_CALL_FUNC_SINGLE, "Single function call interrupts"),
        S(IPI_CPU_STOP, "CPU stop interrupts"),
+        S(IPI_TIMER, "Timer broadcast interrupts"),
 };
 void show_ipi_list(struct seq_file *p, int prec)
@@ -532,6 +536,14 @@ void handle_IPI(int ipinr, struct pt_regs *regs)
                irq_exit();
                break;
+#ifdef CONFIG_GENERIC_CLOCKEVENTS_BROADCAST
+        case IPI_TIMER:
+                irq_enter();
+                tick_receive_broadcast();
+                irq_exit();
+                break;
+#endif
        default:
                pr_crit("CPU%u: Unknown IPI message 0x%x\n", cpu, ipinr);
                break;
@@ -544,6 +556,13 @@ void smp_send_reschedule(int cpu)
        smp_cross_call(cpumask_of(cpu), IPI_RESCHEDULE);
 }
+#ifdef CONFIG_GENERIC_CLOCKEVENTS_BROADCAST
+void tick_broadcast(const struct cpumask *mask)
+{
+        smp_cross_call(mask, IPI_TIMER);
+}
+#endif
 void smp_send_stop(void)
 {
        unsigned long timeout;
diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
index d25459ff57fc..c3b6c63ea5fb 100644
--- a/arch/arm64/kernel/stacktrace.c
+++ b/arch/arm64/kernel/stacktrace.c
@@ -43,7 +43,7 @@ int unwind_frame(struct stackframe *frame)
        low  = frame->sp;
        high = ALIGN(low, THREAD_SIZE);
-        if (fp < low || fp > high || fp & 0xf)
+        if (fp < low || fp > high - 0x18 || fp & 0xf)
                return -EINVAL;
        frame->sp = fp + 0x10;
diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c
new file mode 100644
index 000000000000..430344e2c989
--- /dev/null
+++ b/arch/arm64/kernel/suspend.c
@@ -0,0 +1,132 @@
+#include <linux/slab.h>
+#include <asm/cacheflush.h>
+#include <asm/cpu_ops.h>
+#include <asm/debug-monitors.h>
+#include <asm/pgtable.h>
+#include <asm/memory.h>
+#include <asm/smp_plat.h>
+#include <asm/suspend.h>
+#include <asm/tlbflush.h>
+extern int __cpu_suspend(unsigned long);
+/*
+ * This is called by __cpu_suspend() to save the state, and do whatever
+ * flushing is required to ensure that when the CPU goes to sleep we have
+ * the necessary data available when the caches are not searched.
+ *
+ * @arg: Argument to pass to suspend operations
+ * @ptr: CPU context virtual address
+ * @save_ptr: address of the location where the context physical address
+ *            must be saved
+ */
+int __cpu_suspend_finisher(unsigned long arg, struct cpu_suspend_ctx *ptr,
+                           phys_addr_t *save_ptr)
+{
+        int cpu = smp_processor_id();
+        *save_ptr = virt_to_phys(ptr);
+        cpu_do_suspend(ptr);
+        /*
+         * Only flush the context that must be retrieved with the MMU
+         * off. VA primitives ensure the flush is applied to all
+         * cache levels so context is pushed to DRAM.
+         */
+        __flush_dcache_area(ptr, sizeof(*ptr));
+        __flush_dcache_area(save_ptr, sizeof(*save_ptr));
+        return cpu_ops[cpu]->cpu_suspend(arg);
+}
+/*
+ * This hook is provided so that cpu_suspend code can restore HW
+ * breakpoints as early as possible in the resume path, before reenabling
+ * debug exceptions. Code cannot be run from a CPU PM notifier since by the
+ * time the notifier runs debug exceptions might have been enabled already,
+ * with HW breakpoints registers content still in an unknown state.
+ */
+void (*hw_breakpoint_restore)(void *);
+void __init cpu_suspend_set_dbg_restorer(void (*hw_bp_restore)(void *))
+{
+        /* Prevent multiple restore hook initializations */
+        if (WARN_ON(hw_breakpoint_restore))
+                return;
+        hw_breakpoint_restore = hw_bp_restore;
+}
+/**
+ * cpu_suspend
+ *
+ * @arg: argument to pass to the finisher function
+ */
+int cpu_suspend(unsigned long arg)
+{
+        struct mm_struct *mm = current->active_mm;
+        int ret, cpu = smp_processor_id();
+        unsigned long flags;
+        /*
+         * If cpu_ops have not been registered or suspend
+         * has not been initialized, cpu_suspend call fails early.
+         */
+        if (!cpu_ops[cpu] || !cpu_ops[cpu]->cpu_suspend)
+                return -EOPNOTSUPP;
+        /*
+         * From this point debug exceptions are disabled to prevent
+         * updates to mdscr register (saved and restored along with
+         * general purpose registers) from kernel debuggers.
+         */
+        local_dbg_save(flags);
+        /*
+         * mm context saved on the stack, it will be restored when
+         * the cpu comes out of reset through the identity mapped
+         * page tables, so that the thread address space is properly
+         * set-up on function return.
+         */
+        ret = __cpu_suspend(arg);
+        if (ret == 0) {
+                cpu_switch_mm(mm->pgd, mm);
+                flush_tlb_all();
+                /*
+                 * Restore HW breakpoint registers to sane values
+                 * before debug exceptions are possibly reenabled
+                 * through local_dbg_restore.
+                 */
+                if (hw_breakpoint_restore)
+                        hw_breakpoint_restore(NULL);
+        }
+        /*
+         * Restore pstate flags. OS lock and mdscr have been already
+         * restored, so from this point onwards, debugging is fully
+         * renabled if it was enabled when core started shutdown.
+         */
+        local_dbg_restore(flags);
+        return ret;
+}
+extern struct sleep_save_sp sleep_save_sp;
+extern phys_addr_t sleep_idmap_phys;
+static int cpu_suspend_init(void)
+{
+        void *ctx_ptr;
+        /* ctx_ptr is an array of physical addresses */
+        ctx_ptr = kcalloc(mpidr_hash_size(), sizeof(phys_addr_t), GFP_KERNEL);
+        if (WARN_ON(!ctx_ptr))
+                return -ENOMEM;
+        sleep_save_sp.save_ptr_stash = ctx_ptr;
+        sleep_save_sp.save_ptr_stash_phys = virt_to_phys(ctx_ptr);
+        sleep_idmap_phys = virt_to_phys(idmap_pg_dir);
+        __flush_dcache_area(&sleep_save_sp, sizeof(struct sleep_save_sp));
+        __flush_dcache_area(&sleep_idmap_phys, sizeof(sleep_idmap_phys));
+        return 0;
+}
+early_initcall(cpu_suspend_init);
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 5161ad992091..4ba7a55b49c7 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -99,17 +99,14 @@ SECTIONS
        . = ALIGN(PAGE_SIZE);
        _data = .;
-        __data_loc = _data - LOAD_OFFSET;
        _sdata = .;
        RW_DATA_SECTION(64, PAGE_SIZE, THREAD_SIZE)
        _edata = .;
-        _edata_loc = __data_loc + SIZEOF(.data);
        BSS_SECTION(0, 0, 0)
        _end = .;
        STABS_DEBUG
-        .comment 0 : { *(.comment) }
 }
 /*
diff --git a/arch/arm64/lib/Makefile b/arch/arm64/lib/Makefile
index 59acc0ef0462..328ce1a99daa 100644
--- a/arch/arm64/lib/Makefile
+++ b/arch/arm64/lib/Makefile
@@ -1,6 +1,4 @@
-lib-y           := bitops.o delay.o                                     \
+lib-y           := bitops.o clear_user.o delay.o copy_from_user.o       \
-                   strncpy_from_user.o strnlen_user.o clear_user.o      \
+                   copy_to_user.o copy_in_user.o copy_page.o            \
-                   copy_from_user.o copy_to_user.o copy_in_user.o       \
+                   clear_page.o memchr.o memcpy.o memmove.o memset.o    \
-                   copy_page.o clear_page.o                             \
-                   memchr.o memcpy.o memmove.o memset.o                 \
                   strchr.o strrchr.o
diff --git a/arch/arm64/lib/strncpy_from_user.S b/arch/arm64/lib/strncpy_from_user.S
deleted file mode 100644
index 56e448a831a0..000000000000
--- a/arch/arm64/lib/strncpy_from_user.S
+++ /dev/null
@@ -1,50 +0,0 @@
-/*
- * Based on arch/arm/lib/strncpy_from_user.S
- *
- * Copyright (C) 1995-2000 Russell King
- * Copyright (C) 2012 ARM Ltd.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-#include <linux/linkage.h>
-#include <asm/assembler.h>
-#include <asm/errno.h>
-        .text
-        .align  5
-/*
- * Copy a string from user space to kernel space.
- *  x0 = dst, x1 = src, x2 = byte length
- * returns the number of characters copied (strlen of copied string),
- *  -EFAULT on exception, or "len" if we fill the whole buffer
- */
-ENTRY(__strncpy_from_user)
-        mov     x4, x1
-1:      subs    x2, x2, #1
-        bmi     2f
-USER(9f, ldrb   w3, [x1], #1    )
-        strb    w3, [x0], #1
-        cbnz    w3, 1b
-        sub     x1, x1, #1      // take NUL character out of count
-2:      sub     x0, x1, x4
-        ret
-ENDPROC(__strncpy_from_user)
-        .section .fixup,"ax"
-        .align  0
-9:      strb    wzr, [x0]       // null terminate
-        mov     x0, #-EFAULT
-        ret
-        .previous
diff --git a/arch/arm64/lib/strnlen_user.S b/arch/arm64/lib/strnlen_user.S
deleted file mode 100644
index 7f7b176a5646..000000000000
--- a/arch/arm64/lib/strnlen_user.S
+++ /dev/null
@@ -1,47 +0,0 @@
-/*
- * Based on arch/arm/lib/strnlen_user.S
- *
- * Copyright (C) 1995-2000 Russell King
- * Copyright (C) 2012 ARM Ltd.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program.  If not, see <http://www.gnu.org/licenses/>.
- */
-#include <linux/linkage.h>
-#include <asm/assembler.h>
-#include <asm/errno.h>
-        .text
-        .align  5
-/* Prototype: unsigned long __strnlen_user(const char *str, long n)
- * Purpose  : get length of a string in user memory
- * Params   : str - address of string in user memory
- * Returns  : length of string *including terminator*
- *            or zero on exception, or n if too long
- */
-ENTRY(__strnlen_user)
-        mov     x2, x0
-1:      subs    x1, x1, #1
-        b.mi    2f
-USER(9f, ldrb   w3, [x0], #1    )
-        cbnz    w3, 1b
-2:      sub     x0, x0, x2
-        ret
-ENDPROC(__strnlen_user)
-        .section .fixup,"ax"
-        .align  0
-9:      mov     x0, #0
-        ret
-        .previous
diff --git a/arch/arm64/mm/dma-mapping.c b/arch/arm64/mm/dma-mapping.c
index 4bd7579ec9e6..45b5ab54c9ee 100644
--- a/arch/arm64/mm/dma-mapping.c
+++ b/arch/arm64/mm/dma-mapping.c
@@ -21,6 +21,7 @@
 #include <linux/export.h>
 #include <linux/slab.h>
 #include <linux/dma-mapping.h>
+#include <linux/dma-contiguous.h>
 #include <linux/vmalloc.h>
 #include <linux/swiotlb.h>
@@ -33,17 +34,47 @@ static void *arm64_swiotlb_alloc_coherent(struct device *dev, size_t size,
                                          dma_addr_t *dma_handle, gfp_t flags,
                                          struct dma_attrs *attrs)
 {
+        if (dev == NULL) {
+                WARN_ONCE(1, "Use an actual device structure for DMA allocation\n");
+                return NULL;
+        }
        if (IS_ENABLED(CONFIG_ZONE_DMA32) &&
            dev->coherent_dma_mask <= DMA_BIT_MASK(32))
                flags |= GFP_DMA32;
-        return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
+        if (IS_ENABLED(CONFIG_DMA_CMA)) {
+                struct page *page;
+                page = dma_alloc_from_contiguous(dev, size >> PAGE_SHIFT,
+                                                        get_order(size));
+                if (!page)
+                        return NULL;
+                *dma_handle = phys_to_dma(dev, page_to_phys(page));
+                return page_address(page);
+        } else {
+                return swiotlb_alloc_coherent(dev, size, dma_handle, flags);
+        }
 }
 static void arm64_swiotlb_free_coherent(struct device *dev, size_t size,
                                        void *vaddr, dma_addr_t dma_handle,
                                        struct dma_attrs *attrs)
 {
-        swiotlb_free_coherent(dev, size, vaddr, dma_handle);
+        if (dev == NULL) {
+                WARN_ONCE(1, "Use an actual device structure for DMA allocation\n");
+                return;
+        }
+        if (IS_ENABLED(CONFIG_DMA_CMA)) {
+                phys_addr_t paddr = dma_to_phys(dev, dma_handle);
+                dma_release_from_contiguous(dev,
+                                        phys_to_page(paddr),
+                                        size >> PAGE_SHIFT);
+        } else {
+                swiotlb_free_coherent(dev, size, vaddr, dma_handle);
+        }
 }
 static struct dma_map_ops arm64_swiotlb_dma_ops = {
diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c
index 0cb8742de4f2..d0b4c2efda90 100644
--- a/arch/arm64/mm/init.c
+++ b/arch/arm64/mm/init.c
@@ -30,6 +30,7 @@
 #include <linux/memblock.h>
 #include <linux/sort.h>
 #include <linux/of_fdt.h>
+#include <linux/dma-contiguous.h>
 #include <asm/sections.h>
 #include <asm/setup.h>
@@ -159,6 +160,8 @@ void __init arm64_memblock_init(void)
                memblock_reserve(base, size);
        }
+        dma_contiguous_reserve(0);
        memblock_allow_resize();
        memblock_dump_all();
 }
diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S
index 0f7fec52c7f8..bed1f1de1caf 100644
--- a/arch/arm64/mm/proc.S
+++ b/arch/arm64/mm/proc.S
@@ -80,6 +80,75 @@ ENTRY(cpu_do_idle)
        ret
 ENDPROC(cpu_do_idle)
+#ifdef CONFIG_ARM64_CPU_SUSPEND
+/**
+ * cpu_do_suspend - save CPU registers context
+ *
+ * x0: virtual address of context pointer
+ */
+ENTRY(cpu_do_suspend)
+        mrs     x2, tpidr_el0
+        mrs     x3, tpidrro_el0
+        mrs     x4, contextidr_el1
+        mrs     x5, mair_el1
+        mrs     x6, cpacr_el1
+        mrs     x7, ttbr1_el1
+        mrs     x8, tcr_el1
+        mrs     x9, vbar_el1
+        mrs     x10, mdscr_el1
+        mrs     x11, oslsr_el1
+        mrs     x12, sctlr_el1
+        stp     x2, x3, [x0]
+        stp     x4, x5, [x0, #16]
+        stp     x6, x7, [x0, #32]
+        stp     x8, x9, [x0, #48]
+        stp     x10, x11, [x0, #64]
+        str     x12, [x0, #80]
+        ret
+ENDPROC(cpu_do_suspend)
+/**
+ * cpu_do_resume - restore CPU register context
+ *
+ * x0: Physical address of context pointer
+ * x1: ttbr0_el1 to be restored
+ *
+ * Returns:
+ *      sctlr_el1 value in x0
+ */
+ENTRY(cpu_do_resume)
+        /*
+         * Invalidate local tlb entries before turning on MMU
+         */
+        tlbi    vmalle1
+        ldp     x2, x3, [x0]
+        ldp     x4, x5, [x0, #16]
+        ldp     x6, x7, [x0, #32]
+        ldp     x8, x9, [x0, #48]
+        ldp     x10, x11, [x0, #64]
+        ldr     x12, [x0, #80]
+        msr     tpidr_el0, x2
+        msr     tpidrro_el0, x3
+        msr     contextidr_el1, x4
+        msr     mair_el1, x5
+        msr     cpacr_el1, x6
+        msr     ttbr0_el1, x1
+        msr     ttbr1_el1, x7
+        msr     tcr_el1, x8
+        msr     vbar_el1, x9
+        msr     mdscr_el1, x10
+        /*
+         * Restore oslsr_el1 by writing oslar_el1
+         */
+        ubfx    x11, x11, #1, #1
+        msr     oslar_el1, x11
+        mov     x0, x12
+        dsb     nsh             // Make sure local tlb invalidation completed
+        isb
+        ret
+ENDPROC(cpu_do_resume)
+#endif
 /*
 *      cpu_switch_mm(pgd_phys, tsk)
 *
diff --git a/arch/avr32/include/asm/barrier.h b/arch/avr32/include/asm/barrier.h
index 0961275373db..715100790fd0 100644
--- a/arch/avr32/include/asm/barrier.h
+++ b/arch/avr32/include/asm/barrier.h
@@ -8,22 +8,15 @@
 #ifndef __ASM_AVR32_BARRIER_H
 #define __ASM_AVR32_BARRIER_H
-#define nop()                   asm volatile("nop")
+/*
+ * Weirdest thing ever.. no full barrier, but it has a write barrier!
-#define mb()                    asm volatile("" : : : "memory")
+ */
-#define rmb()                   mb()
+#define wmb()   asm volatile("sync 0" : : : "memory")
-#define wmb()                   asm volatile("sync 0" : : : "memory")
-#define read_barrier_depends()  do { } while(0)
-#define set_mb(var, value)      do { var = value; mb(); } while(0)
 #ifdef CONFIG_SMP
 # error "The AVR32 port does not support SMP"
-#else
-# define smp_mb()               barrier()
-# define smp_rmb()              barrier()
-# define smp_wmb()              barrier()
-# define smp_read_barrier_depends() do { } while(0)
 #endif
+#include <asm-generic/barrier.h>
 #endif /* __ASM_AVR32_BARRIER_H */
diff --git a/arch/blackfin/include/asm/barrier.h b/arch/blackfin/include/asm/barrier.h
index ebb189507dd7..19283a16ac08 100644
--- a/arch/blackfin/include/asm/barrier.h
+++ b/arch/blackfin/include/asm/barrier.h
@@ -23,26 +23,10 @@
 # define rmb()  do { barrier(); smp_check_barrier(); } while (0)
 # define wmb()  do { barrier(); smp_mark_barrier(); } while (0)
 # define read_barrier_depends() do { barrier(); smp_check_barrier(); } while (0)
-#else
-# define mb()   barrier()
-# define rmb()  barrier()
-# define wmb()  barrier()
-# define read_barrier_depends() do { } while (0)
 #endif
-#else /* !CONFIG_SMP */
-#define mb()    barrier()
-#define rmb()   barrier()
-#define wmb()   barrier()
-#define read_barrier_depends()  do { } while (0)
 #endif /* !CONFIG_SMP */
-#define smp_mb()  mb()
+#include <asm-generic/barrier.h>
-#define smp_rmb() rmb()
-#define smp_wmb() wmb()
-#define set_mb(var, value) do { var = value; mb(); } while (0)
-#define smp_read_barrier_depends()      read_barrier_depends()
 #endif /* _BLACKFIN_BARRIER_H */
diff --git a/arch/cris/include/asm/Kbuild b/arch/cris/include/asm/Kbuild
index b06caf649a95..199b1a9dab89 100644
--- a/arch/cris/include/asm/Kbuild
+++ b/arch/cris/include/asm/Kbuild
@@ -3,6 +3,7 @@ header-y += arch-v10/
 header-y += arch-v32/
+generic-y += barrier.h
 generic-y += clkdev.h
 generic-y += exec.h
 generic-y += kvm_para.h
diff --git a/arch/cris/include/asm/barrier.h b/arch/cris/include/asm/barrier.h
deleted file mode 100644
index 198ad7fa6b25..000000000000
--- a/arch/cris/include/asm/barrier.h
+++ /dev/null
@@ -1,25 +0,0 @@
-#ifndef __ASM_CRIS_BARRIER_H
-#define __ASM_CRIS_BARRIER_H
-#define nop() __asm__ __volatile__ ("nop");
-#define barrier() __asm__ __volatile__("": : :"memory")
-#define mb() barrier()
-#define rmb() mb()
-#define wmb() mb()
-#define read_barrier_depends() do { } while(0)
-#define set_mb(var, value)  do { var = value; mb(); } while (0)
-#ifdef CONFIG_SMP
-#define smp_mb()        mb()
-#define smp_rmb()       rmb()
-#define smp_wmb()       wmb()
-#define smp_read_barrier_depends()     read_barrier_depends()
-#else
-#define smp_mb()        barrier()
-#define smp_rmb()       barrier()
-#define smp_wmb()       barrier()
-#define smp_read_barrier_depends()     do { } while(0)
-#endif
-#endif /* __ASM_CRIS_BARRIER_H */
diff --git a/arch/frv/include/asm/barrier.h b/arch/frv/include/asm/barrier.h
index 06776ad9f5e9..abbef470154c 100644
--- a/arch/frv/include/asm/barrier.h
+++ b/arch/frv/include/asm/barrier.h
@@ -17,13 +17,7 @@
 #define mb()                    asm volatile ("membar" : : :"memory")
 #define rmb()                   asm volatile ("membar" : : :"memory")
 #define wmb()                   asm volatile ("membar" : : :"memory")
-#define read_barrier_depends()  do { } while (0)
-#define smp_mb()                        barrier()
+#include <asm-generic/barrier.h>
-#define smp_rmb()                       barrier()
-#define smp_wmb()                       barrier()
-#define smp_read_barrier_depends()      do {} while(0)
-#define set_mb(var, value) \
-        do { var = (value); barrier(); } while (0)
 #endif /* _ASM_BARRIER_H */
diff --git a/arch/hexagon/include/asm/Kbuild b/arch/hexagon/include/asm/Kbuild
index 67c3450309b7..ada843c701ef 100644
--- a/arch/hexagon/include/asm/Kbuild
+++ b/arch/hexagon/include/asm/Kbuild
@@ -2,6 +2,7 @@
 header-y += ucontext.h
 generic-y += auxvec.h
+generic-y += barrier.h
 generic-y += bug.h
 generic-y += bugs.h
 generic-y += clkdev.h
diff --git a/arch/hexagon/include/asm/atomic.h b/arch/hexagon/include/asm/atomic.h
index 8a64ff2337f6..7aae4cb2a29a 100644
--- a/arch/hexagon/include/asm/atomic.h
+++ b/arch/hexagon/include/asm/atomic.h
@@ -160,8 +160,12 @@ static inline int __atomic_add_unless(atomic_t *v, int a, int u)
 #define atomic_sub_and_test(i, v) (atomic_sub_return(i, (v)) == 0)
 #define atomic_add_negative(i, v) (atomic_add_return(i, (v)) < 0)
 #define atomic_inc_return(v) (atomic_add_return(1, v))
 #define atomic_dec_return(v) (atomic_sub_return(1, v))
+#define smp_mb__before_atomic_dec()     barrier()
+#define smp_mb__after_atomic_dec()      barrier()
+#define smp_mb__before_atomic_inc()     barrier()
+#define smp_mb__after_atomic_inc()      barrier()
 #endif
diff --git a/arch/hexagon/include/asm/barrier.h b/arch/hexagon/include/asm/barrier.h
index 1041a8e70ce8..4e863daea25b 100644
--- a/arch/hexagon/include/asm/barrier.h
+++ b/arch/hexagon/include/asm/barrier.h
@@ -29,10 +29,6 @@
 #define smp_read_barrier_depends()      barrier()
 #define smp_wmb()                       barrier()
 #define smp_mb()                        barrier()
-#define smp_mb__before_atomic_dec()     barrier()
-#define smp_mb__after_atomic_dec()      barrier()
-#define smp_mb__before_atomic_inc()     barrier()
-#define smp_mb__after_atomic_inc()      barrier()
 /*  Set a value and use a memory barrier.  Used by the scheduler somewhere.  */
 #define set_mb(var, value) \
diff --git a/arch/ia64/Kconfig b/arch/ia64/Kconfig
index 4e4119b0e691..a8c3a11dc5ab 100644
--- a/arch/ia64/Kconfig
+++ b/arch/ia64/Kconfig
@@ -147,9 +147,6 @@ config PARAVIRT
          over full virtualization.  However, when run without a hypervisor
          the kernel is theoretically slower and slightly larger.
-source "arch/ia64/xen/Kconfig"
 endif
 choice
@@ -175,7 +172,6 @@ config IA64_GENERIC
          SGI-SN2               For SGI Altix systems
          SGI-UV                For SGI UV systems
          Ski-simulator         For the HP simulator <http://www.hpl.hp.com/research/linux/ski/>
-          Xen-domU              For xen domU system
          If you don't know what to do, choose "generic".
@@ -231,14 +227,6 @@ config IA64_HP_SIM
        bool "Ski-simulator"
        select SWIOTLB
-config IA64_XEN_GUEST
-        bool "Xen guest"
-        select SWIOTLB
-        depends on XEN
-        help
-          Build a kernel that runs on Xen guest domain. At this moment only
-          16KB page size in supported.
 endchoice
 choice
diff --git a/arch/ia64/Makefile b/arch/ia64/Makefile
index be7bfa12b705..f37238f45bcd 100644
--- a/arch/ia64/Makefile
+++ b/arch/ia64/Makefile
@@ -51,11 +51,9 @@ core-$(CONFIG_IA64_DIG_VTD) 	+= arch/ia64/dig/
 core-$(CONFIG_IA64_GENERIC)     += arch/ia64/dig/
 core-$(CONFIG_IA64_HP_ZX1)      += arch/ia64/dig/
 core-$(CONFIG_IA64_HP_ZX1_SWIOTLB) += arch/ia64/dig/
-core-$(CONFIG_IA64_XEN_GUEST)   += arch/ia64/dig/
 core-$(CONFIG_IA64_SGI_SN2)     += arch/ia64/sn/
 core-$(CONFIG_IA64_SGI_UV)      += arch/ia64/uv/
 core-$(CONFIG_KVM)              += arch/ia64/kvm/
-core-$(CONFIG_XEN)              += arch/ia64/xen/
 drivers-$(CONFIG_PCI)           += arch/ia64/pci/
 drivers-$(CONFIG_IA64_HP_SIM)   += arch/ia64/hp/sim/
diff --git a/arch/ia64/configs/xen_domu_defconfig b/arch/ia64/configs/xen_domu_defconfig
deleted file mode 100644
index b025acfde5c1..000000000000
--- a/arch/ia64/configs/xen_domu_defconfig
+++ /dev/null
@@ -1,199 +0,0 @@
-CONFIG_EXPERIMENTAL=y
-CONFIG_SYSVIPC=y
-CONFIG_POSIX_MQUEUE=y
-CONFIG_IKCONFIG=y
-CONFIG_IKCONFIG_PROC=y
-CONFIG_LOG_BUF_SHIFT=20
-CONFIG_SYSFS_DEPRECATED_V2=y
-CONFIG_BLK_DEV_INITRD=y
-CONFIG_KALLSYMS_ALL=y
-CONFIG_MODULES=y
-CONFIG_MODULE_UNLOAD=y
-CONFIG_MODVERSIONS=y
-CONFIG_MODULE_SRCVERSION_ALL=y
-# CONFIG_BLK_DEV_BSG is not set
-CONFIG_PARAVIRT_GUEST=y
-CONFIG_IA64_XEN_GUEST=y
-CONFIG_MCKINLEY=y
-CONFIG_IA64_CYCLONE=y
-CONFIG_SMP=y
-CONFIG_NR_CPUS=16
-CONFIG_HOTPLUG_CPU=y
-CONFIG_PERMIT_BSP_REMOVE=y
-CONFIG_FORCE_CPEI_RETARGET=y
-CONFIG_IA64_MCA_RECOVERY=y
-CONFIG_PERFMON=y
-CONFIG_IA64_PALINFO=y
-CONFIG_KEXEC=y
-CONFIG_EFI_VARS=y
-CONFIG_BINFMT_MISC=m
-CONFIG_ACPI_PROCFS=y
-CONFIG_ACPI_BUTTON=m
-CONFIG_ACPI_FAN=m
-CONFIG_ACPI_PROCESSOR=m
-CONFIG_ACPI_CONTAINER=m
-CONFIG_HOTPLUG_PCI=y
-CONFIG_HOTPLUG_PCI_ACPI=m
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_INET=y
-CONFIG_IP_MULTICAST=y
-CONFIG_ARPD=y
-CONFIG_SYN_COOKIES=y
-# CONFIG_INET_LRO is not set
-# CONFIG_IPV6 is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
-CONFIG_BLK_DEV_LOOP=m
-CONFIG_BLK_DEV_CRYPTOLOOP=m
-CONFIG_BLK_DEV_NBD=m
-CONFIG_BLK_DEV_RAM=y
-CONFIG_IDE=y
-CONFIG_BLK_DEV_IDECD=y
-CONFIG_BLK_DEV_GENERIC=y
-CONFIG_BLK_DEV_CMD64X=y
-CONFIG_BLK_DEV_PIIX=y
-CONFIG_SCSI=y
-CONFIG_BLK_DEV_SD=y
-CONFIG_CHR_DEV_ST=m
-CONFIG_BLK_DEV_SR=m
-CONFIG_CHR_DEV_SG=m
-CONFIG_SCSI_SYM53C8XX_2=y
-CONFIG_SCSI_QLOGIC_1280=y
-CONFIG_MD=y
-CONFIG_BLK_DEV_MD=m
-CONFIG_MD_LINEAR=m
-CONFIG_MD_RAID0=m
-CONFIG_MD_RAID1=m
-CONFIG_MD_MULTIPATH=m
-CONFIG_BLK_DEV_DM=m
-CONFIG_DM_CRYPT=m
-CONFIG_DM_SNAPSHOT=m
-CONFIG_DM_MIRROR=m
-CONFIG_DM_ZERO=m
-CONFIG_FUSION=y
-CONFIG_FUSION_SPI=y
-CONFIG_FUSION_FC=y
-CONFIG_FUSION_CTL=y
-CONFIG_NETDEVICES=y
-CONFIG_DUMMY=m
-CONFIG_NET_ETHERNET=y
-CONFIG_NET_TULIP=y
-CONFIG_TULIP=m
-CONFIG_NET_PCI=y
-CONFIG_NET_VENDOR_INTEL=y
-CONFIG_E100=m
-CONFIG_E1000=y
-CONFIG_TIGON3=y
-CONFIG_NETCONSOLE=y
-# CONFIG_SERIO_SERPORT is not set
-CONFIG_GAMEPORT=m
-CONFIG_SERIAL_NONSTANDARD=y
-CONFIG_SERIAL_8250=y
-CONFIG_SERIAL_8250_CONSOLE=y
-CONFIG_SERIAL_8250_NR_UARTS=6
-CONFIG_SERIAL_8250_EXTENDED=y
-CONFIG_SERIAL_8250_SHARE_IRQ=y
-# CONFIG_HW_RANDOM is not set
-CONFIG_EFI_RTC=y
-CONFIG_RAW_DRIVER=m
-CONFIG_HPET=y
-CONFIG_AGP=m
-CONFIG_DRM=m
-CONFIG_DRM_TDFX=m
-CONFIG_DRM_R128=m
-CONFIG_DRM_RADEON=m
-CONFIG_DRM_MGA=m
-CONFIG_DRM_SIS=m
-CONFIG_HID_GYRATION=y
-CONFIG_HID_NTRIG=y
-CONFIG_HID_PANTHERLORD=y
-CONFIG_HID_PETALYNX=y
-CONFIG_HID_SAMSUNG=y
-CONFIG_HID_SONY=y
-CONFIG_HID_SUNPLUS=y
-CONFIG_HID_TOPSEED=y
-CONFIG_USB=y
-CONFIG_USB_DEVICEFS=y
-CONFIG_USB_EHCI_HCD=m
-CONFIG_USB_OHCI_HCD=m
-CONFIG_USB_UHCI_HCD=y
-CONFIG_USB_STORAGE=m
-CONFIG_EXT2_FS=y
-CONFIG_EXT2_FS_XATTR=y
-CONFIG_EXT2_FS_POSIX_ACL=y
-CONFIG_EXT2_FS_SECURITY=y
-CONFIG_EXT3_FS=y
-CONFIG_EXT3_FS_POSIX_ACL=y
-CONFIG_EXT3_FS_SECURITY=y
-CONFIG_REISERFS_FS=y
-CONFIG_REISERFS_FS_XATTR=y
-CONFIG_REISERFS_FS_POSIX_ACL=y
-CONFIG_REISERFS_FS_SECURITY=y
-CONFIG_XFS_FS=y
-CONFIG_AUTOFS_FS=y
-CONFIG_AUTOFS4_FS=y
-CONFIG_ISO9660_FS=m
-CONFIG_JOLIET=y
-CONFIG_UDF_FS=m
-CONFIG_VFAT_FS=y
-CONFIG_NTFS_FS=m
-CONFIG_PROC_KCORE=y
-CONFIG_TMPFS=y
-CONFIG_HUGETLBFS=y
-CONFIG_NFS_FS=m
-CONFIG_NFS_V3=y
-CONFIG_NFS_V4=y
-CONFIG_NFSD=m
-CONFIG_NFSD_V4=y
-CONFIG_SMB_FS=m
-CONFIG_SMB_NLS_DEFAULT=y
-CONFIG_CIFS=m
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_SGI_PARTITION=y
-CONFIG_EFI_PARTITION=y
-CONFIG_NLS_CODEPAGE_437=y
-CONFIG_NLS_CODEPAGE_737=m
-CONFIG_NLS_CODEPAGE_775=m
-CONFIG_NLS_CODEPAGE_850=m
-CONFIG_NLS_CODEPAGE_852=m
-CONFIG_NLS_CODEPAGE_855=m
-CONFIG_NLS_CODEPAGE_857=m
-CONFIG_NLS_CODEPAGE_860=m
-CONFIG_NLS_CODEPAGE_861=m
-CONFIG_NLS_CODEPAGE_862=m
-CONFIG_NLS_CODEPAGE_863=m
-CONFIG_NLS_CODEPAGE_864=m
-CONFIG_NLS_CODEPAGE_865=m
-CONFIG_NLS_CODEPAGE_866=m
-CONFIG_NLS_CODEPAGE_869=m
-CONFIG_NLS_CODEPAGE_936=m
-CONFIG_NLS_CODEPAGE_950=m
-CONFIG_NLS_CODEPAGE_932=m
-CONFIG_NLS_CODEPAGE_949=m
-CONFIG_NLS_CODEPAGE_874=m
-CONFIG_NLS_ISO8859_8=m
-CONFIG_NLS_CODEPAGE_1250=m
-CONFIG_NLS_CODEPAGE_1251=m
-CONFIG_NLS_ISO8859_1=y
-CONFIG_NLS_ISO8859_2=m
-CONFIG_NLS_ISO8859_3=m
-CONFIG_NLS_ISO8859_4=m
-CONFIG_NLS_ISO8859_5=m
-CONFIG_NLS_ISO8859_6=m
-CONFIG_NLS_ISO8859_7=m
-CONFIG_NLS_ISO8859_9=m
-CONFIG_NLS_ISO8859_13=m
-CONFIG_NLS_ISO8859_14=m
-CONFIG_NLS_ISO8859_15=m
-CONFIG_NLS_KOI8_R=m
-CONFIG_NLS_KOI8_U=m
-CONFIG_NLS_UTF8=m
-CONFIG_MAGIC_SYSRQ=y
-CONFIG_DEBUG_KERNEL=y
-CONFIG_DEBUG_MUTEXES=y
-# CONFIG_RCU_CPU_STALL_DETECTOR is not set
-CONFIG_IA64_GRANULE_16MB=y
-CONFIG_CRYPTO_ECB=m
-CONFIG_CRYPTO_PCBC=m
-CONFIG_CRYPTO_MD5=y
-# CONFIG_CRYPTO_ANSI_CPRNG is not set
diff --git a/arch/ia64/include/asm/acpi.h b/arch/ia64/include/asm/acpi.h
index faa1bf0da815..d651102a4d45 100644
--- a/arch/ia64/include/asm/acpi.h
+++ b/arch/ia64/include/asm/acpi.h
@@ -111,8 +111,6 @@ static inline const char *acpi_get_sysname (void)
        return "uv";
 # elif defined (CONFIG_IA64_DIG)
        return "dig";
-# elif defined (CONFIG_IA64_XEN_GUEST)
-        return "xen";
 # elif defined(CONFIG_IA64_DIG_VTD)
        return "dig_vtd";
 # else
diff --git a/arch/ia64/include/asm/barrier.h b/arch/ia64/include/asm/barrier.h
index 60576e06b6fb..d0a69aa35e27 100644
--- a/arch/ia64/include/asm/barrier.h
+++ b/arch/ia64/include/asm/barrier.h
@@ -45,14 +45,37 @@
 # define smp_rmb()      rmb()
 # define smp_wmb()      wmb()
 # define smp_read_barrier_depends()     read_barrier_depends()
 #else
 # define smp_mb()       barrier()
 # define smp_rmb()      barrier()
 # define smp_wmb()      barrier()
 # define smp_read_barrier_depends()     do { } while(0)
 #endif
 /*
+ * IA64 GCC turns volatile stores into st.rel and volatile loads into ld.acq no
+ * need for asm trickery!
+ */
+#define smp_store_release(p, v)                                         \
+do {                                                                    \
+        compiletime_assert_atomic_type(*p);                             \
+        barrier();                                                      \
+        ACCESS_ONCE(*p) = (v);                                          \
+} while (0)
+#define smp_load_acquire(p)                                             \
+({                                                                      \
+        typeof(*p) ___p1 = ACCESS_ONCE(*p);                             \
+        compiletime_assert_atomic_type(*p);                             \
+        barrier();                                                      \
+        ___p1;                                                          \
+})
+/*
 * XXX check on this ---I suspect what Linus really wants here is
 * acquire vs release semantics but we can't discuss this stuff with
 * Linus just yet.  Grrr...
diff --git a/arch/ia64/include/asm/machvec.h b/arch/ia64/include/asm/machvec.h
index 2d1ad4b11a85..9c39bdfc2da8 100644
--- a/arch/ia64/include/asm/machvec.h
+++ b/arch/ia64/include/asm/machvec.h
@@ -113,8 +113,6 @@ extern void machvec_tlb_migrate_finish (struct mm_struct *);
 #  include <asm/machvec_sn2.h>
 # elif defined (CONFIG_IA64_SGI_UV)
 #  include <asm/machvec_uv.h>
-# elif defined (CONFIG_IA64_XEN_GUEST)
-#  include <asm/machvec_xen.h>
 # elif defined (CONFIG_IA64_GENERIC)
 # ifdef MACHVEC_PLATFORM_HEADER
diff --git a/arch/ia64/include/asm/machvec_xen.h b/arch/ia64/include/asm/machvec_xen.h
deleted file mode 100644
index 8b8bd0eb3923..000000000000
--- a/arch/ia64/include/asm/machvec_xen.h
+++ /dev/null
@@ -1,22 +0,0 @@
-#ifndef _ASM_IA64_MACHVEC_XEN_h
-#define _ASM_IA64_MACHVEC_XEN_h
-extern ia64_mv_setup_t                  dig_setup;
-extern ia64_mv_cpu_init_t               xen_cpu_init;
-extern ia64_mv_irq_init_t               xen_irq_init;
-extern ia64_mv_send_ipi_t               xen_platform_send_ipi;
-/*
- * This stuff has dual use!
- *
- * For a generic kernel, the macros are used to initialize the
- * platform's machvec structure.  When compiling a non-generic kernel,
- * the macros are used directly.
- */
-#define ia64_platform_name                      "xen"
-#define platform_setup                          dig_setup
-#define platform_cpu_init                       xen_cpu_init
-#define platform_irq_init                       xen_irq_init
-#define platform_send_ipi                       xen_platform_send_ipi
-#endif /* _ASM_IA64_MACHVEC_XEN_h */
diff --git a/arch/ia64/include/asm/meminit.h b/arch/ia64/include/asm/meminit.h
index 61c7b1750b16..092f1c91b36c 100644
--- a/arch/ia64/include/asm/meminit.h
+++ b/arch/ia64/include/asm/meminit.h
@@ -18,7 +18,6 @@
 *      - crash dumping code reserved region
 *      - Kernel memory map built from EFI memory map
 *      - ELF core header
- *      - xen start info if CONFIG_XEN
 *
 * More could be added if necessary
 */
diff --git a/arch/ia64/include/asm/paravirt.h b/arch/ia64/include/asm/paravirt.h
index b149b88ea795..b53518a98026 100644
--- a/arch/ia64/include/asm/paravirt.h
+++ b/arch/ia64/include/asm/paravirt.h
@@ -75,7 +75,6 @@ void *paravirt_get_gate_section(void);
 #ifdef CONFIG_PARAVIRT_GUEST
 #define PARAVIRT_HYPERVISOR_TYPE_DEFAULT        0
-#define PARAVIRT_HYPERVISOR_TYPE_XEN            1
 #ifndef __ASSEMBLY__
diff --git a/arch/ia64/include/asm/pvclock-abi.h b/arch/ia64/include/asm/pvclock-abi.h
index 44ef9ef8f5b3..42b233bedeb5 100644
--- a/arch/ia64/include/asm/pvclock-abi.h
+++ b/arch/ia64/include/asm/pvclock-abi.h
@@ -11,7 +11,7 @@
 /*
 * These structs MUST NOT be changed.
 * They are the ABI between hypervisor and guest OS.
- * Both Xen and KVM are using this.
+ * KVM is using this.
 *
 * pvclock_vcpu_time_info holds the system time and the tsc timestamp
 * of the last update. So the guest can use the tsc delta to get a
diff --git a/arch/ia64/include/asm/sync_bitops.h b/arch/ia64/include/asm/sync_bitops.h
deleted file mode 100644
index 593c12eeb270..000000000000
--- a/arch/ia64/include/asm/sync_bitops.h
+++ /dev/null
@@ -1,51 +0,0 @@
-#ifndef _ASM_IA64_SYNC_BITOPS_H
-#define _ASM_IA64_SYNC_BITOPS_H
-/*
- * Copyright (C) 2008 Isaku Yamahata <yamahata at valinux co jp>
- *
- * Based on synch_bitops.h which Dan Magenhaimer wrote.
- *
- * bit operations which provide guaranteed strong synchronisation
- * when communicating with Xen or other guest OSes running on other CPUs.
- */
-static inline void sync_set_bit(int nr, volatile void *addr)
-{
-        set_bit(nr, addr);
-}
-static inline void sync_clear_bit(int nr, volatile void *addr)
-{
-        clear_bit(nr, addr);
-}
-static inline void sync_change_bit(int nr, volatile void *addr)
-{
-        change_bit(nr, addr);
-}
-static inline int sync_test_and_set_bit(int nr, volatile void *addr)
-{
-        return test_and_set_bit(nr, addr);
-}
-static inline int sync_test_and_clear_bit(int nr, volatile void *addr)
-{
-        return test_and_clear_bit(nr, addr);
-}
-static inline int sync_test_and_change_bit(int nr, volatile void *addr)
-{
-        return test_and_change_bit(nr, addr);
-}
-static inline int sync_test_bit(int nr, const volatile void *addr)
-{
-        return test_bit(nr, addr);
-}
-#define sync_cmpxchg(ptr, old, new)                             \
-        ((__typeof__(*(ptr)))cmpxchg_acq((ptr), (old), (new)))
-#endif /* _ASM_IA64_SYNC_BITOPS_H */
diff --git a/arch/ia64/include/asm/xen/events.h b/arch/ia64/include/asm/xen/events.h
deleted file mode 100644
index baa74c82aa71..000000000000
--- a/arch/ia64/include/asm/xen/events.h
+++ /dev/null
@@ -1,41 +0,0 @@
-/******************************************************************************
- * arch/ia64/include/asm/xen/events.h
- *
- * Copyright (c) 2008 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-#ifndef _ASM_IA64_XEN_EVENTS_H
-#define _ASM_IA64_XEN_EVENTS_H
-enum ipi_vector {
-        XEN_RESCHEDULE_VECTOR,
-        XEN_IPI_VECTOR,
-        XEN_CMCP_VECTOR,
-        XEN_CPEP_VECTOR,
-        XEN_NR_IPIS,
-};
-static inline int xen_irqs_disabled(struct pt_regs *regs)
-{
-        return !(ia64_psr(regs)->i);
-}
-#define irq_ctx_init(cpu)       do { } while (0)
-#endif /* _ASM_IA64_XEN_EVENTS_H */
diff --git a/arch/ia64/include/asm/xen/hypercall.h b/arch/ia64/include/asm/xen/hypercall.h
deleted file mode 100644
index ed28bcd5bb85..000000000000
--- a/arch/ia64/include/asm/xen/hypercall.h
+++ /dev/null
@@ -1,265 +0,0 @@
-/******************************************************************************
- * hypercall.h
- *
- * Linux-specific hypervisor handling.
- *
- * Copyright (c) 2002-2004, K A Fraser
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
- * as published by the Free Software Foundation; or, when distributed
- * separately from the Linux kernel or incorporated into other
- * software packages, subject to the following license:
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this source file (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use, copy, modify,
- * merge, publish, distribute, sublicense, and/or sell copies of the Software,
- * and to permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
- * IN THE SOFTWARE.
- */
-#ifndef _ASM_IA64_XEN_HYPERCALL_H
-#define _ASM_IA64_XEN_HYPERCALL_H
-#include <xen/interface/xen.h>
-#include <xen/interface/physdev.h>
-#include <xen/interface/sched.h>
-#include <asm/xen/xcom_hcall.h>
-struct xencomm_handle;
-extern unsigned long __hypercall(unsigned long a1, unsigned long a2,
-                                 unsigned long a3, unsigned long a4,
-                                 unsigned long a5, unsigned long cmd);
-/*
- * Assembler stubs for hyper-calls.
- */
-#define _hypercall0(type, name)                                 \
-({                                                              \
-        long __res;                                             \
-        __res = __hypercall(0, 0, 0, 0, 0, __HYPERVISOR_##name);\
-        (type)__res;                                            \
-})
-#define _hypercall1(type, name, a1)                             \
-({                                                              \
-        long __res;                                             \
-        __res = __hypercall((unsigned long)a1,                  \
-                             0, 0, 0, 0, __HYPERVISOR_##name);  \
-        (type)__res;                                            \
-})
-#define _hypercall2(type, name, a1, a2)                         \
-({                                                              \
-        long __res;                                             \
-        __res = __hypercall((unsigned long)a1,                  \
-                            (unsigned long)a2,                  \
-                            0, 0, 0, __HYPERVISOR_##name);      \
-        (type)__res;                                            \
-})
-#define _hypercall3(type, name, a1, a2, a3)                     \
-({                                                              \
-        long __res;                                             \
-        __res = __hypercall((unsigned long)a1,                  \
-                            (unsigned long)a2,                  \
-                            (unsigned long)a3,                  \
-                            0, 0, __HYPERVISOR_##name);         \
-        (type)__res;                                            \
-})
-#define _hypercall4(type, name, a1, a2, a3, a4)                 \
-({                                                              \
-        long __res;                                             \
-        __res = __hypercall((unsigned long)a1,                  \
-                            (unsigned long)a2,                  \
-                            (unsigned long)a3,                  \
-                            (unsigned long)a4,                  \
-                            0, __HYPERVISOR_##name);            \
-        (type)__res;                                            \
-})
-#define _hypercall5(type, name, a1, a2, a3, a4, a5)             \
-({                                                              \
-        long __res;                                             \
-        __res = __hypercall((unsigned long)a1,                  \
-                            (unsigned long)a2,                  \
-                            (unsigned long)a3,                  \
-                            (unsigned long)a4,                  \
-                            (unsigned long)a5,                  \
-                            __HYPERVISOR_##name);               \
-        (type)__res;                                            \
-})
-static inline int
-xencomm_arch_hypercall_sched_op(int cmd, struct xencomm_handle *arg)
-{
-        return _hypercall2(int, sched_op, cmd, arg);
-}
-static inline long
-HYPERVISOR_set_timer_op(u64 timeout)
-{
-        unsigned long timeout_hi = (unsigned long)(timeout >> 32);
-        unsigned long timeout_lo = (unsigned long)timeout;
-        return _hypercall2(long, set_timer_op, timeout_lo, timeout_hi);
-}
-static inline int
-xencomm_arch_hypercall_multicall(struct xencomm_handle *call_list,
-                                 int nr_calls)
-{
-        return _hypercall2(int, multicall, call_list, nr_calls);
-}
-static inline int
-xencomm_arch_hypercall_memory_op(unsigned int cmd, struct xencomm_handle *arg)
-{
-        return _hypercall2(int, memory_op, cmd, arg);
-}
-static inline int
-xencomm_arch_hypercall_event_channel_op(int cmd, struct xencomm_handle *arg)
-{
-        return _hypercall2(int, event_channel_op, cmd, arg);
-}
-static inline int
-xencomm_arch_hypercall_xen_version(int cmd, struct xencomm_handle *arg)
-{
-        return _hypercall2(int, xen_version, cmd, arg);
-}
-static inline int
-xencomm_arch_hypercall_console_io(int cmd, int count,
-                                  struct xencomm_handle *str)
-{
-        return _hypercall3(int, console_io, cmd, count, str);
-}
-static inline int
-xencomm_arch_hypercall_physdev_op(int cmd, struct xencomm_handle *arg)
-{
-        return _hypercall2(int, physdev_op, cmd, arg);
-}
-static inline int
-xencomm_arch_hypercall_grant_table_op(unsigned int cmd,
-                                      struct xencomm_handle *uop,
-                                      unsigned int count)
-{
-        return _hypercall3(int, grant_table_op, cmd, uop, count);
-}
-int HYPERVISOR_grant_table_op(unsigned int cmd, void *uop, unsigned int count);
-extern int xencomm_arch_hypercall_suspend(struct xencomm_handle *arg);
-static inline int
-xencomm_arch_hypercall_callback_op(int cmd, struct xencomm_handle *arg)
-{
-        return _hypercall2(int, callback_op, cmd, arg);
-}
-static inline long
-xencomm_arch_hypercall_vcpu_op(int cmd, int cpu, void *arg)
-{
-        return _hypercall3(long, vcpu_op, cmd, cpu, arg);
-}
-static inline int
-HYPERVISOR_physdev_op(int cmd, void *arg)
-{
-        switch (cmd) {
-        case PHYSDEVOP_eoi:
-                return _hypercall1(int, ia64_fast_eoi,
-                                   ((struct physdev_eoi *)arg)->irq);
-        default:
-                return xencomm_hypercall_physdev_op(cmd, arg);
-        }
-}
-static inline long
-xencomm_arch_hypercall_opt_feature(struct xencomm_handle *arg)
-{
-        return _hypercall1(long, opt_feature, arg);
-}
-/* for balloon driver */
-#define HYPERVISOR_update_va_mapping(va, new_val, flags) (0)
-/* Use xencomm to do hypercalls.  */
-#define HYPERVISOR_sched_op xencomm_hypercall_sched_op
-#define HYPERVISOR_event_channel_op xencomm_hypercall_event_channel_op
-#define HYPERVISOR_callback_op xencomm_hypercall_callback_op
-#define HYPERVISOR_multicall xencomm_hypercall_multicall
-#define HYPERVISOR_xen_version xencomm_hypercall_xen_version
-#define HYPERVISOR_console_io xencomm_hypercall_console_io
-#define HYPERVISOR_memory_op xencomm_hypercall_memory_op
-#define HYPERVISOR_suspend xencomm_hypercall_suspend
-#define HYPERVISOR_vcpu_op xencomm_hypercall_vcpu_op
-#define HYPERVISOR_opt_feature xencomm_hypercall_opt_feature
-/* to compile gnttab_copy_grant_page() in drivers/xen/core/gnttab.c */
-#define HYPERVISOR_mmu_update(req, count, success_count, domid) ({ BUG(); 0; })
-static inline int
-HYPERVISOR_shutdown(
-        unsigned int reason)
-{
-        struct sched_shutdown sched_shutdown = {
-                .reason = reason
-        };
-        int rc = HYPERVISOR_sched_op(SCHEDOP_shutdown, &sched_shutdown);
-        return rc;
-}
-/* for netfront.c, netback.c */
-#define MULTI_UVMFLAGS_INDEX 0 /* XXX any value */
-static inline void
-MULTI_update_va_mapping(
-        struct multicall_entry *mcl, unsigned long va,
-        pte_t new_val, unsigned long flags)
-{
-        mcl->op = __HYPERVISOR_update_va_mapping;
-        mcl->result = 0;
-}
-static inline void
-MULTI_grant_table_op(struct multicall_entry *mcl, unsigned int cmd,
-        void *uop, unsigned int count)
-{
-        mcl->op = __HYPERVISOR_grant_table_op;
-        mcl->args[0] = cmd;
-        mcl->args[1] = (unsigned long)uop;
-        mcl->args[2] = count;
-}
-static inline void
-MULTI_mmu_update(struct multicall_entry *mcl, struct mmu_update *req,
-                 int count, int *success_count, domid_t domid)
-{
-        mcl->op = __HYPERVISOR_mmu_update;
-        mcl->args[0] = (unsigned long)req;
-        mcl->args[1] = count;
-        mcl->args[2] = (unsigned long)success_count;
-        mcl->args[3] = domid;
-}
-#endif /* _ASM_IA64_XEN_HYPERCALL_H */
diff --git a/arch/ia64/include/asm/xen/hypervisor.h b/arch/ia64/include/asm/xen/hypervisor.h
deleted file mode 100644
index 67455c2ed2b1..000000000000
--- a/arch/ia64/include/asm/xen/hypervisor.h
+++ /dev/null
@@ -1,61 +0,0 @@
-/******************************************************************************
- * hypervisor.h
- *
- * Linux-specific hypervisor handling.
- *
- * Copyright (c) 2002-2004, K A Fraser
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License version 2
- * as published by the Free Software Foundation; or, when distributed
- * separately from the Linux kernel or incorporated into other
- * software packages, subject to the following license:
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this source file (the "Software"), to deal in the Software without
- * restriction, including without limitation the rights to use, copy, modify,
- * merge, publish, distribute, sublicense, and/or sell copies of the Software,
- * and to permit persons to whom the Software is furnished to do so, subject to
- * the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
- * IN THE SOFTWARE.
- */
-#ifndef _ASM_IA64_XEN_HYPERVISOR_H
-#define _ASM_IA64_XEN_HYPERVISOR_H
-#include <linux/err.h>
-#include <xen/interface/xen.h>
-#include <xen/interface/version.h>      /* to compile feature.c */
-#include <xen/features.h>               /* to comiple xen-netfront.c */
-#include <xen/xen.h>
-#include <asm/xen/hypercall.h>
-#ifdef CONFIG_XEN
-extern struct shared_info *HYPERVISOR_shared_info;
-extern struct start_info *xen_start_info;
-void __init xen_setup_vcpu_info_placement(void);
-void force_evtchn_callback(void);
-/* for drivers/xen/balloon/balloon.c */
-#ifdef CONFIG_XEN_SCRUB_PAGES
-#define scrub_pages(_p, _n) memset((void *)(_p), 0, (_n) << PAGE_SHIFT)
-#else
-#define scrub_pages(_p, _n) ((void)0)
-#endif
-/* For setup_arch() in arch/ia64/kernel/setup.c */
-void xen_ia64_enable_opt_feature(void);
-#endif
-#endif /* _ASM_IA64_XEN_HYPERVISOR_H */
diff --git a/arch/ia64/include/asm/xen/inst.h b/arch/ia64/include/asm/xen/inst.h
deleted file mode 100644
index c53a47611208..000000000000
--- a/arch/ia64/include/asm/xen/inst.h
+++ /dev/null
@@ -1,486 +0,0 @@
-/******************************************************************************
- * arch/ia64/include/asm/xen/inst.h
- *
- * Copyright (c) 2008 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-#include <asm/xen/privop.h>
-#define ia64_ivt                                xen_ivt
-#define DO_SAVE_MIN                             XEN_DO_SAVE_MIN
-#define __paravirt_switch_to                    xen_switch_to
-#define __paravirt_leave_syscall                xen_leave_syscall
-#define __paravirt_work_processed_syscall       xen_work_processed_syscall
-#define __paravirt_leave_kernel                 xen_leave_kernel
-#define __paravirt_pending_syscall_end          xen_work_pending_syscall_end
-#define __paravirt_work_processed_syscall_target \
-                                                xen_work_processed_syscall
-#define paravirt_fsyscall_table                 xen_fsyscall_table
-#define paravirt_fsys_bubble_down               xen_fsys_bubble_down
-#define MOV_FROM_IFA(reg)       \
-        movl reg = XSI_IFA;     \
-        ;;                      \
-        ld8 reg = [reg]
-#define MOV_FROM_ITIR(reg)      \
-        movl reg = XSI_ITIR;    \
-        ;;                      \
-        ld8 reg = [reg]
-#define MOV_FROM_ISR(reg)       \
-        movl reg = XSI_ISR;     \
-        ;;                      \
-        ld8 reg = [reg]
-#define MOV_FROM_IHA(reg)       \
-        movl reg = XSI_IHA;     \
-        ;;                      \
-        ld8 reg = [reg]
-#define MOV_FROM_IPSR(pred, reg)        \
-(pred)  movl reg = XSI_IPSR;            \
-        ;;                              \
-(pred)  ld8 reg = [reg]
-#define MOV_FROM_IIM(reg)       \
-        movl reg = XSI_IIM;     \
-        ;;                      \
-        ld8 reg = [reg]
-#define MOV_FROM_IIP(reg)       \
-        movl reg = XSI_IIP;     \
-        ;;                      \
-        ld8 reg = [reg]
-.macro __MOV_FROM_IVR reg, clob
-        .ifc "\reg", "r8"
-                XEN_HYPER_GET_IVR
-                .exitm
-        .endif
-        .ifc "\clob", "r8"
-                XEN_HYPER_GET_IVR
-                ;;
-                mov \reg = r8
-                .exitm
-        .endif
-        mov \clob = r8
-        ;;
-        XEN_HYPER_GET_IVR
-        ;;
-        mov \reg = r8
-        ;;
-        mov r8 = \clob
-.endm
-#define MOV_FROM_IVR(reg, clob) __MOV_FROM_IVR reg, clob
-.macro __MOV_FROM_PSR pred, reg, clob
-        .ifc "\reg", "r8"
-                (\pred) XEN_HYPER_GET_PSR;
-                .exitm
-        .endif
-        .ifc "\clob", "r8"
-                (\pred) XEN_HYPER_GET_PSR
-                ;;
-                (\pred) mov \reg = r8
-                .exitm
-        .endif
-        (\pred) mov \clob = r8
-        (\pred) XEN_HYPER_GET_PSR
-        ;;
-        (\pred) mov \reg = r8
-        (\pred) mov r8 = \clob
-.endm
-#define MOV_FROM_PSR(pred, reg, clob)   __MOV_FROM_PSR pred, reg, clob
-/* assuming ar.itc is read with interrupt disabled. */
-#define MOV_FROM_ITC(pred, pred_clob, reg, clob)                \
-(pred)  movl clob = XSI_ITC_OFFSET;                             \
-        ;;                                                      \
-(pred)  ld8 clob = [clob];                                      \
-(pred)  mov reg = ar.itc;                                       \
-        ;;                                                      \
-(pred)  add reg = reg, clob;                                    \
-        ;;                                                      \
-(pred)  movl clob = XSI_ITC_LAST;                               \
-        ;;                                                      \
-(pred)  ld8 clob = [clob];                                      \
-        ;;                                                      \
-(pred)  cmp.geu.unc pred_clob, p0 = clob, reg;                  \
-        ;;                                                      \
-(pred_clob)     add reg = 1, clob;                              \
-        ;;                                                      \
-(pred)  movl clob = XSI_ITC_LAST;                               \
-        ;;                                                      \
-(pred)  st8 [clob] = reg
-#define MOV_TO_IFA(reg, clob)   \
-        movl clob = XSI_IFA;    \
-        ;;                      \
-        st8 [clob] = reg        \
-#define MOV_TO_ITIR(pred, reg, clob)    \
-(pred)  movl clob = XSI_ITIR;           \
-        ;;                              \
-(pred)  st8 [clob] = reg
-#define MOV_TO_IHA(pred, reg, clob)     \
-(pred)  movl clob = XSI_IHA;            \
-        ;;                              \
-(pred)  st8 [clob] = reg
-#define MOV_TO_IPSR(pred, reg, clob)    \
-(pred)  movl clob = XSI_IPSR;           \
-        ;;                              \
-(pred)  st8 [clob] = reg;               \
-        ;;
-#define MOV_TO_IFS(pred, reg, clob)     \
-(pred)  movl clob = XSI_IFS;            \
-        ;;                              \
-(pred)  st8 [clob] = reg;               \
-        ;;
-#define MOV_TO_IIP(reg, clob)   \
-        movl clob = XSI_IIP;    \
-        ;;                      \
-        st8 [clob] = reg
-.macro ____MOV_TO_KR kr, reg, clob0, clob1
-        .ifc "\clob0", "r9"
-                .error "clob0 \clob0 must not be r9"
-        .endif
-        .ifc "\clob1", "r8"
-                .error "clob1 \clob1 must not be r8"
-        .endif
-        .ifnc "\reg", "r9"
-                .ifnc "\clob1", "r9"
-                        mov \clob1 = r9
-                .endif
-                mov r9 = \reg
-        .endif
-        .ifnc "\clob0", "r8"
-                mov \clob0 = r8
-        .endif
-        mov r8 = \kr
-        ;;
-        XEN_HYPER_SET_KR
-        .ifnc "\reg", "r9"
-                .ifnc "\clob1", "r9"
-                        mov r9 = \clob1
-                .endif
-        .endif
-        .ifnc "\clob0", "r8"
-                mov r8 = \clob0
-        .endif
-.endm
-.macro __MOV_TO_KR kr, reg, clob0, clob1
-        .ifc "\clob0", "r9"
-                ____MOV_TO_KR \kr, \reg, \clob1, \clob0
-                .exitm
-        .endif
-        .ifc "\clob1", "r8"
-                ____MOV_TO_KR \kr, \reg, \clob1, \clob0
-                .exitm
-        .endif
-        ____MOV_TO_KR \kr, \reg, \clob0, \clob1
-.endm
-#define MOV_TO_KR(kr, reg, clob0, clob1) \
-        __MOV_TO_KR IA64_KR_ ## kr, reg, clob0, clob1
-.macro __ITC_I pred, reg, clob
-        .ifc "\reg", "r8"
-                (\pred) XEN_HYPER_ITC_I
-                .exitm
-        .endif
-        .ifc "\clob", "r8"
-                (\pred) mov r8 = \reg
-                ;;
-                (\pred) XEN_HYPER_ITC_I
-                .exitm
-        .endif
-        (\pred) mov \clob = r8
-        (\pred) mov r8 = \reg
-        ;;
-        (\pred) XEN_HYPER_ITC_I
-        ;;
-        (\pred) mov r8 = \clob
-        ;;
-.endm
-#define ITC_I(pred, reg, clob)  __ITC_I pred, reg, clob
-.macro __ITC_D pred, reg, clob
-        .ifc "\reg", "r8"
-                (\pred) XEN_HYPER_ITC_D
-                ;;
-                .exitm
-        .endif
-        .ifc "\clob", "r8"
-                (\pred) mov r8 = \reg
-                ;;
-                (\pred) XEN_HYPER_ITC_D
-                ;;
-                .exitm
-        .endif
-        (\pred) mov \clob = r8
-        (\pred) mov r8 = \reg
-        ;;
-        (\pred) XEN_HYPER_ITC_D
-        ;;
-        (\pred) mov r8 = \clob
-        ;;
-.endm
-#define ITC_D(pred, reg, clob)  __ITC_D pred, reg, clob
-.macro __ITC_I_AND_D pred_i, pred_d, reg, clob
-        .ifc "\reg", "r8"
-                (\pred_i)XEN_HYPER_ITC_I
-                ;;
-                (\pred_d)XEN_HYPER_ITC_D
-                ;;
-                .exitm
-        .endif
-        .ifc "\clob", "r8"
-                mov r8 = \reg
-                ;;
-                (\pred_i)XEN_HYPER_ITC_I
-                ;;
-                (\pred_d)XEN_HYPER_ITC_D
-                ;;
-                .exitm
-        .endif
-        mov \clob = r8
-        mov r8 = \reg
-        ;;
-        (\pred_i)XEN_HYPER_ITC_I
-        ;;
-        (\pred_d)XEN_HYPER_ITC_D
-        ;;
-        mov r8 = \clob
-        ;;
-.endm
-#define ITC_I_AND_D(pred_i, pred_d, reg, clob) \
-        __ITC_I_AND_D pred_i, pred_d, reg, clob
-.macro __THASH pred, reg0, reg1, clob
-        .ifc "\reg0", "r8"
-                (\pred) mov r8 = \reg1
-                (\pred) XEN_HYPER_THASH
-                .exitm
-        .endc
-        .ifc "\reg1", "r8"
-                (\pred) XEN_HYPER_THASH
-                ;;
-                (\pred) mov \reg0 = r8
-                ;;
-                .exitm
-        .endif
-        .ifc "\clob", "r8"
-                (\pred) mov r8 = \reg1
-                (\pred) XEN_HYPER_THASH
-                ;;
-                (\pred) mov \reg0 = r8
-                ;;
-                .exitm
-        .endif
-        (\pred) mov \clob = r8
-        (\pred) mov r8 = \reg1
-        (\pred) XEN_HYPER_THASH
-        ;;
-        (\pred) mov \reg0 = r8
-        (\pred) mov r8 = \clob
-        ;;
-.endm
-#define THASH(pred, reg0, reg1, clob) __THASH pred, reg0, reg1, clob
-#define SSM_PSR_IC_AND_DEFAULT_BITS_AND_SRLZ_I(clob0, clob1)    \
-        mov clob0 = 1;                                          \
-        movl clob1 = XSI_PSR_IC;                                \
-        ;;                                                      \
-        st4 [clob1] = clob0                                     \
-        ;;
-#define SSM_PSR_IC_AND_SRLZ_D(clob0, clob1)     \
-        ;;                                      \
-        srlz.d;                                 \
-        mov clob1 = 1;                          \
-        movl clob0 = XSI_PSR_IC;                \
-        ;;                                      \
-        st4 [clob0] = clob1
-#define RSM_PSR_IC(clob)        \
-        movl clob = XSI_PSR_IC; \
-        ;;                      \
-        st4 [clob] = r0;        \
-        ;;
-/* pred will be clobbered */
-#define MASK_TO_PEND_OFS    (-1)
-#define SSM_PSR_I(pred, pred_clob, clob)                                \
-(pred)  movl clob = XSI_PSR_I_ADDR                                      \
-        ;;                                                              \
-(pred)  ld8 clob = [clob]                                               \
-        ;;                                                              \
-        /* if (pred) vpsr.i = 1 */                                      \
-        /* if (pred) (vcpu->vcpu_info->evtchn_upcall_mask)=0 */         \
-(pred)  st1 [clob] = r0, MASK_TO_PEND_OFS                               \
-        ;;                                                              \
-        /* if (vcpu->vcpu_info->evtchn_upcall_pending) */               \
-(pred)  ld1 clob = [clob]                                               \
-        ;;                                                              \
-(pred)  cmp.ne.unc pred_clob, p0 = clob, r0                             \
-        ;;                                                              \
-(pred_clob)XEN_HYPER_SSM_I      /* do areal ssm psr.i */
-#define RSM_PSR_I(pred, clob0, clob1)   \
-        movl clob0 = XSI_PSR_I_ADDR;    \
-        mov clob1 = 1;                  \
-        ;;                              \
-        ld8 clob0 = [clob0];            \
-        ;;                              \
-(pred)  st1 [clob0] = clob1
-#define RSM_PSR_I_IC(clob0, clob1, clob2)               \
-        movl clob0 = XSI_PSR_I_ADDR;                    \
-        movl clob1 = XSI_PSR_IC;                        \
-        ;;                                              \
-        ld8 clob0 = [clob0];                            \
-        mov clob2 = 1;                                  \
-        ;;                                              \
-        /* note: clears both vpsr.i and vpsr.ic! */     \
-        st1 [clob0] = clob2;                            \
-        st4 [clob1] = r0;                               \
-        ;;
-#define RSM_PSR_DT              \
-        XEN_HYPER_RSM_PSR_DT
-#define RSM_PSR_BE_I(clob0, clob1)      \
-        RSM_PSR_I(p0, clob0, clob1);    \
-        rum psr.be
-#define SSM_PSR_DT_AND_SRLZ_I   \
-        XEN_HYPER_SSM_PSR_DT
-#define BSW_0(clob0, clob1, clob2)                      \
-        ;;                                              \
-        /* r16-r31 all now hold bank1 values */         \
-        mov clob2 = ar.unat;                            \
-        movl clob0 = XSI_BANK1_R16;                     \
-        movl clob1 = XSI_BANK1_R16 + 8;                 \
-        ;;                                              \
-.mem.offset 0, 0; st8.spill [clob0] = r16, 16;          \
-.mem.offset 8, 0; st8.spill [clob1] = r17, 16;          \
-        ;;                                              \
-.mem.offset 0, 0; st8.spill [clob0] = r18, 16;          \
-.mem.offset 8, 0; st8.spill [clob1] = r19, 16;          \
-        ;;                                              \
-.mem.offset 0, 0; st8.spill [clob0] = r20, 16;          \
-.mem.offset 8, 0; st8.spill [clob1] = r21, 16;          \
-        ;;                                              \
-.mem.offset 0, 0; st8.spill [clob0] = r22, 16;          \
-.mem.offset 8, 0; st8.spill [clob1] = r23, 16;          \
-        ;;                                              \
-.mem.offset 0, 0; st8.spill [clob0] = r24, 16;          \
-.mem.offset 8, 0; st8.spill [clob1] = r25, 16;          \
-        ;;                                              \
-.mem.offset 0, 0; st8.spill [clob0] = r26, 16;          \
-.mem.offset 8, 0; st8.spill [clob1] = r27, 16;          \
-        ;;                                              \
-.mem.offset 0, 0; st8.spill [clob0] = r28, 16;          \
-.mem.offset 8, 0; st8.spill [clob1] = r29, 16;          \
-        ;;                                              \
-.mem.offset 0, 0; st8.spill [clob0] = r30, 16;          \
-.mem.offset 8, 0; st8.spill [clob1] = r31, 16;          \
-        ;;                                              \
-        mov clob1 = ar.unat;                            \
-        movl clob0 = XSI_B1NAT;                         \
-        ;;                                              \
-        st8 [clob0] = clob1;                            \
-        mov ar.unat = clob2;                            \
-        movl clob0 = XSI_BANKNUM;                       \
-        ;;                                              \
-        st4 [clob0] = r0
-        /* FIXME: THIS CODE IS NOT NaT SAFE! */
-#define XEN_BSW_1(clob)                 \
-        mov clob = ar.unat;             \
-        movl r30 = XSI_B1NAT;           \
-        ;;                              \
-        ld8 r30 = [r30];                \
-        mov r31 = 1;                    \
-        ;;                              \
-        mov ar.unat = r30;              \
-        movl r30 = XSI_BANKNUM;         \
-        ;;                              \
-        st4 [r30] = r31;                \
-        movl r30 = XSI_BANK1_R16;       \
-        movl r31 = XSI_BANK1_R16+8;     \
-        ;;                              \
-        ld8.fill r16 = [r30], 16;       \
-        ld8.fill r17 = [r31], 16;       \
-        ;;                              \
-        ld8.fill r18 = [r30], 16;       \
-        ld8.fill r19 = [r31], 16;       \
-        ;;                              \
-        ld8.fill r20 = [r30], 16;       \
-        ld8.fill r21 = [r31], 16;       \
-        ;;                              \
-        ld8.fill r22 = [r30], 16;       \
-        ld8.fill r23 = [r31], 16;       \
-        ;;                              \
-        ld8.fill r24 = [r30], 16;       \
-        ld8.fill r25 = [r31], 16;       \
-        ;;                              \
-        ld8.fill r26 = [r30], 16;       \
-        ld8.fill r27 = [r31], 16;       \
-        ;;                              \
-        ld8.fill r28 = [r30], 16;       \
-        ld8.fill r29 = [r31], 16;       \
-        ;;                              \
-        ld8.fill r30 = [r30];           \
-        ld8.fill r31 = [r31];           \
-        ;;                              \
-        mov ar.unat = clob
-#define BSW_1(clob0, clob1)     XEN_BSW_1(clob1)
-#define COVER   \
-        XEN_HYPER_COVER
-#define RFI                     \
-        XEN_HYPER_RFI;          \
-        dv_serialize_data
diff --git a/arch/ia64/include/asm/xen/interface.h b/arch/ia64/include/asm/xen/interface.h
deleted file mode 100644
index e88c5de27410..000000000000
--- a/arch/ia64/include/asm/xen/interface.h
+++ /dev/null
@@ -1,363 +0,0 @@
-/******************************************************************************
- * arch-ia64/hypervisor-if.h
- *
- * Guest OS interface to IA64 Xen.
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to
- * deal in the Software without restriction, including without limitation the
- * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
- * sell copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
- * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
- * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
- * DEALINGS IN THE SOFTWARE.
- *
- * Copyright by those who contributed. (in alphabetical order)
- *
- * Anthony Xu <anthony.xu@intel.com>
- * Eddie Dong <eddie.dong@intel.com>
- * Fred Yang <fred.yang@intel.com>
- * Kevin Tian <kevin.tian@intel.com>
- * Alex Williamson <alex.williamson@hp.com>
- * Chris Wright <chrisw@sous-sol.org>
- * Christian Limpach <Christian.Limpach@cl.cam.ac.uk>
- * Dietmar Hahn <dietmar.hahn@fujitsu-siemens.com>
- * Hollis Blanchard <hollisb@us.ibm.com>
- * Isaku Yamahata <yamahata@valinux.co.jp>
- * Jan Beulich <jbeulich@novell.com>
- * John Levon <john.levon@sun.com>
- * Kazuhiro Suzuki <kaz@jp.fujitsu.com>
- * Keir Fraser <keir.fraser@citrix.com>
- * Kouya Shimura <kouya@jp.fujitsu.com>
- * Masaki Kanno <kanno.masaki@jp.fujitsu.com>
- * Matt Chapman <matthewc@hp.com>
- * Matthew Chapman <matthewc@hp.com>
- * Samuel Thibault <samuel.thibault@eu.citrix.com>
- * Tomonari Horikoshi <t.horikoshi@jp.fujitsu.com>
- * Tristan Gingold <tgingold@free.fr>
- * Tsunehisa Doi <Doi.Tsunehisa@jp.fujitsu.com>
- * Yutaka Ezaki <yutaka.ezaki@jp.fujitsu.com>
- * Zhang Xin <xing.z.zhang@intel.com>
- * Zhang xiantao <xiantao.zhang@intel.com>
- * dan.magenheimer@hp.com
- * ian.pratt@cl.cam.ac.uk
- * michael.fetterman@cl.cam.ac.uk
- */
-#ifndef _ASM_IA64_XEN_INTERFACE_H
-#define _ASM_IA64_XEN_INTERFACE_H
-#define __DEFINE_GUEST_HANDLE(name, type)       \
-        typedef struct { type *p; } __guest_handle_ ## name
-#define DEFINE_GUEST_HANDLE_STRUCT(name)        \
-        __DEFINE_GUEST_HANDLE(name, struct name)
-#define DEFINE_GUEST_HANDLE(name)       __DEFINE_GUEST_HANDLE(name, name)
-#define GUEST_HANDLE(name)              __guest_handle_ ## name
-#define GUEST_HANDLE_64(name)           GUEST_HANDLE(name)
-#define set_xen_guest_handle(hnd, val)  do { (hnd).p = val; } while (0)
-#ifndef __ASSEMBLY__
-/* Explicitly size integers that represent pfns in the public interface
- * with Xen so that we could have one ABI that works for 32 and 64 bit
- * guests. */
-typedef unsigned long xen_pfn_t;
-typedef unsigned long xen_ulong_t;
-/* Guest handles for primitive C types. */
-__DEFINE_GUEST_HANDLE(uchar, unsigned char);
-__DEFINE_GUEST_HANDLE(uint, unsigned int);
-__DEFINE_GUEST_HANDLE(ulong, unsigned long);
-DEFINE_GUEST_HANDLE(char);
-DEFINE_GUEST_HANDLE(int);
-DEFINE_GUEST_HANDLE(long);
-DEFINE_GUEST_HANDLE(void);
-DEFINE_GUEST_HANDLE(uint64_t);
-DEFINE_GUEST_HANDLE(uint32_t);
-DEFINE_GUEST_HANDLE(xen_pfn_t);
-#define PRI_xen_pfn     "lx"
-#endif
-/* Arch specific VIRQs definition */
-#define VIRQ_ITC        VIRQ_ARCH_0     /* V. Virtual itc timer */
-#define VIRQ_MCA_CMC    VIRQ_ARCH_1     /* MCA cmc interrupt */
-#define VIRQ_MCA_CPE    VIRQ_ARCH_2     /* MCA cpe interrupt */
-/* Maximum number of virtual CPUs in multi-processor guests. */
-/* keep sizeof(struct shared_page) <= PAGE_SIZE.
- * this is checked in arch/ia64/xen/hypervisor.c. */
-#define MAX_VIRT_CPUS   64
-#ifndef __ASSEMBLY__
-#define INVALID_MFN     (~0UL)
-union vac {
-        unsigned long value;
-        struct {
-                int a_int:1;
-                int a_from_int_cr:1;
-                int a_to_int_cr:1;
-                int a_from_psr:1;
-                int a_from_cpuid:1;
-                int a_cover:1;
-                int a_bsw:1;
-                long reserved:57;
-        };
-};
-union vdc {
-        unsigned long value;
-        struct {
-                int d_vmsw:1;
-                int d_extint:1;
-                int d_ibr_dbr:1;
-                int d_pmc:1;
-                int d_to_pmd:1;
-                int d_itm:1;
-                long reserved:58;
-        };
-};
-struct mapped_regs {
-        union vac vac;
-        union vdc vdc;
-        unsigned long virt_env_vaddr;
-        unsigned long reserved1[29];
-        unsigned long vhpi;
-        unsigned long reserved2[95];
-        union {
-                unsigned long vgr[16];
-                unsigned long bank1_regs[16];   /* bank1 regs (r16-r31)
-                                                   when bank0 active */
-        };
-        union {
-                unsigned long vbgr[16];
-                unsigned long bank0_regs[16];   /* bank0 regs (r16-r31)
-                                                   when bank1 active */
-        };
-        unsigned long vnat;
-        unsigned long vbnat;
-        unsigned long vcpuid[5];
-        unsigned long reserved3[11];
-        unsigned long vpsr;
-        unsigned long vpr;
-        unsigned long reserved4[76];
-        union {
-                unsigned long vcr[128];
-                struct {
-                        unsigned long dcr;      /* CR0 */
-                        unsigned long itm;
-                        unsigned long iva;
-                        unsigned long rsv1[5];
-                        unsigned long pta;      /* CR8 */
-                        unsigned long rsv2[7];
-                        unsigned long ipsr;     /* CR16 */
-                        unsigned long isr;
-                        unsigned long rsv3;
-                        unsigned long iip;
-                        unsigned long ifa;
-                        unsigned long itir;
-                        unsigned long iipa;
-                        unsigned long ifs;
-                        unsigned long iim;      /* CR24 */
-                        unsigned long iha;
-                        unsigned long rsv4[38];
-                        unsigned long lid;      /* CR64 */
-                        unsigned long ivr;
-                        unsigned long tpr;
-                        unsigned long eoi;
-                        unsigned long irr[4];
-                        unsigned long itv;      /* CR72 */
-                        unsigned long pmv;
-                        unsigned long cmcv;
-                        unsigned long rsv5[5];
-                        unsigned long lrr0;     /* CR80 */
-                        unsigned long lrr1;
-                        unsigned long rsv6[46];
-                };
-        };
-        union {
-                unsigned long reserved5[128];
-                struct {
-                        unsigned long precover_ifs;
-                        unsigned long unat;     /* not sure if this is needed
-                                                   until NaT arch is done */
-                        int interrupt_collection_enabled; /* virtual psr.ic */
-                        /* virtual interrupt deliverable flag is
-                         * evtchn_upcall_mask in shared info area now.
-                         * interrupt_mask_addr is the address
-                         * of evtchn_upcall_mask for current vcpu
-                         */
-                        unsigned char *interrupt_mask_addr;
-                        int pending_interruption;
-                        unsigned char vpsr_pp;
-                        unsigned char vpsr_dfh;
-                        unsigned char hpsr_dfh;
-                        unsigned char hpsr_mfh;
-                        unsigned long reserved5_1[4];
-                        int metaphysical_mode;  /* 1 = use metaphys mapping
-                                                   0 = use virtual */
-                        int banknum;            /* 0 or 1, which virtual
-                                                   register bank is active */
-                        unsigned long rrs[8];   /* region registers */
-                        unsigned long krs[8];   /* kernel registers */
-                        unsigned long tmp[16];  /* temp registers
-                                                   (e.g. for hyperprivops) */
-                        /* itc paravirtualization
-                         * vAR.ITC = mAR.ITC + itc_offset
-                         * itc_last is one which was lastly passed to
-                         * the guest OS in order to prevent it from
-                         * going backwords.
-                         */
-                        unsigned long itc_offset;
-                        unsigned long itc_last;
-                };
-        };
-};
-struct arch_vcpu_info {
-        /* nothing */
-};
-/*
- * This structure is used for magic page in domain pseudo physical address
- * space and the result of XENMEM_machine_memory_map.
- * As the XENMEM_machine_memory_map result,
- * xen_memory_map::nr_entries indicates the size in bytes
- * including struct xen_ia64_memmap_info. Not the number of entries.
- */
-struct xen_ia64_memmap_info {
-        uint64_t efi_memmap_size;       /* size of EFI memory map */
-        uint64_t efi_memdesc_size;      /* size of an EFI memory map
-                                         * descriptor */
-        uint32_t efi_memdesc_version;   /* memory descriptor version */
-        void *memdesc[0];               /* array of efi_memory_desc_t */
-};
-struct arch_shared_info {
-        /* PFN of the start_info page.  */
-        unsigned long start_info_pfn;
-        /* Interrupt vector for event channel.  */
-        int evtchn_vector;
-        /* PFN of memmap_info page */
-        unsigned int memmap_info_num_pages;     /* currently only = 1 case is
-                                                   supported. */
-        unsigned long memmap_info_pfn;
-        uint64_t pad[31];
-};
-struct xen_callback {
-        unsigned long ip;
-};
-typedef struct xen_callback xen_callback_t;
-#endif /* !__ASSEMBLY__ */
-#include <asm/pvclock-abi.h>
-/* Size of the shared_info area (this is not related to page size).  */
-#define XSI_SHIFT                       14
-#define XSI_SIZE                        (1 << XSI_SHIFT)
-/* Log size of mapped_regs area (64 KB - only 4KB is used).  */
-#define XMAPPEDREGS_SHIFT               12
-#define XMAPPEDREGS_SIZE                (1 << XMAPPEDREGS_SHIFT)
-/* Offset of XASI (Xen arch shared info) wrt XSI_BASE.  */
-#define XMAPPEDREGS_OFS                 XSI_SIZE
-/* Hyperprivops.  */
-#define HYPERPRIVOP_START               0x1
-#define HYPERPRIVOP_RFI                 (HYPERPRIVOP_START + 0x0)
-#define HYPERPRIVOP_RSM_DT              (HYPERPRIVOP_START + 0x1)
-#define HYPERPRIVOP_SSM_DT              (HYPERPRIVOP_START + 0x2)
-#define HYPERPRIVOP_COVER               (HYPERPRIVOP_START + 0x3)
-#define HYPERPRIVOP_ITC_D               (HYPERPRIVOP_START + 0x4)
-#define HYPERPRIVOP_ITC_I               (HYPERPRIVOP_START + 0x5)
-#define HYPERPRIVOP_SSM_I               (HYPERPRIVOP_START + 0x6)
-#define HYPERPRIVOP_GET_IVR             (HYPERPRIVOP_START + 0x7)
-#define HYPERPRIVOP_GET_TPR             (HYPERPRIVOP_START + 0x8)
-#define HYPERPRIVOP_SET_TPR             (HYPERPRIVOP_START + 0x9)
-#define HYPERPRIVOP_EOI                 (HYPERPRIVOP_START + 0xa)
-#define HYPERPRIVOP_SET_ITM             (HYPERPRIVOP_START + 0xb)
-#define HYPERPRIVOP_THASH               (HYPERPRIVOP_START + 0xc)
-#define HYPERPRIVOP_PTC_GA              (HYPERPRIVOP_START + 0xd)
-#define HYPERPRIVOP_ITR_D               (HYPERPRIVOP_START + 0xe)
-#define HYPERPRIVOP_GET_RR              (HYPERPRIVOP_START + 0xf)
-#define HYPERPRIVOP_SET_RR              (HYPERPRIVOP_START + 0x10)
-#define HYPERPRIVOP_SET_KR              (HYPERPRIVOP_START + 0x11)
-#define HYPERPRIVOP_FC                  (HYPERPRIVOP_START + 0x12)
-#define HYPERPRIVOP_GET_CPUID           (HYPERPRIVOP_START + 0x13)
-#define HYPERPRIVOP_GET_PMD             (HYPERPRIVOP_START + 0x14)
-#define HYPERPRIVOP_GET_EFLAG           (HYPERPRIVOP_START + 0x15)
-#define HYPERPRIVOP_SET_EFLAG           (HYPERPRIVOP_START + 0x16)
-#define HYPERPRIVOP_RSM_BE              (HYPERPRIVOP_START + 0x17)
-#define HYPERPRIVOP_GET_PSR             (HYPERPRIVOP_START + 0x18)
-#define HYPERPRIVOP_SET_RR0_TO_RR4      (HYPERPRIVOP_START + 0x19)
-#define HYPERPRIVOP_MAX                 (0x1a)
-/* Fast and light hypercalls.  */
-#define __HYPERVISOR_ia64_fast_eoi      __HYPERVISOR_arch_1
-/* Xencomm macros.  */
-#define XENCOMM_INLINE_MASK             0xf800000000000000UL
-#define XENCOMM_INLINE_FLAG             0x8000000000000000UL
-#ifndef __ASSEMBLY__
-/*
- * Optimization features.
- * The hypervisor may do some special optimizations for guests. This hypercall
- * can be used to switch on/of these special optimizations.
- */
-#define __HYPERVISOR_opt_feature        0x700UL
-#define XEN_IA64_OPTF_OFF               0x0
-#define XEN_IA64_OPTF_ON                0x1
-/*
- * If this feature is switched on, the hypervisor inserts the
- * tlb entries without calling the guests traphandler.
- * This is useful in guests using region 7 for identity mapping
- * like the linux kernel does.
- */
-#define XEN_IA64_OPTF_IDENT_MAP_REG7    1
-/* Identity mapping of region 4 addresses in HVM. */
-#define XEN_IA64_OPTF_IDENT_MAP_REG4    2
-/* Identity mapping of region 5 addresses in HVM. */
-#define XEN_IA64_OPTF_IDENT_MAP_REG5    3
-#define XEN_IA64_OPTF_IDENT_MAP_NOT_SET  (0)
-struct xen_ia64_opt_feature {
-        unsigned long cmd;      /* Which feature */
-        unsigned char on;       /* Switch feature on/off */
-        union {
-                struct {
-                        /* The page protection bit mask of the pte.
-                         * This will be or'ed with the pte. */
-                        unsigned long pgprot;
-                        unsigned long key;      /* A protection key for itir.*/
-                };
-        };
-};
-#endif /* __ASSEMBLY__ */
-#endif /* _ASM_IA64_XEN_INTERFACE_H */
diff --git a/arch/ia64/include/asm/xen/irq.h b/arch/ia64/include/asm/xen/irq.h
deleted file mode 100644
index a90450983003..000000000000
--- a/arch/ia64/include/asm/xen/irq.h
+++ /dev/null
@@ -1,44 +0,0 @@
-/******************************************************************************
- * arch/ia64/include/asm/xen/irq.h
- *
- * Copyright (c) 2008 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-#ifndef _ASM_IA64_XEN_IRQ_H
-#define _ASM_IA64_XEN_IRQ_H
-/*
- * The flat IRQ space is divided into two regions:
- *  1. A one-to-one mapping of real physical IRQs. This space is only used
- *     if we have physical device-access privilege. This region is at the
- *     start of the IRQ space so that existing device drivers do not need
- *     to be modified to translate physical IRQ numbers into our IRQ space.
- *  3. A dynamic mapping of inter-domain and Xen-sourced virtual IRQs. These
- *     are bound using the provided bind/unbind functions.
- */
-#define XEN_PIRQ_BASE           0
-#define XEN_NR_PIRQS            256
-#define XEN_DYNIRQ_BASE         (XEN_PIRQ_BASE + XEN_NR_PIRQS)
-#define XEN_NR_DYNIRQS          (NR_CPUS * 8)
-#define XEN_NR_IRQS             (XEN_NR_PIRQS + XEN_NR_DYNIRQS)
-#endif /* _ASM_IA64_XEN_IRQ_H */
diff --git a/arch/ia64/include/asm/xen/minstate.h b/arch/ia64/include/asm/xen/minstate.h
deleted file mode 100644
index 00cf03e0cb82..000000000000
--- a/arch/ia64/include/asm/xen/minstate.h
+++ /dev/null
@@ -1,143 +0,0 @@
-#ifdef CONFIG_VIRT_CPU_ACCOUNTING_NATIVE
-/* read ar.itc in advance, and use it before leaving bank 0 */
-#define XEN_ACCOUNT_GET_STAMP           \
-        MOV_FROM_ITC(pUStk, p6, r20, r2);
-#else
-#define XEN_ACCOUNT_GET_STAMP
-#endif
-/*
- * DO_SAVE_MIN switches to the kernel stacks (if necessary) and saves
- * the minimum state necessary that allows us to turn psr.ic back
- * on.
- *
- * Assumed state upon entry:
- *      psr.ic: off
- *      r31:    contains saved predicates (pr)
- *
- * Upon exit, the state is as follows:
- *      psr.ic: off
- *       r2 = points to &pt_regs.r16
- *       r8 = contents of ar.ccv
- *       r9 = contents of ar.csd
- *      r10 = contents of ar.ssd
- *      r11 = FPSR_DEFAULT
- *      r12 = kernel sp (kernel virtual address)
- *      r13 = points to current task_struct (kernel virtual address)
- *      p15 = TRUE if psr.i is set in cr.ipsr
- *      predicate registers (other than p2, p3, and p15), b6, r3, r14, r15:
- *              preserved
- * CONFIG_XEN note: p6/p7 are not preserved
- *
- * Note that psr.ic is NOT turned on by this macro.  This is so that
- * we can pass interruption state as arguments to a handler.
- */
-#define XEN_DO_SAVE_MIN(__COVER,SAVE_IFS,EXTRA,WORKAROUND)                                      \
-        mov r16=IA64_KR(CURRENT);       /* M */                                                 \
-        mov r27=ar.rsc;                 /* M */                                                 \
-        mov r20=r1;                     /* A */                                                 \
-        mov r25=ar.unat;                /* M */                                                 \
-        MOV_FROM_IPSR(p0,r29);          /* M */                                                 \
-        MOV_FROM_IIP(r28);              /* M */                                                 \
-        mov r21=ar.fpsr;                /* M */                                                 \
-        mov r26=ar.pfs;                 /* I */                                                 \
-        __COVER;                        /* B;; (or nothing) */                                  \
-        adds r16=IA64_TASK_THREAD_ON_USTACK_OFFSET,r16;                                         \
-        ;;                                                                                      \
-        ld1 r17=[r16];                          /* load current->thread.on_ustack flag */       \
-        st1 [r16]=r0;                           /* clear current->thread.on_ustack flag */      \
-        adds r1=-IA64_TASK_THREAD_ON_USTACK_OFFSET,r16                                          \
-        /* switch from user to kernel RBS: */                                                   \
-        ;;                                                                                      \
-        invala;                         /* M */                                                 \
-        /* SAVE_IFS;*/ /* see xen special handling below */                                     \
-        cmp.eq pKStk,pUStk=r0,r17;              /* are we in kernel mode already? */            \
-        ;;                                                                                      \
-(pUStk) mov ar.rsc=0;           /* set enforced lazy mode, pl 0, little-endian, loadrs=0 */     \
-        ;;                                                                                      \
-(pUStk) mov.m r24=ar.rnat;                                                                      \
-(pUStk) addl r22=IA64_RBS_OFFSET,r1;                    /* compute base of RBS */               \
-(pKStk) mov r1=sp;                                      /* get sp  */                           \
-        ;;                                                                                      \
-(pUStk) lfetch.fault.excl.nt1 [r22];                                                            \
-(pUStk) addl r1=IA64_STK_OFFSET-IA64_PT_REGS_SIZE,r1;   /* compute base of memory stack */      \
-(pUStk) mov r23=ar.bspstore;                            /* save ar.bspstore */                  \
-        ;;                                                                                      \
-(pUStk) mov ar.bspstore=r22;                            /* switch to kernel RBS */              \
-(pKStk) addl r1=-IA64_PT_REGS_SIZE,r1;                  /* if in kernel mode, use sp (r12) */   \
-        ;;                                                                                      \
-(pUStk) mov r18=ar.bsp;                                                                         \
-(pUStk) mov ar.rsc=0x3;         /* set eager mode, pl 0, little-endian, loadrs=0 */             \
-        adds r17=2*L1_CACHE_BYTES,r1;           /* really: biggest cache-line size */           \
-        adds r16=PT(CR_IPSR),r1;                                                                \
-        ;;                                                                                      \
-        lfetch.fault.excl.nt1 [r17],L1_CACHE_BYTES;                                             \
-        st8 [r16]=r29;          /* save cr.ipsr */                                              \
-        ;;                                                                                      \
-        lfetch.fault.excl.nt1 [r17];                                                            \
-        tbit.nz p15,p0=r29,IA64_PSR_I_BIT;                                                      \
-        mov r29=b0                                                                              \
-        ;;                                                                                      \
-        WORKAROUND;                                                                             \
-        adds r16=PT(R8),r1;     /* initialize first base pointer */                             \
-        adds r17=PT(R9),r1;     /* initialize second base pointer */                            \
-(pKStk) mov r18=r0;             /* make sure r18 isn't NaT */                                   \
-        ;;                                                                                      \
-.mem.offset 0,0; st8.spill [r16]=r8,16;                                                         \
-.mem.offset 8,0; st8.spill [r17]=r9,16;                                                         \
-        ;;                                                                                      \
-.mem.offset 0,0; st8.spill [r16]=r10,24;                                                        \
-        movl r8=XSI_PRECOVER_IFS;                                                               \
-.mem.offset 8,0; st8.spill [r17]=r11,24;                                                        \
-        ;;                                                                                      \
-        /* xen special handling for possibly lazy cover */                                      \
-        /* SAVE_MIN case in dispatch_ia32_handler: mov r30=r0 */                                \
-        ld8 r30=[r8];                                                                           \
-(pUStk) sub r18=r18,r22;        /* r18=RSE.ndirty*8 */                                          \
-        st8 [r16]=r28,16;       /* save cr.iip */                                               \
-        ;;                                                                                      \
-        st8 [r17]=r30,16;       /* save cr.ifs */                                               \
-        mov r8=ar.ccv;                                                                          \
-        mov r9=ar.csd;                                                                          \
-        mov r10=ar.ssd;                                                                         \
-        movl r11=FPSR_DEFAULT;   /* L-unit */                                                   \
-        ;;                                                                                      \
-        st8 [r16]=r25,16;       /* save ar.unat */                                              \
-        st8 [r17]=r26,16;       /* save ar.pfs */                                               \
-        shl r18=r18,16;         /* compute ar.rsc to be used for "loadrs" */                    \
-        ;;                                                                                      \
-        st8 [r16]=r27,16;       /* save ar.rsc */                                               \
-(pUStk) st8 [r17]=r24,16;       /* save ar.rnat */                                              \
-(pKStk) adds r17=16,r17;        /* skip over ar_rnat field */                                   \
-        ;;                      /* avoid RAW on r16 & r17 */                                    \
-(pUStk) st8 [r16]=r23,16;       /* save ar.bspstore */                                          \
-        st8 [r17]=r31,16;       /* save predicates */                                           \
-(pKStk) adds r16=16,r16;        /* skip over ar_bspstore field */                               \
-        ;;                                                                                      \
-        st8 [r16]=r29,16;       /* save b0 */                                                   \
-        st8 [r17]=r18,16;       /* save ar.rsc value for "loadrs" */                            \
-        cmp.eq pNonSys,pSys=r0,r0       /* initialize pSys=0, pNonSys=1 */                      \
-        ;;                                                                                      \
-.mem.offset 0,0; st8.spill [r16]=r20,16;        /* save original r1 */                          \
-.mem.offset 8,0; st8.spill [r17]=r12,16;                                                        \
-        adds r12=-16,r1;        /* switch to kernel memory stack (with 16 bytes of scratch) */  \
-        ;;                                                                                      \
-.mem.offset 0,0; st8.spill [r16]=r13,16;                                                        \
-.mem.offset 8,0; st8.spill [r17]=r21,16;        /* save ar.fpsr */                              \
-        mov r13=IA64_KR(CURRENT);       /* establish `current' */                               \
-        ;;                                                                                      \
-.mem.offset 0,0; st8.spill [r16]=r15,16;                                                        \
-.mem.offset 8,0; st8.spill [r17]=r14,16;                                                        \
-        ;;                                                                                      \
-.mem.offset 0,0; st8.spill [r16]=r2,16;                                                         \
-.mem.offset 8,0; st8.spill [r17]=r3,16;                                                         \
-        XEN_ACCOUNT_GET_STAMP                                                                   \
-        adds r2=IA64_PT_REGS_R16_OFFSET,r1;                                                     \
-        ;;                                                                                      \
-        EXTRA;                                                                                  \
-        movl r1=__gp;           /* establish kernel global pointer */                           \
-        ;;                                                                                      \
-        ACCOUNT_SYS_ENTER                                                                       \
-        BSW_1(r3,r14);  /* switch back to bank 1 (must be last in insn group) */                \
-        ;;
diff --git a/arch/ia64/include/asm/xen/page-coherent.h b/arch/ia64/include/asm/xen/page-coherent.h
deleted file mode 100644
index 96e42f97fa1f..000000000000
--- a/arch/ia64/include/asm/xen/page-coherent.h
+++ /dev/null
@@ -1,38 +0,0 @@
-#ifndef _ASM_IA64_XEN_PAGE_COHERENT_H
-#define _ASM_IA64_XEN_PAGE_COHERENT_H
-#include <asm/page.h>
-#include <linux/dma-attrs.h>
-#include <linux/dma-mapping.h>
-static inline void *xen_alloc_coherent_pages(struct device *hwdev, size_t size,
-                dma_addr_t *dma_handle, gfp_t flags,
-                struct dma_attrs *attrs)
-{
-        void *vstart = (void*)__get_free_pages(flags, get_order(size));
-        *dma_handle = virt_to_phys(vstart);
-        return vstart;
-}
-static inline void xen_free_coherent_pages(struct device *hwdev, size_t size,
-                void *cpu_addr, dma_addr_t dma_handle,
-                struct dma_attrs *attrs)
-{
-        free_pages((unsigned long) cpu_addr, get_order(size));
-}
-static inline void xen_dma_map_page(struct device *hwdev, struct page *page,
-             unsigned long offset, size_t size, enum dma_data_direction dir,
-             struct dma_attrs *attrs) { }
-static inline void xen_dma_unmap_page(struct device *hwdev, dma_addr_t handle,
-                size_t size, enum dma_data_direction dir,
-                struct dma_attrs *attrs) { }
-static inline void xen_dma_sync_single_for_cpu(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir) { }
-static inline void xen_dma_sync_single_for_device(struct device *hwdev,
-                dma_addr_t handle, size_t size, enum dma_data_direction dir) { }
-#endif /* _ASM_IA64_XEN_PAGE_COHERENT_H */
diff --git a/arch/ia64/include/asm/xen/page.h b/arch/ia64/include/asm/xen/page.h
deleted file mode 100644
index 03441a780b5b..000000000000
--- a/arch/ia64/include/asm/xen/page.h
+++ /dev/null
@@ -1,65 +0,0 @@
-/******************************************************************************
- * arch/ia64/include/asm/xen/page.h
- *
- * Copyright (c) 2008 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-#ifndef _ASM_IA64_XEN_PAGE_H
-#define _ASM_IA64_XEN_PAGE_H
-#define INVALID_P2M_ENTRY       (~0UL)
-static inline unsigned long mfn_to_pfn(unsigned long mfn)
-{
-        return mfn;
-}
-static inline unsigned long pfn_to_mfn(unsigned long pfn)
-{
-        return pfn;
-}
-#define phys_to_machine_mapping_valid(_x)       (1)
-static inline void *mfn_to_virt(unsigned long mfn)
-{
-        return __va(mfn << PAGE_SHIFT);
-}
-static inline unsigned long virt_to_mfn(void *virt)
-{
-        return __pa(virt) >> PAGE_SHIFT;
-}
-/* for tpmfront.c */
-static inline unsigned long virt_to_machine(void *virt)
-{
-        return __pa(virt);
-}
-static inline void set_phys_to_machine(unsigned long pfn, unsigned long mfn)
-{
-        /* nothing */
-}
-#define pte_mfn(_x)     pte_pfn(_x)
-#define mfn_pte(_x, _y) __pte_ma(0)             /* unmodified use */
-#define __pte_ma(_x)    ((pte_t) {(_x)})        /* unmodified use */
-#endif /* _ASM_IA64_XEN_PAGE_H */
diff --git a/arch/ia64/include/asm/xen/patchlist.h b/arch/ia64/include/asm/xen/patchlist.h
deleted file mode 100644
index eae944e88846..000000000000
--- a/arch/ia64/include/asm/xen/patchlist.h
+++ /dev/null
@@ -1,38 +0,0 @@
-/******************************************************************************
- * arch/ia64/include/asm/xen/patchlist.h
- *
- * Copyright (c) 2008 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-#define __paravirt_start_gate_fsyscall_patchlist                \
-        __xen_start_gate_fsyscall_patchlist
-#define __paravirt_end_gate_fsyscall_patchlist                  \
-        __xen_end_gate_fsyscall_patchlist
-#define __paravirt_start_gate_brl_fsys_bubble_down_patchlist    \
-        __xen_start_gate_brl_fsys_bubble_down_patchlist
-#define __paravirt_end_gate_brl_fsys_bubble_down_patchlist      \
-        __xen_end_gate_brl_fsys_bubble_down_patchlist
-#define __paravirt_start_gate_vtop_patchlist                    \
-        __xen_start_gate_vtop_patchlist
-#define __paravirt_end_gate_vtop_patchlist                      \
-        __xen_end_gate_vtop_patchlist
-#define __paravirt_start_gate_mckinley_e9_patchlist             \
-        __xen_start_gate_mckinley_e9_patchlist
-#define __paravirt_end_gate_mckinley_e9_patchlist               \
-        __xen_end_gate_mckinley_e9_patchlist
diff --git a/arch/ia64/include/asm/xen/privop.h b/arch/ia64/include/asm/xen/privop.h
deleted file mode 100644
index fb4ec5e0b066..000000000000
--- a/arch/ia64/include/asm/xen/privop.h
+++ /dev/null
@@ -1,135 +0,0 @@
-#ifndef _ASM_IA64_XEN_PRIVOP_H
-#define _ASM_IA64_XEN_PRIVOP_H
-/*
- * Copyright (C) 2005 Hewlett-Packard Co
- *      Dan Magenheimer <dan.magenheimer@hp.com>
- *
- * Paravirtualizations of privileged operations for Xen/ia64
- *
- *
- * inline privop and paravirt_alt support
- * Copyright (c) 2007 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- */
-#ifndef __ASSEMBLY__
-#include <linux/types.h>                /* arch-ia64.h requires uint64_t */
-#endif
-#include <asm/xen/interface.h>
-/* At 1 MB, before per-cpu space but still addressable using addl instead
-   of movl. */
-#define XSI_BASE                        0xfffffffffff00000
-/* Address of mapped regs.  */
-#define XMAPPEDREGS_BASE                (XSI_BASE + XSI_SIZE)
-#ifdef __ASSEMBLY__
-#define XEN_HYPER_RFI                   break HYPERPRIVOP_RFI
-#define XEN_HYPER_RSM_PSR_DT            break HYPERPRIVOP_RSM_DT
-#define XEN_HYPER_SSM_PSR_DT            break HYPERPRIVOP_SSM_DT
-#define XEN_HYPER_COVER                 break HYPERPRIVOP_COVER
-#define XEN_HYPER_ITC_D                 break HYPERPRIVOP_ITC_D
-#define XEN_HYPER_ITC_I                 break HYPERPRIVOP_ITC_I
-#define XEN_HYPER_SSM_I                 break HYPERPRIVOP_SSM_I
-#define XEN_HYPER_GET_IVR               break HYPERPRIVOP_GET_IVR
-#define XEN_HYPER_THASH                 break HYPERPRIVOP_THASH
-#define XEN_HYPER_ITR_D                 break HYPERPRIVOP_ITR_D
-#define XEN_HYPER_SET_KR                break HYPERPRIVOP_SET_KR
-#define XEN_HYPER_GET_PSR               break HYPERPRIVOP_GET_PSR
-#define XEN_HYPER_SET_RR0_TO_RR4        break HYPERPRIVOP_SET_RR0_TO_RR4
-#define XSI_IFS                         (XSI_BASE + XSI_IFS_OFS)
-#define XSI_PRECOVER_IFS                (XSI_BASE + XSI_PRECOVER_IFS_OFS)
-#define XSI_IFA                         (XSI_BASE + XSI_IFA_OFS)
-#define XSI_ISR                         (XSI_BASE + XSI_ISR_OFS)
-#define XSI_IIM                         (XSI_BASE + XSI_IIM_OFS)
-#define XSI_ITIR                        (XSI_BASE + XSI_ITIR_OFS)
-#define XSI_PSR_I_ADDR                  (XSI_BASE + XSI_PSR_I_ADDR_OFS)
-#define XSI_PSR_IC                      (XSI_BASE + XSI_PSR_IC_OFS)
-#define XSI_IPSR                        (XSI_BASE + XSI_IPSR_OFS)
-#define XSI_IIP                         (XSI_BASE + XSI_IIP_OFS)
-#define XSI_B1NAT                       (XSI_BASE + XSI_B1NATS_OFS)
-#define XSI_BANK1_R16                   (XSI_BASE + XSI_BANK1_R16_OFS)
-#define XSI_BANKNUM                     (XSI_BASE + XSI_BANKNUM_OFS)
-#define XSI_IHA                         (XSI_BASE + XSI_IHA_OFS)
-#define XSI_ITC_OFFSET                  (XSI_BASE + XSI_ITC_OFFSET_OFS)
-#define XSI_ITC_LAST                    (XSI_BASE + XSI_ITC_LAST_OFS)
-#endif
-#ifndef __ASSEMBLY__
-/************************************************/
-/* Instructions paravirtualized for correctness */
-/************************************************/
-/* "fc" and "thash" are privilege-sensitive instructions, meaning they
- *  may have different semantics depending on whether they are executed
- *  at PL0 vs PL!=0.  When paravirtualized, these instructions mustn't
- *  be allowed to execute directly, lest incorrect semantics result. */
-extern void xen_fc(void *addr);
-extern unsigned long xen_thash(unsigned long addr);
-/* Note that "ttag" and "cover" are also privilege-sensitive; "ttag"
- * is not currently used (though it may be in a long-format VHPT system!)
- * and the semantics of cover only change if psr.ic is off which is very
- * rare (and currently non-existent outside of assembly code */
-/* There are also privilege-sensitive registers.  These registers are
- * readable at any privilege level but only writable at PL0. */
-extern unsigned long xen_get_cpuid(int index);
-extern unsigned long xen_get_pmd(int index);
-#ifndef ASM_SUPPORTED
-extern unsigned long xen_get_eflag(void);       /* see xen_ia64_getreg */
-extern void xen_set_eflag(unsigned long);       /* see xen_ia64_setreg */
-#endif
-/************************************************/
-/* Instructions paravirtualized for performance */
-/************************************************/
-/* Xen uses memory-mapped virtual privileged registers for access to many
- * performance-sensitive privileged registers.  Some, like the processor
- * status register (psr), are broken up into multiple memory locations.
- * Others, like "pend", are abstractions based on privileged registers.
- * "Pend" is guaranteed to be set if reading cr.ivr would return a
- * (non-spurious) interrupt. */
-#define XEN_MAPPEDREGS ((struct mapped_regs *)XMAPPEDREGS_BASE)
-#define XSI_PSR_I                       \
-        (*XEN_MAPPEDREGS->interrupt_mask_addr)
-#define xen_get_virtual_psr_i()         \
-        (!XSI_PSR_I)
-#define xen_set_virtual_psr_i(_val)     \
-        ({ XSI_PSR_I = (uint8_t)(_val) ? 0 : 1; })
-#define xen_set_virtual_psr_ic(_val)    \
-        ({ XEN_MAPPEDREGS->interrupt_collection_enabled = _val ? 1 : 0; })
-#define xen_get_virtual_pend()          \
-        (*(((uint8_t *)XEN_MAPPEDREGS->interrupt_mask_addr) - 1))
-#ifndef ASM_SUPPORTED
-/* Although all privileged operations can be left to trap and will
- * be properly handled by Xen, some are frequent enough that we use
- * hyperprivops for performance. */
-extern unsigned long xen_get_psr(void);
-extern unsigned long xen_get_ivr(void);
-extern unsigned long xen_get_tpr(void);
-extern void xen_hyper_ssm_i(void);
-extern void xen_set_itm(unsigned long);
-extern void xen_set_tpr(unsigned long);
-extern void xen_eoi(unsigned long);
-extern unsigned long xen_get_rr(unsigned long index);
-extern void xen_set_rr(unsigned long index, unsigned long val);
-extern void xen_set_rr0_to_rr4(unsigned long val0, unsigned long val1,
-                               unsigned long val2, unsigned long val3,
-                               unsigned long val4);
-extern void xen_set_kr(unsigned long index, unsigned long val);
-extern void xen_ptcga(unsigned long addr, unsigned long size);
-#endif /* !ASM_SUPPORTED */
-#endif /* !__ASSEMBLY__ */
-#endif /* _ASM_IA64_XEN_PRIVOP_H */
diff --git a/arch/ia64/include/asm/xen/xcom_hcall.h b/arch/ia64/include/asm/xen/xcom_hcall.h
deleted file mode 100644
index 20b2950c71b6..000000000000
--- a/arch/ia64/include/asm/xen/xcom_hcall.h
+++ /dev/null
@@ -1,51 +0,0 @@
-/*
- * Copyright (C) 2006 Tristan Gingold <tristan.gingold@bull.net>, Bull SAS
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
- */
-#ifndef _ASM_IA64_XEN_XCOM_HCALL_H
-#define _ASM_IA64_XEN_XCOM_HCALL_H
-/* These function creates inline or mini descriptor for the parameters and
-   calls the corresponding xencomm_arch_hypercall_X.
-   Architectures should defines HYPERVISOR_xxx as xencomm_hypercall_xxx unless
-   they want to use their own wrapper.  */
-extern int xencomm_hypercall_console_io(int cmd, int count, char *str);
-extern int xencomm_hypercall_event_channel_op(int cmd, void *op);
-extern int xencomm_hypercall_xen_version(int cmd, void *arg);
-extern int xencomm_hypercall_physdev_op(int cmd, void *op);
-extern int xencomm_hypercall_grant_table_op(unsigned int cmd, void *op,
-                                            unsigned int count);
-extern int xencomm_hypercall_sched_op(int cmd, void *arg);
-extern int xencomm_hypercall_multicall(void *call_list, int nr_calls);
-extern int xencomm_hypercall_callback_op(int cmd, void *arg);
-extern int xencomm_hypercall_memory_op(unsigned int cmd, void *arg);
-extern int xencomm_hypercall_suspend(unsigned long srec);
-extern long xencomm_hypercall_vcpu_op(int cmd, int cpu, void *arg);
-extern long xencomm_hypercall_opt_feature(void *arg);
-#endif /* _ASM_IA64_XEN_XCOM_HCALL_H */
diff --git a/arch/ia64/include/asm/xen/xencomm.h b/arch/ia64/include/asm/xen/xencomm.h
deleted file mode 100644
index cded677bebf2..000000000000
--- a/arch/ia64/include/asm/xen/xencomm.h
+++ /dev/null
@@ -1,42 +0,0 @@
-/*
- * Copyright (C) 2006 Hollis Blanchard <hollisb@us.ibm.com>, IBM Corporation
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
- */
-#ifndef _ASM_IA64_XEN_XENCOMM_H
-#define _ASM_IA64_XEN_XENCOMM_H
-#include <xen/xencomm.h>
-#include <asm/pgtable.h>
-/* Must be called before any hypercall.  */
-extern void xencomm_initialize(void);
-extern int xencomm_is_initialized(void);
-/* Check if virtual contiguity means physical contiguity
- * where the passed address is a pointer value in virtual address.
- * On ia64, identity mapping area in region 7 or the piece of region 5
- * that is mapped by itr[IA64_TR_KERNEL]/dtr[IA64_TR_KERNEL]
- */
-static inline int xencomm_is_phys_contiguous(unsigned long addr)
-{
-        return (PAGE_OFFSET <= addr &&
-                addr < (PAGE_OFFSET + (1UL << IA64_MAX_PHYS_BITS))) ||
-                (KERNEL_START <= addr &&
-                 addr < KERNEL_START + KERNEL_TR_PAGE_SIZE);
-}
-#endif /* _ASM_IA64_XEN_XENCOMM_H */
diff --git a/arch/ia64/include/uapi/asm/break.h b/arch/ia64/include/uapi/asm/break.h
index e90c40ec9edf..f03402039896 100644
--- a/arch/ia64/include/uapi/asm/break.h
+++ b/arch/ia64/include/uapi/asm/break.h
@@ -20,13 +20,4 @@
 */
 #define __IA64_BREAK_SYSCALL            0x100000
-/*
- * Xen specific break numbers:
- */
-#define __IA64_XEN_HYPERCALL            0x1000
-/* [__IA64_XEN_HYPERPRIVOP_START, __IA64_XEN_HYPERPRIVOP_MAX] is used
-   for xen hyperprivops */
-#define __IA64_XEN_HYPERPRIVOP_START    0x1
-#define __IA64_XEN_HYPERPRIVOP_MAX      0x1a
 #endif /* _ASM_IA64_BREAK_H */
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index 59d52e3aef12..bfa19311e09c 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -53,7 +53,6 @@
 #include <asm/numa.h>
 #include <asm/sal.h>
 #include <asm/cyclone.h>
-#include <asm/xen/hypervisor.h>
 #define BAD_MADT_ENTRY(entry, end) (                                        \
                (!entry) || (unsigned long)entry + sizeof(*entry) > end ||  \
@@ -120,8 +119,6 @@ acpi_get_sysname(void)
                        return "uv";
                else
                        return "sn2";
-        } else if (xen_pv_domain() && !strcmp(hdr->oem_id, "XEN")) {
-                return "xen";
        }
 #ifdef CONFIG_INTEL_IOMMU
diff --git a/arch/ia64/kernel/asm-offsets.c b/arch/ia64/kernel/asm-offsets.c
index 46c9e3007315..60ef83e6db71 100644
--- a/arch/ia64/kernel/asm-offsets.c
+++ b/arch/ia64/kernel/asm-offsets.c
@@ -16,9 +16,6 @@
 #include <asm/sigcontext.h>
 #include <asm/mca.h>
-#include <asm/xen/interface.h>
-#include <asm/xen/hypervisor.h>
 #include "../kernel/sigframe.h"
 #include "../kernel/fsyscall_gtod_data.h"
@@ -290,33 +287,4 @@ void foo(void)
        DEFINE(IA64_ITC_LASTCYCLE_OFFSET,
                offsetof (struct itc_jitter_data_t, itc_lastcycle));
-#ifdef CONFIG_XEN
-        BLANK();
-        DEFINE(XEN_NATIVE_ASM, XEN_NATIVE);
-        DEFINE(XEN_PV_DOMAIN_ASM, XEN_PV_DOMAIN);
-#define DEFINE_MAPPED_REG_OFS(sym, field) \
-        DEFINE(sym, (XMAPPEDREGS_OFS + offsetof(struct mapped_regs, field)))
-        DEFINE_MAPPED_REG_OFS(XSI_PSR_I_ADDR_OFS, interrupt_mask_addr);
-        DEFINE_MAPPED_REG_OFS(XSI_IPSR_OFS, ipsr);
-        DEFINE_MAPPED_REG_OFS(XSI_IIP_OFS, iip);
-        DEFINE_MAPPED_REG_OFS(XSI_IFS_OFS, ifs);
-        DEFINE_MAPPED_REG_OFS(XSI_PRECOVER_IFS_OFS, precover_ifs);
-        DEFINE_MAPPED_REG_OFS(XSI_ISR_OFS, isr);
-        DEFINE_MAPPED_REG_OFS(XSI_IFA_OFS, ifa);
-        DEFINE_MAPPED_REG_OFS(XSI_IIPA_OFS, iipa);
-        DEFINE_MAPPED_REG_OFS(XSI_IIM_OFS, iim);
-        DEFINE_MAPPED_REG_OFS(XSI_IHA_OFS, iha);
-        DEFINE_MAPPED_REG_OFS(XSI_ITIR_OFS, itir);
-        DEFINE_MAPPED_REG_OFS(XSI_PSR_IC_OFS, interrupt_collection_enabled);
-        DEFINE_MAPPED_REG_OFS(XSI_BANKNUM_OFS, banknum);
-        DEFINE_MAPPED_REG_OFS(XSI_BANK0_R16_OFS, bank0_regs[0]);
-        DEFINE_MAPPED_REG_OFS(XSI_BANK1_R16_OFS, bank1_regs[0]);
-        DEFINE_MAPPED_REG_OFS(XSI_B0NATS_OFS, vbnat);
-        DEFINE_MAPPED_REG_OFS(XSI_B1NATS_OFS, vnat);
-        DEFINE_MAPPED_REG_OFS(XSI_ITC_OFFSET_OFS, itc_offset);
-        DEFINE_MAPPED_REG_OFS(XSI_ITC_LAST_OFS, itc_last);
-#endif /* CONFIG_XEN */
 }
diff --git a/arch/ia64/kernel/head.S b/arch/ia64/kernel/head.S
index 991ca336b8a2..e6f80fcf013b 100644
--- a/arch/ia64/kernel/head.S
+++ b/arch/ia64/kernel/head.S
@@ -416,8 +416,6 @@ start_ap:
 default_setup_hook = 0          // Currently nothing needs to be done.
-        .weak xen_setup_hook
        .global hypervisor_type
 hypervisor_type:
        data8           PARAVIRT_HYPERVISOR_TYPE_DEFAULT
@@ -426,7 +424,6 @@ hypervisor_type:
 hypervisor_setup_hooks:
        data8           default_setup_hook
-        data8           xen_setup_hook
 num_hypervisor_hooks = (. - hypervisor_setup_hooks) / 8
        .previous
diff --git a/arch/ia64/kernel/nr-irqs.c b/arch/ia64/kernel/nr-irqs.c
index ee564575148e..f6769cd54bd9 100644
--- a/arch/ia64/kernel/nr-irqs.c
+++ b/arch/ia64/kernel/nr-irqs.c
@@ -10,15 +10,11 @@
 #include <linux/kbuild.h>
 #include <linux/threads.h>
 #include <asm/native/irq.h>
-#include <asm/xen/irq.h>
 void foo(void)
 {
        union paravirt_nr_irqs_max {
                char ia64_native_nr_irqs[IA64_NATIVE_NR_IRQS];
-#ifdef CONFIG_XEN
-                char xen_nr_irqs[XEN_NR_IRQS];
-#endif
        };
        DEFINE(NR_IRQS, sizeof (union paravirt_nr_irqs_max));
diff --git a/arch/ia64/kernel/paravirt_inst.h b/arch/ia64/kernel/paravirt_inst.h
index 64d6d810c64b..1ad7512b5f65 100644
--- a/arch/ia64/kernel/paravirt_inst.h
+++ b/arch/ia64/kernel/paravirt_inst.h
@@ -22,9 +22,6 @@
 #ifdef __IA64_ASM_PARAVIRTUALIZED_PVCHECK
 #include <asm/native/pvchk_inst.h>
-#elif defined(__IA64_ASM_PARAVIRTUALIZED_XEN)
-#include <asm/xen/inst.h>
-#include <asm/xen/minstate.h>
 #else
 #include <asm/native/inst.h>
 #endif
diff --git a/arch/ia64/kernel/paravirt_patchlist.h b/arch/ia64/kernel/paravirt_patchlist.h
index 0684aa6c6507..67cffc3643a3 100644
--- a/arch/ia64/kernel/paravirt_patchlist.h
+++ b/arch/ia64/kernel/paravirt_patchlist.h
@@ -20,9 +20,5 @@
 *
 */
-#if defined(__IA64_GATE_PARAVIRTUALIZED_XEN)
-#include <asm/xen/patchlist.h>
-#else
 #include <asm/native/patchlist.h>
-#endif
diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
index 0ccb28fab27e..84f8a52ac5ae 100644
--- a/arch/ia64/kernel/vmlinux.lds.S
+++ b/arch/ia64/kernel/vmlinux.lds.S
@@ -182,12 +182,6 @@ SECTIONS {
                __start_gate_section = .;
                *(.data..gate)
                __stop_gate_section = .;
-#ifdef CONFIG_XEN
-                . = ALIGN(PAGE_SIZE);
-                __xen_start_gate_section = .;
-                *(.data..gate.xen)
-                __xen_stop_gate_section = .;
-#endif
        }
        /*
         * make sure the gate page doesn't expose
diff --git a/arch/ia64/xen/Kconfig b/arch/ia64/xen/Kconfig
deleted file mode 100644
index 5d8a06b0ddf7..000000000000
--- a/arch/ia64/xen/Kconfig
+++ /dev/null
@@ -1,25 +0,0 @@
-#
-# This Kconfig describes xen/ia64 options
-#
-config XEN
-        bool "Xen hypervisor support"
-        default y
-        depends on PARAVIRT && MCKINLEY && IA64_PAGE_SIZE_16KB
-        select XEN_XENCOMM
-        select NO_IDLE_HZ
-        # followings are required to save/restore.
-        select ARCH_SUSPEND_POSSIBLE
-        select SUSPEND
-        select PM_SLEEP
-        help
-          Enable Xen hypervisor support.  Resulting kernel runs
-          both as a guest OS on Xen and natively on hardware.
-config XEN_XENCOMM
-        depends on XEN
-        bool
-config NO_IDLE_HZ
-        depends on XEN
-        bool
diff --git a/arch/ia64/xen/Makefile b/arch/ia64/xen/Makefile
deleted file mode 100644
index e6f4a0a74228..000000000000
--- a/arch/ia64/xen/Makefile
+++ /dev/null
@@ -1,37 +0,0 @@
-#
-# Makefile for Xen components
-#
-obj-y := hypercall.o xenivt.o xensetup.o xen_pv_ops.o irq_xen.o \
-         hypervisor.o xencomm.o xcom_hcall.o grant-table.o time.o suspend.o \
-         gate-data.o
-obj-$(CONFIG_IA64_GENERIC) += machvec.o
-# The gate DSO image is built using a special linker script.
-include $(srctree)/arch/ia64/kernel/Makefile.gate
-# tell compiled for xen
-CPPFLAGS_gate.lds += -D__IA64_GATE_PARAVIRTUALIZED_XEN
-AFLAGS_gate.o += -D__IA64_ASM_PARAVIRTUALIZED_XEN -D__IA64_GATE_PARAVIRTUALIZED_XEN
-# use same file of native.
-$(obj)/gate.o: $(src)/../kernel/gate.S FORCE
-        $(call if_changed_dep,as_o_S)
-$(obj)/gate.lds: $(src)/../kernel/gate.lds.S FORCE
-        $(call if_changed_dep,cpp_lds_S)
-AFLAGS_xenivt.o += -D__IA64_ASM_PARAVIRTUALIZED_XEN
-# xen multi compile
-ASM_PARAVIRT_MULTI_COMPILE_SRCS = ivt.S entry.S fsys.S
-ASM_PARAVIRT_OBJS = $(addprefix xen-,$(ASM_PARAVIRT_MULTI_COMPILE_SRCS:.S=.o))
-obj-y += $(ASM_PARAVIRT_OBJS)
-define paravirtualized_xen
-AFLAGS_$(1) += -D__IA64_ASM_PARAVIRTUALIZED_XEN
-endef
-$(foreach o,$(ASM_PARAVIRT_OBJS),$(eval $(call paravirtualized_xen,$(o))))
-$(obj)/xen-%.o: $(src)/../kernel/%.S FORCE
-        $(call if_changed_dep,as_o_S)
diff --git a/arch/ia64/xen/gate-data.S b/arch/ia64/xen/gate-data.S
deleted file mode 100644
index 6f95b6b32a4e..000000000000
--- a/arch/ia64/xen/gate-data.S
+++ /dev/null
@@ -1,3 +0,0 @@
-        .section .data..gate.xen, "aw"
-        .incbin "arch/ia64/xen/gate.so"
diff --git a/arch/ia64/xen/grant-table.c b/arch/ia64/xen/grant-table.c
deleted file mode 100644
index c18281332f84..000000000000
--- a/arch/ia64/xen/grant-table.c
+++ /dev/null
@@ -1,94 +0,0 @@
-/******************************************************************************
- * arch/ia64/xen/grant-table.c
- *
- * Copyright (c) 2006 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-#include <linux/module.h>
-#include <linux/vmalloc.h>
-#include <linux/slab.h>
-#include <linux/mm.h>
-#include <xen/interface/xen.h>
-#include <xen/interface/memory.h>
-#include <xen/grant_table.h>
-#include <asm/xen/hypervisor.h>
-/****************************************************************************
- * grant table hack
- * cmd: GNTTABOP_xxx
- */
-int arch_gnttab_map_shared(unsigned long *frames, unsigned long nr_gframes,
-                           unsigned long max_nr_gframes,
-                           struct grant_entry **__shared)
-{
-        *__shared = __va(frames[0] << PAGE_SHIFT);
-        return 0;
-}
-void arch_gnttab_unmap_shared(struct grant_entry *shared,
-                              unsigned long nr_gframes)
-{
-        /* nothing */
-}
-static void
-gnttab_map_grant_ref_pre(struct gnttab_map_grant_ref *uop)
-{
-        uint32_t flags;
-        flags = uop->flags;
-        if (flags & GNTMAP_host_map) {
-                if (flags & GNTMAP_application_map) {
-                        printk(KERN_DEBUG
-                               "GNTMAP_application_map is not supported yet: "
-                               "flags 0x%x\n", flags);
-                        BUG();
-                }
-                if (flags & GNTMAP_contains_pte) {
-                        printk(KERN_DEBUG
-                               "GNTMAP_contains_pte is not supported yet: "
-                               "flags 0x%x\n", flags);
-                        BUG();
-                }
-        } else if (flags & GNTMAP_device_map) {
-                printk("GNTMAP_device_map is not supported yet 0x%x\n", flags);
-                BUG();  /* not yet. actually this flag is not used. */
-        } else {
-                BUG();
-        }
-}
-int
-HYPERVISOR_grant_table_op(unsigned int cmd, void *uop, unsigned int count)
-{
-        if (cmd == GNTTABOP_map_grant_ref) {
-                unsigned int i;
-                for (i = 0; i < count; i++) {
-                        gnttab_map_grant_ref_pre(
-                                (struct gnttab_map_grant_ref *)uop + i);
-                }
-        }
-        return xencomm_hypercall_grant_table_op(cmd, uop, count);
-}
-EXPORT_SYMBOL(HYPERVISOR_grant_table_op);
diff --git a/arch/ia64/xen/hypercall.S b/arch/ia64/xen/hypercall.S
deleted file mode 100644
index 08847aa12583..000000000000
--- a/arch/ia64/xen/hypercall.S
+++ /dev/null
@@ -1,88 +0,0 @@
-/*
- * Support routines for Xen hypercalls
- *
- * Copyright (C) 2005 Dan Magenheimer <dan.magenheimer@hp.com>
- * Copyright (C) 2008 Yaozu (Eddie) Dong <eddie.dong@intel.com>
- */
-#include <asm/asmmacro.h>
-#include <asm/intrinsics.h>
-#include <asm/xen/privop.h>
-#ifdef __INTEL_COMPILER
-/*
- * Hypercalls without parameter.
- */
-#define __HCALL0(name,hcall)            \
-        GLOBAL_ENTRY(name);             \
-        break   hcall;                  \
-        br.ret.sptk.many rp;            \
-        END(name)
-/*
- * Hypercalls with 1 parameter.
- */
-#define __HCALL1(name,hcall)            \
-        GLOBAL_ENTRY(name);             \
-        mov r8=r32;                     \
-        break   hcall;                  \
-        br.ret.sptk.many rp;            \
-        END(name)
-/*
- * Hypercalls with 2 parameters.
- */
-#define __HCALL2(name,hcall)            \
-        GLOBAL_ENTRY(name);             \
-        mov r8=r32;                     \
-        mov r9=r33;                     \
-        break   hcall;                  \
-        br.ret.sptk.many rp;            \
-        END(name)
-__HCALL0(xen_get_psr, HYPERPRIVOP_GET_PSR)
-__HCALL0(xen_get_ivr, HYPERPRIVOP_GET_IVR)
-__HCALL0(xen_get_tpr, HYPERPRIVOP_GET_TPR)
-__HCALL0(xen_hyper_ssm_i, HYPERPRIVOP_SSM_I)
-__HCALL1(xen_set_tpr, HYPERPRIVOP_SET_TPR)
-__HCALL1(xen_eoi, HYPERPRIVOP_EOI)
-__HCALL1(xen_thash, HYPERPRIVOP_THASH)
-__HCALL1(xen_set_itm, HYPERPRIVOP_SET_ITM)
-__HCALL1(xen_get_rr, HYPERPRIVOP_GET_RR)
-__HCALL1(xen_fc, HYPERPRIVOP_FC)
-__HCALL1(xen_get_cpuid, HYPERPRIVOP_GET_CPUID)
-__HCALL1(xen_get_pmd, HYPERPRIVOP_GET_PMD)
-__HCALL2(xen_ptcga, HYPERPRIVOP_PTC_GA)
-__HCALL2(xen_set_rr, HYPERPRIVOP_SET_RR)
-__HCALL2(xen_set_kr, HYPERPRIVOP_SET_KR)
-GLOBAL_ENTRY(xen_set_rr0_to_rr4)
-        mov r8=r32
-        mov r9=r33
-        mov r10=r34
-        mov r11=r35
-        mov r14=r36
-        XEN_HYPER_SET_RR0_TO_RR4
-        br.ret.sptk.many rp
-        ;;
-END(xen_set_rr0_to_rr4)
-#endif
-GLOBAL_ENTRY(xen_send_ipi)
-        mov r14=r32
-        mov r15=r33
-        mov r2=0x400
-        break 0x1000
-        ;;
-        br.ret.sptk.many rp
-        ;;
-END(xen_send_ipi)
-GLOBAL_ENTRY(__hypercall)
-        mov r2=r37
-        break 0x1000
-        br.ret.sptk.many b0
-        ;;
-END(__hypercall)
diff --git a/arch/ia64/xen/hypervisor.c b/arch/ia64/xen/hypervisor.c
deleted file mode 100644
index fab62528a80b..000000000000
--- a/arch/ia64/xen/hypervisor.c
+++ /dev/null
@@ -1,97 +0,0 @@
-/******************************************************************************
- * arch/ia64/xen/hypervisor.c
- *
- * Copyright (c) 2006 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-#include <linux/efi.h>
-#include <linux/export.h>
-#include <asm/xen/hypervisor.h>
-#include <asm/xen/privop.h>
-#include "irq_xen.h"
-struct shared_info *HYPERVISOR_shared_info __read_mostly =
-        (struct shared_info *)XSI_BASE;
-EXPORT_SYMBOL(HYPERVISOR_shared_info);
-DEFINE_PER_CPU(struct vcpu_info *, xen_vcpu);
-struct start_info *xen_start_info;
-EXPORT_SYMBOL(xen_start_info);
-EXPORT_SYMBOL(xen_domain_type);
-EXPORT_SYMBOL(__hypercall);
-/* Stolen from arch/x86/xen/enlighten.c */
-/*
- * Flag to determine whether vcpu info placement is available on all
- * VCPUs.  We assume it is to start with, and then set it to zero on
- * the first failure.  This is because it can succeed on some VCPUs
- * and not others, since it can involve hypervisor memory allocation,
- * or because the guest failed to guarantee all the appropriate
- * constraints on all VCPUs (ie buffer can't cross a page boundary).
- *
- * Note that any particular CPU may be using a placed vcpu structure,
- * but we can only optimise if the all are.
- *
- * 0: not available, 1: available
- */
-static void __init xen_vcpu_setup(int cpu)
-{
-        /*
-         * WARNING:
-         * before changing MAX_VIRT_CPUS,
-         * check that shared_info fits on a page
-         */
-        BUILD_BUG_ON(sizeof(struct shared_info) > PAGE_SIZE);
-        per_cpu(xen_vcpu, cpu) = &HYPERVISOR_shared_info->vcpu_info[cpu];
-}
-void __init xen_setup_vcpu_info_placement(void)
-{
-        int cpu;
-        for_each_possible_cpu(cpu)
-                xen_vcpu_setup(cpu);
-}
-void
-xen_cpu_init(void)
-{
-        xen_smp_intr_init();
-}
-/**************************************************************************
- * opt feature
- */
-void
-xen_ia64_enable_opt_feature(void)
-{
-        /* Enable region 7 identity map optimizations in Xen */
-        struct xen_ia64_opt_feature optf;
-        optf.cmd = XEN_IA64_OPTF_IDENT_MAP_REG7;
-        optf.on = XEN_IA64_OPTF_ON;
-        optf.pgprot = pgprot_val(PAGE_KERNEL);
-        optf.key = 0;   /* No key on linux. */
-        HYPERVISOR_opt_feature(&optf);
-}
diff --git a/arch/ia64/xen/irq_xen.c b/arch/ia64/xen/irq_xen.c
deleted file mode 100644
index efb74dafec4d..000000000000
--- a/arch/ia64/xen/irq_xen.c
+++ /dev/null
@@ -1,443 +0,0 @@
-/******************************************************************************
- * arch/ia64/xen/irq_xen.c
- *
- * Copyright (c) 2008 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-#include <linux/cpu.h>
-#include <xen/interface/xen.h>
-#include <xen/interface/callback.h>
-#include <xen/events.h>
-#include <asm/xen/privop.h>
-#include "irq_xen.h"
-/***************************************************************************
- * pv_irq_ops
- * irq operations
- */
-static int
-xen_assign_irq_vector(int irq)
-{
-        struct physdev_irq irq_op;
-        irq_op.irq = irq;
-        if (HYPERVISOR_physdev_op(PHYSDEVOP_alloc_irq_vector, &irq_op))
-                return -ENOSPC;
-        return irq_op.vector;
-}
-static void
-xen_free_irq_vector(int vector)
-{
-        struct physdev_irq irq_op;
-        if (vector < IA64_FIRST_DEVICE_VECTOR ||
-            vector > IA64_LAST_DEVICE_VECTOR)
-                return;
-        irq_op.vector = vector;
-        if (HYPERVISOR_physdev_op(PHYSDEVOP_free_irq_vector, &irq_op))
-                printk(KERN_WARNING "%s: xen_free_irq_vector fail vector=%d\n",
-                       __func__, vector);
-}
-static DEFINE_PER_CPU(int, xen_timer_irq) = -1;
-static DEFINE_PER_CPU(int, xen_ipi_irq) = -1;
-static DEFINE_PER_CPU(int, xen_resched_irq) = -1;
-static DEFINE_PER_CPU(int, xen_cmc_irq) = -1;
-static DEFINE_PER_CPU(int, xen_cmcp_irq) = -1;
-static DEFINE_PER_CPU(int, xen_cpep_irq) = -1;
-#define NAME_SIZE       15
-static DEFINE_PER_CPU(char[NAME_SIZE], xen_timer_name);
-static DEFINE_PER_CPU(char[NAME_SIZE], xen_ipi_name);
-static DEFINE_PER_CPU(char[NAME_SIZE], xen_resched_name);
-static DEFINE_PER_CPU(char[NAME_SIZE], xen_cmc_name);
-static DEFINE_PER_CPU(char[NAME_SIZE], xen_cmcp_name);
-static DEFINE_PER_CPU(char[NAME_SIZE], xen_cpep_name);
-#undef NAME_SIZE
-struct saved_irq {
-        unsigned int irq;
-        struct irqaction *action;
-};
-/* 16 should be far optimistic value, since only several percpu irqs
- * are registered early.
- */
-#define MAX_LATE_IRQ    16
-static struct saved_irq saved_percpu_irqs[MAX_LATE_IRQ];
-static unsigned short late_irq_cnt;
-static unsigned short saved_irq_cnt;
-static int xen_slab_ready;
-#ifdef CONFIG_SMP
-#include <linux/sched.h>
-/* Dummy stub. Though we may check XEN_RESCHEDULE_VECTOR before __do_IRQ,
- * it ends up to issue several memory accesses upon percpu data and
- * thus adds unnecessary traffic to other paths.
- */
-static irqreturn_t
-xen_dummy_handler(int irq, void *dev_id)
-{
-        return IRQ_HANDLED;
-}
-static irqreturn_t
-xen_resched_handler(int irq, void *dev_id)
-{
-        scheduler_ipi();
-        return IRQ_HANDLED;
-}
-static struct irqaction xen_ipi_irqaction = {
-        .handler =      handle_IPI,
-        .flags =        IRQF_DISABLED,
-        .name =         "IPI"
-};
-static struct irqaction xen_resched_irqaction = {
-        .handler =      xen_resched_handler,
-        .flags =        IRQF_DISABLED,
-        .name =         "resched"
-};
-static struct irqaction xen_tlb_irqaction = {
-        .handler =      xen_dummy_handler,
-        .flags =        IRQF_DISABLED,
-        .name =         "tlb_flush"
-};
-#endif
-/*
- * This is xen version percpu irq registration, which needs bind
- * to xen specific evtchn sub-system. One trick here is that xen
- * evtchn binding interface depends on kmalloc because related
- * port needs to be freed at device/cpu down. So we cache the
- * registration on BSP before slab is ready and then deal them
- * at later point. For rest instances happening after slab ready,
- * we hook them to xen evtchn immediately.
- *
- * FIXME: MCA is not supported by far, and thus "nomca" boot param is
- * required.
- */
-static void
-__xen_register_percpu_irq(unsigned int cpu, unsigned int vec,
-                        struct irqaction *action, int save)
-{
-        int irq = 0;
-        if (xen_slab_ready) {
-                switch (vec) {
-                case IA64_TIMER_VECTOR:
-                        snprintf(per_cpu(xen_timer_name, cpu),
-                                 sizeof(per_cpu(xen_timer_name, cpu)),
-                                 "%s%d", action->name, cpu);
-                        irq = bind_virq_to_irqhandler(VIRQ_ITC, cpu,
-                                action->handler, action->flags,
-                                per_cpu(xen_timer_name, cpu), action->dev_id);
-                        per_cpu(xen_timer_irq, cpu) = irq;
-                        break;
-                case IA64_IPI_RESCHEDULE:
-                        snprintf(per_cpu(xen_resched_name, cpu),
-                                 sizeof(per_cpu(xen_resched_name, cpu)),
-                                 "%s%d", action->name, cpu);
-                        irq = bind_ipi_to_irqhandler(XEN_RESCHEDULE_VECTOR, cpu,
-                                action->handler, action->flags,
-                                per_cpu(xen_resched_name, cpu), action->dev_id);
-                        per_cpu(xen_resched_irq, cpu) = irq;
-                        break;
-                case IA64_IPI_VECTOR:
-                        snprintf(per_cpu(xen_ipi_name, cpu),
-                                 sizeof(per_cpu(xen_ipi_name, cpu)),
-                                 "%s%d", action->name, cpu);
-                        irq = bind_ipi_to_irqhandler(XEN_IPI_VECTOR, cpu,
-                                action->handler, action->flags,
-                                per_cpu(xen_ipi_name, cpu), action->dev_id);
-                        per_cpu(xen_ipi_irq, cpu) = irq;
-                        break;
-                case IA64_CMC_VECTOR:
-                        snprintf(per_cpu(xen_cmc_name, cpu),
-                                 sizeof(per_cpu(xen_cmc_name, cpu)),
-                                 "%s%d", action->name, cpu);
-                        irq = bind_virq_to_irqhandler(VIRQ_MCA_CMC, cpu,
-                                                action->handler,
-                                                action->flags,
-                                                per_cpu(xen_cmc_name, cpu),
-                                                action->dev_id);
-                        per_cpu(xen_cmc_irq, cpu) = irq;
-                        break;
-                case IA64_CMCP_VECTOR:
-                        snprintf(per_cpu(xen_cmcp_name, cpu),
-                                 sizeof(per_cpu(xen_cmcp_name, cpu)),
-                                 "%s%d", action->name, cpu);
-                        irq = bind_ipi_to_irqhandler(XEN_CMCP_VECTOR, cpu,
-                                                action->handler,
-                                                action->flags,
-                                                per_cpu(xen_cmcp_name, cpu),
-                                                action->dev_id);
-                        per_cpu(xen_cmcp_irq, cpu) = irq;
-                        break;
-                case IA64_CPEP_VECTOR:
-                        snprintf(per_cpu(xen_cpep_name, cpu),
-                                 sizeof(per_cpu(xen_cpep_name, cpu)),
-                                 "%s%d", action->name, cpu);
-                        irq = bind_ipi_to_irqhandler(XEN_CPEP_VECTOR, cpu,
-                                                action->handler,
-                                                action->flags,
-                                                per_cpu(xen_cpep_name, cpu),
-                                                action->dev_id);
-                        per_cpu(xen_cpep_irq, cpu) = irq;
-                        break;
-                case IA64_CPE_VECTOR:
-                case IA64_MCA_RENDEZ_VECTOR:
-                case IA64_PERFMON_VECTOR:
-                case IA64_MCA_WAKEUP_VECTOR:
-                case IA64_SPURIOUS_INT_VECTOR:
-                        /* No need to complain, these aren't supported. */
-                        break;
-                default:
-                        printk(KERN_WARNING "Percpu irq %d is unsupported "
-                               "by xen!\n", vec);
-                        break;
-                }
-                BUG_ON(irq < 0);
-                if (irq > 0) {
-                        /*
-                         * Mark percpu.  Without this, migrate_irqs() will
-                         * mark the interrupt for migrations and trigger it
-                         * on cpu hotplug.
-                         */
-                        irq_set_status_flags(irq, IRQ_PER_CPU);
-                }
-        }
-        /* For BSP, we cache registered percpu irqs, and then re-walk
-         * them when initializing APs
-         */
-        if (!cpu && save) {
-                BUG_ON(saved_irq_cnt == MAX_LATE_IRQ);
-                saved_percpu_irqs[saved_irq_cnt].irq = vec;
-                saved_percpu_irqs[saved_irq_cnt].action = action;
-                saved_irq_cnt++;
-                if (!xen_slab_ready)
-                        late_irq_cnt++;
-        }
-}
-static void
-xen_register_percpu_irq(ia64_vector vec, struct irqaction *action)
-{
-        __xen_register_percpu_irq(smp_processor_id(), vec, action, 1);
-}
-static void
-xen_bind_early_percpu_irq(void)
-{
-        int i;
-        xen_slab_ready = 1;
-        /* There's no race when accessing this cached array, since only
-         * BSP will face with such step shortly
-         */
-        for (i = 0; i < late_irq_cnt; i++)
-                __xen_register_percpu_irq(smp_processor_id(),
-                                          saved_percpu_irqs[i].irq,
-                                          saved_percpu_irqs[i].action, 0);
-}
-/* FIXME: There's no obvious point to check whether slab is ready. So
- * a hack is used here by utilizing a late time hook.
- */
-#ifdef CONFIG_HOTPLUG_CPU
-static int unbind_evtchn_callback(struct notifier_block *nfb,
-                                  unsigned long action, void *hcpu)
-{
-        unsigned int cpu = (unsigned long)hcpu;
-        if (action == CPU_DEAD) {
-                /* Unregister evtchn.  */
-                if (per_cpu(xen_cpep_irq, cpu) >= 0) {
-                        unbind_from_irqhandler(per_cpu(xen_cpep_irq, cpu),
-                                               NULL);
-                        per_cpu(xen_cpep_irq, cpu) = -1;
-                }
-                if (per_cpu(xen_cmcp_irq, cpu) >= 0) {
-                        unbind_from_irqhandler(per_cpu(xen_cmcp_irq, cpu),
-                                               NULL);
-                        per_cpu(xen_cmcp_irq, cpu) = -1;
-                }
-                if (per_cpu(xen_cmc_irq, cpu) >= 0) {
-                        unbind_from_irqhandler(per_cpu(xen_cmc_irq, cpu), NULL);
-                        per_cpu(xen_cmc_irq, cpu) = -1;
-                }
-                if (per_cpu(xen_ipi_irq, cpu) >= 0) {
-                        unbind_from_irqhandler(per_cpu(xen_ipi_irq, cpu), NULL);
-                        per_cpu(xen_ipi_irq, cpu) = -1;
-                }
-                if (per_cpu(xen_resched_irq, cpu) >= 0) {
-                        unbind_from_irqhandler(per_cpu(xen_resched_irq, cpu),
-                                               NULL);
-                        per_cpu(xen_resched_irq, cpu) = -1;
-                }
-                if (per_cpu(xen_timer_irq, cpu) >= 0) {
-                        unbind_from_irqhandler(per_cpu(xen_timer_irq, cpu),
-                                               NULL);
-                        per_cpu(xen_timer_irq, cpu) = -1;
-                }
-        }
-        return NOTIFY_OK;
-}
-static struct notifier_block unbind_evtchn_notifier = {
-        .notifier_call = unbind_evtchn_callback,
-        .priority = 0
-};
-#endif
-void xen_smp_intr_init_early(unsigned int cpu)
-{
-#ifdef CONFIG_SMP
-        unsigned int i;
-        for (i = 0; i < saved_irq_cnt; i++)
-                __xen_register_percpu_irq(cpu, saved_percpu_irqs[i].irq,
-                                          saved_percpu_irqs[i].action, 0);
-#endif
-}
-void xen_smp_intr_init(void)
-{
-#ifdef CONFIG_SMP
-        unsigned int cpu = smp_processor_id();
-        struct callback_register event = {
-                .type = CALLBACKTYPE_event,
-                .address = { .ip = (unsigned long)&xen_event_callback },
-        };
-        if (cpu == 0) {
-                /* Initialization was already done for boot cpu.  */
-#ifdef CONFIG_HOTPLUG_CPU
-                /* Register the notifier only once.  */
-                register_cpu_notifier(&unbind_evtchn_notifier);
-#endif
-                return;
-        }
-        /* This should be piggyback when setup vcpu guest context */
-        BUG_ON(HYPERVISOR_callback_op(CALLBACKOP_register, &event));
-#endif /* CONFIG_SMP */
-}
-void __init
-xen_irq_init(void)
-{
-        struct callback_register event = {
-                .type = CALLBACKTYPE_event,
-                .address = { .ip = (unsigned long)&xen_event_callback },
-        };
-        xen_init_IRQ();
-        BUG_ON(HYPERVISOR_callback_op(CALLBACKOP_register, &event));
-        late_time_init = xen_bind_early_percpu_irq;
-}
-void
-xen_platform_send_ipi(int cpu, int vector, int delivery_mode, int redirect)
-{
-#ifdef CONFIG_SMP
-        /* TODO: we need to call vcpu_up here */
-        if (unlikely(vector == ap_wakeup_vector)) {
-                /* XXX
-                 * This should be in __cpu_up(cpu) in ia64 smpboot.c
-                 * like x86. But don't want to modify it,
-                 * keep it untouched.
-                 */
-                xen_smp_intr_init_early(cpu);
-                xen_send_ipi(cpu, vector);
-                /* vcpu_prepare_and_up(cpu); */
-                return;
-        }
-#endif
-        switch (vector) {
-        case IA64_IPI_VECTOR:
-                xen_send_IPI_one(cpu, XEN_IPI_VECTOR);
-                break;
-        case IA64_IPI_RESCHEDULE:
-                xen_send_IPI_one(cpu, XEN_RESCHEDULE_VECTOR);
-                break;
-        case IA64_CMCP_VECTOR:
-                xen_send_IPI_one(cpu, XEN_CMCP_VECTOR);
-                break;
-        case IA64_CPEP_VECTOR:
-                xen_send_IPI_one(cpu, XEN_CPEP_VECTOR);
-                break;
-        case IA64_TIMER_VECTOR: {
-                /* this is used only once by check_sal_cache_flush()
-                   at boot time */
-                static int used = 0;
-                if (!used) {
-                        xen_send_ipi(cpu, IA64_TIMER_VECTOR);
-                        used = 1;
-                        break;
-                }
-                /* fallthrough */
-        }
-        default:
-                printk(KERN_WARNING "Unsupported IPI type 0x%x\n",
-                       vector);
-                notify_remote_via_irq(0); /* defaults to 0 irq */
-                break;
-        }
-}
-static void __init
-xen_register_ipi(void)
-{
-#ifdef CONFIG_SMP
-        register_percpu_irq(IA64_IPI_VECTOR, &xen_ipi_irqaction);
-        register_percpu_irq(IA64_IPI_RESCHEDULE, &xen_resched_irqaction);
-        register_percpu_irq(IA64_IPI_LOCAL_TLB_FLUSH, &xen_tlb_irqaction);
-#endif
-}
-static void
-xen_resend_irq(unsigned int vector)
-{
-        (void)resend_irq_on_evtchn(vector);
-}
-const struct pv_irq_ops xen_irq_ops __initconst = {
-        .register_ipi = xen_register_ipi,
-        .assign_irq_vector = xen_assign_irq_vector,
-        .free_irq_vector = xen_free_irq_vector,
-        .register_percpu_irq = xen_register_percpu_irq,
-        .resend_irq = xen_resend_irq,
-};
diff --git a/arch/ia64/xen/irq_xen.h b/arch/ia64/xen/irq_xen.h
deleted file mode 100644
index 1778517b90fe..000000000000
--- a/arch/ia64/xen/irq_xen.h
+++ /dev/null
@@ -1,34 +0,0 @@
-/******************************************************************************
- * arch/ia64/xen/irq_xen.h
- *
- * Copyright (c) 2008 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-#ifndef IRQ_XEN_H
-#define IRQ_XEN_H
-extern void (*late_time_init)(void);
-extern char xen_event_callback;
-void __init xen_init_IRQ(void);
-extern const struct pv_irq_ops xen_irq_ops __initconst;
-extern void xen_smp_intr_init(void);
-extern void xen_send_ipi(int cpu, int vec);
-#endif /* IRQ_XEN_H */
diff --git a/arch/ia64/xen/machvec.c b/arch/ia64/xen/machvec.c
deleted file mode 100644
index 4ad588a7c279..000000000000
--- a/arch/ia64/xen/machvec.c
+++ /dev/null
@@ -1,4 +0,0 @@
-#define MACHVEC_PLATFORM_NAME           xen
-#define MACHVEC_PLATFORM_HEADER         <asm/machvec_xen.h>
-#include <asm/machvec_init.h>
diff --git a/arch/ia64/xen/suspend.c b/arch/ia64/xen/suspend.c
deleted file mode 100644
index 419c8620945a..000000000000
--- a/arch/ia64/xen/suspend.c
+++ /dev/null
@@ -1,59 +0,0 @@
-/******************************************************************************
- * arch/ia64/xen/suspend.c
- *
- * Copyright (c) 2008 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- * suspend/resume
- */
-#include <xen/xen-ops.h>
-#include <asm/xen/hypervisor.h>
-#include "time.h"
-void
-xen_mm_pin_all(void)
-{
-        /* nothing */
-}
-void
-xen_mm_unpin_all(void)
-{
-        /* nothing */
-}
-void
-xen_arch_pre_suspend()
-{
-        /* nothing */
-}
-void
-xen_arch_post_suspend(int suspend_cancelled)
-{
-        if (suspend_cancelled)
-                return;
-        xen_ia64_enable_opt_feature();
-        /* add more if necessary */
-}
-void xen_arch_resume(void)
-{
-        xen_timer_resume_on_aps();
-}
diff --git a/arch/ia64/xen/time.c b/arch/ia64/xen/time.c
deleted file mode 100644
index 1f8244a78bee..000000000000
--- a/arch/ia64/xen/time.c
+++ /dev/null
@@ -1,257 +0,0 @@
-/******************************************************************************
- * arch/ia64/xen/time.c
- *
- * Copyright (c) 2008 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-#include <linux/delay.h>
-#include <linux/kernel_stat.h>
-#include <linux/posix-timers.h>
-#include <linux/irq.h>
-#include <linux/clocksource.h>
-#include <asm/timex.h>
-#include <asm/xen/hypervisor.h>
-#include <xen/interface/vcpu.h>
-#include "../kernel/fsyscall_gtod_data.h"
-static DEFINE_PER_CPU(struct vcpu_runstate_info, xen_runstate);
-static DEFINE_PER_CPU(unsigned long, xen_stolen_time);
-static DEFINE_PER_CPU(unsigned long, xen_blocked_time);
-/* taken from i386/kernel/time-xen.c */
-static void xen_init_missing_ticks_accounting(int cpu)
-{
-        struct vcpu_register_runstate_memory_area area;
-        struct vcpu_runstate_info *runstate = &per_cpu(xen_runstate, cpu);
-        int rc;
-        memset(runstate, 0, sizeof(*runstate));
-        area.addr.v = runstate;
-        rc = HYPERVISOR_vcpu_op(VCPUOP_register_runstate_memory_area, cpu,
-                                &area);
-        WARN_ON(rc && rc != -ENOSYS);
-        per_cpu(xen_blocked_time, cpu) = runstate->time[RUNSTATE_blocked];
-        per_cpu(xen_stolen_time, cpu) = runstate->time[RUNSTATE_runnable]
-                                            + runstate->time[RUNSTATE_offline];
-}
-/*
- * Runstate accounting
- */
-/* stolen from arch/x86/xen/time.c */
-static void get_runstate_snapshot(struct vcpu_runstate_info *res)
-{
-        u64 state_time;
-        struct vcpu_runstate_info *state;
-        BUG_ON(preemptible());
-        state = &__get_cpu_var(xen_runstate);
-        /*
-         * The runstate info is always updated by the hypervisor on
-         * the current CPU, so there's no need to use anything
-         * stronger than a compiler barrier when fetching it.
-         */
-        do {
-                state_time = state->state_entry_time;
-                rmb();
-                *res = *state;
-                rmb();
-        } while (state->state_entry_time != state_time);
-}
-#define NS_PER_TICK (1000000000LL/HZ)
-static unsigned long
-consider_steal_time(unsigned long new_itm)
-{
-        unsigned long stolen, blocked;
-        unsigned long delta_itm = 0, stolentick = 0;
-        int cpu = smp_processor_id();
-        struct vcpu_runstate_info runstate;
-        struct task_struct *p = current;
-        get_runstate_snapshot(&runstate);
-        /*
-         * Check for vcpu migration effect
-         * In this case, itc value is reversed.
-         * This causes huge stolen value.
-         * This function just checks and reject this effect.
-         */
-        if (!time_after_eq(runstate.time[RUNSTATE_blocked],
-                           per_cpu(xen_blocked_time, cpu)))
-                blocked = 0;
-        if (!time_after_eq(runstate.time[RUNSTATE_runnable] +
-                           runstate.time[RUNSTATE_offline],
-                           per_cpu(xen_stolen_time, cpu)))
-                stolen = 0;
-        if (!time_after(delta_itm + new_itm, ia64_get_itc()))
-                stolentick = ia64_get_itc() - new_itm;
-        do_div(stolentick, NS_PER_TICK);
-        stolentick++;
-        do_div(stolen, NS_PER_TICK);
-        if (stolen > stolentick)
-                stolen = stolentick;
-        stolentick -= stolen;
-        do_div(blocked, NS_PER_TICK);
-        if (blocked > stolentick)
-                blocked = stolentick;
-        if (stolen > 0 || blocked > 0) {
-                account_steal_ticks(stolen);
-                account_idle_ticks(blocked);
-                run_local_timers();
-                rcu_check_callbacks(cpu, user_mode(get_irq_regs()));
-                scheduler_tick();
-                run_posix_cpu_timers(p);
-                delta_itm += local_cpu_data->itm_delta * (stolen + blocked);
-                if (cpu == time_keeper_id)
-                        xtime_update(stolen + blocked);
-                local_cpu_data->itm_next = delta_itm + new_itm;
-                per_cpu(xen_stolen_time, cpu) += NS_PER_TICK * stolen;
-                per_cpu(xen_blocked_time, cpu) += NS_PER_TICK * blocked;
-        }
-        return delta_itm;
-}
-static int xen_do_steal_accounting(unsigned long *new_itm)
-{
-        unsigned long delta_itm;
-        delta_itm = consider_steal_time(*new_itm);
-        *new_itm += delta_itm;
-        if (time_after(*new_itm, ia64_get_itc()) && delta_itm)
-                return 1;
-        return 0;
-}
-static void xen_itc_jitter_data_reset(void)
-{
-        u64 lcycle, ret;
-        do {
-                lcycle = itc_jitter_data.itc_lastcycle;
-                ret = cmpxchg(&itc_jitter_data.itc_lastcycle, lcycle, 0);
-        } while (unlikely(ret != lcycle));
-}
-/* based on xen_sched_clock() in arch/x86/xen/time.c. */
-/*
- * This relies on HAVE_UNSTABLE_SCHED_CLOCK. If it can't be defined,
- * something similar logic should be implemented here.
- */
-/*
- * Xen sched_clock implementation.  Returns the number of unstolen
- * nanoseconds, which is nanoseconds the VCPU spent in RUNNING+BLOCKED
- * states.
- */
-static unsigned long long xen_sched_clock(void)
-{
-        struct vcpu_runstate_info runstate;
-        unsigned long long now;
-        unsigned long long offset;
-        unsigned long long ret;
-        /*
-         * Ideally sched_clock should be called on a per-cpu basis
-         * anyway, so preempt should already be disabled, but that's
-         * not current practice at the moment.
-         */
-        preempt_disable();
-        /*
-         * both ia64_native_sched_clock() and xen's runstate are
-         * based on mAR.ITC. So difference of them makes sense.
-         */
-        now = ia64_native_sched_clock();
-        get_runstate_snapshot(&runstate);
-        WARN_ON(runstate.state != RUNSTATE_running);
-        offset = 0;
-        if (now > runstate.state_entry_time)
-                offset = now - runstate.state_entry_time;
-        ret = runstate.time[RUNSTATE_blocked] +
-                runstate.time[RUNSTATE_running] +
-                offset;
-        preempt_enable();
-        return ret;
-}
-struct pv_time_ops xen_time_ops __initdata = {
-        .init_missing_ticks_accounting  = xen_init_missing_ticks_accounting,
-        .do_steal_accounting            = xen_do_steal_accounting,
-        .clocksource_resume             = xen_itc_jitter_data_reset,
-        .sched_clock                    = xen_sched_clock,
-};
-/* Called after suspend, to resume time.  */
-static void xen_local_tick_resume(void)
-{
-        /* Just trigger a tick.  */
-        ia64_cpu_local_tick();
-        touch_softlockup_watchdog();
-}
-void
-xen_timer_resume(void)
-{
-        unsigned int cpu;
-        xen_local_tick_resume();
-        for_each_online_cpu(cpu)
-                xen_init_missing_ticks_accounting(cpu);
-}
-static void ia64_cpu_local_tick_fn(void *unused)
-{
-        xen_local_tick_resume();
-        xen_init_missing_ticks_accounting(smp_processor_id());
-}
-void
-xen_timer_resume_on_aps(void)
-{
-        smp_call_function(&ia64_cpu_local_tick_fn, NULL, 1);
-}
diff --git a/arch/ia64/xen/time.h b/arch/ia64/xen/time.h
deleted file mode 100644
index f98d7e1a42f0..000000000000
--- a/arch/ia64/xen/time.h
+++ /dev/null
@@ -1,24 +0,0 @@
-/******************************************************************************
- * arch/ia64/xen/time.h
- *
- * Copyright (c) 2008 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-extern struct pv_time_ops xen_time_ops __initdata;
-void xen_timer_resume_on_aps(void);
diff --git a/arch/ia64/xen/xcom_hcall.c b/arch/ia64/xen/xcom_hcall.c
deleted file mode 100644
index ccaf7431f7c8..000000000000
--- a/arch/ia64/xen/xcom_hcall.c
+++ /dev/null
@@ -1,441 +0,0 @@
-/*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- *
- *          Tristan Gingold <tristan.gingold@bull.net>
- *
- *          Copyright (c) 2007
- *          Isaku Yamahata <yamahata at valinux co jp>
- *                          VA Linux Systems Japan K.K.
- *          consolidate mini and inline version.
- */
-#include <linux/module.h>
-#include <xen/interface/xen.h>
-#include <xen/interface/memory.h>
-#include <xen/interface/grant_table.h>
-#include <xen/interface/callback.h>
-#include <xen/interface/vcpu.h>
-#include <asm/xen/hypervisor.h>
-#include <asm/xen/xencomm.h>
-/* Xencomm notes:
- * This file defines hypercalls to be used by xencomm.  The hypercalls simply
- * create inlines or mini descriptors for pointers and then call the raw arch
- * hypercall xencomm_arch_hypercall_XXX
- *
- * If the arch wants to directly use these hypercalls, simply define macros
- * in asm/xen/hypercall.h, eg:
- *  #define HYPERVISOR_sched_op xencomm_hypercall_sched_op
- *
- * The arch may also define HYPERVISOR_xxx as a function and do more operations
- * before/after doing the hypercall.
- *
- * Note: because only inline or mini descriptors are created these functions
- * must only be called with in kernel memory parameters.
- */
-int
-xencomm_hypercall_console_io(int cmd, int count, char *str)
-{
-        /* xen early printk uses console io hypercall before
-         * xencomm initialization. In that case, we just ignore it.
-         */
-        if (!xencomm_is_initialized())
-                return 0;
-        return xencomm_arch_hypercall_console_io
-                (cmd, count, xencomm_map_no_alloc(str, count));
-}
-EXPORT_SYMBOL_GPL(xencomm_hypercall_console_io);
-int
-xencomm_hypercall_event_channel_op(int cmd, void *op)
-{
-        struct xencomm_handle *desc;
-        desc = xencomm_map_no_alloc(op, sizeof(struct evtchn_op));
-        if (desc == NULL)
-                return -EINVAL;
-        return xencomm_arch_hypercall_event_channel_op(cmd, desc);
-}
-EXPORT_SYMBOL_GPL(xencomm_hypercall_event_channel_op);
-int
-xencomm_hypercall_xen_version(int cmd, void *arg)
-{
-        struct xencomm_handle *desc;
-        unsigned int argsize;
-        switch (cmd) {
-        case XENVER_version:
-                /* do not actually pass an argument */
-                return xencomm_arch_hypercall_xen_version(cmd, 0);
-        case XENVER_extraversion:
-                argsize = sizeof(struct xen_extraversion);
-                break;
-        case XENVER_compile_info:
-                argsize = sizeof(struct xen_compile_info);
-                break;
-        case XENVER_capabilities:
-                argsize = sizeof(struct xen_capabilities_info);
-                break;
-        case XENVER_changeset:
-                argsize = sizeof(struct xen_changeset_info);
-                break;
-        case XENVER_platform_parameters:
-                argsize = sizeof(struct xen_platform_parameters);
-                break;
-        case XENVER_get_features:
-                argsize = (arg == NULL) ? 0 : sizeof(struct xen_feature_info);
-                break;
-        default:
-                printk(KERN_DEBUG
-                       "%s: unknown version op %d\n", __func__, cmd);
-                return -ENOSYS;
-        }
-        desc = xencomm_map_no_alloc(arg, argsize);
-        if (desc == NULL)
-                return -EINVAL;
-        return xencomm_arch_hypercall_xen_version(cmd, desc);
-}
-EXPORT_SYMBOL_GPL(xencomm_hypercall_xen_version);
-int
-xencomm_hypercall_physdev_op(int cmd, void *op)
-{
-        unsigned int argsize;
-        switch (cmd) {
-        case PHYSDEVOP_apic_read:
-        case PHYSDEVOP_apic_write:
-                argsize = sizeof(struct physdev_apic);
-                break;
-        case PHYSDEVOP_alloc_irq_vector:
-        case PHYSDEVOP_free_irq_vector:
-                argsize = sizeof(struct physdev_irq);
-                break;
-        case PHYSDEVOP_irq_status_query:
-                argsize = sizeof(struct physdev_irq_status_query);
-                break;
-        default:
-                printk(KERN_DEBUG
-                       "%s: unknown physdev op %d\n", __func__, cmd);
-                return -ENOSYS;
-        }
-        return xencomm_arch_hypercall_physdev_op
-                (cmd, xencomm_map_no_alloc(op, argsize));
-}
-static int
-xencommize_grant_table_op(struct xencomm_mini **xc_area,
-                          unsigned int cmd, void *op, unsigned int count,
-                          struct xencomm_handle **desc)
-{
-        struct xencomm_handle *desc1;
-        unsigned int argsize;
-        switch (cmd) {
-        case GNTTABOP_map_grant_ref:
-                argsize = sizeof(struct gnttab_map_grant_ref);
-                break;
-        case GNTTABOP_unmap_grant_ref:
-                argsize = sizeof(struct gnttab_unmap_grant_ref);
-                break;
-        case GNTTABOP_setup_table:
-        {
-                struct gnttab_setup_table *setup = op;
-                argsize = sizeof(*setup);
-                if (count != 1)
-                        return -EINVAL;
-                desc1 = __xencomm_map_no_alloc
-                        (xen_guest_handle(setup->frame_list),
-                         setup->nr_frames *
-                         sizeof(*xen_guest_handle(setup->frame_list)),
-                         *xc_area);
-                if (desc1 == NULL)
-                        return -EINVAL;
-                (*xc_area)++;
-                set_xen_guest_handle(setup->frame_list, (void *)desc1);
-                break;
-        }
-        case GNTTABOP_dump_table:
-                argsize = sizeof(struct gnttab_dump_table);
-                break;
-        case GNTTABOP_transfer:
-                argsize = sizeof(struct gnttab_transfer);
-                break;
-        case GNTTABOP_copy:
-                argsize = sizeof(struct gnttab_copy);
-                break;
-        case GNTTABOP_query_size:
-                argsize = sizeof(struct gnttab_query_size);
-                break;
-        default:
-                printk(KERN_DEBUG "%s: unknown hypercall grant table op %d\n",
-                       __func__, cmd);
-                BUG();
-        }
-        *desc = __xencomm_map_no_alloc(op, count * argsize, *xc_area);
-        if (*desc == NULL)
-                return -EINVAL;
-        (*xc_area)++;
-        return 0;
-}
-int
-xencomm_hypercall_grant_table_op(unsigned int cmd, void *op,
-                                 unsigned int count)
-{
-        int rc;
-        struct xencomm_handle *desc;
-        XENCOMM_MINI_ALIGNED(xc_area, 2);
-        rc = xencommize_grant_table_op(&xc_area, cmd, op, count, &desc);
-        if (rc)
-                return rc;
-        return xencomm_arch_hypercall_grant_table_op(cmd, desc, count);
-}
-EXPORT_SYMBOL_GPL(xencomm_hypercall_grant_table_op);
-int
-xencomm_hypercall_sched_op(int cmd, void *arg)
-{
-        struct xencomm_handle *desc;
-        unsigned int argsize;
-        switch (cmd) {
-        case SCHEDOP_yield:
-        case SCHEDOP_block:
-                argsize = 0;
-                break;
-        case SCHEDOP_shutdown:
-                argsize = sizeof(struct sched_shutdown);
-                break;
-        case SCHEDOP_poll:
-        {
-                struct sched_poll *poll = arg;
-                struct xencomm_handle *ports;
-                argsize = sizeof(struct sched_poll);
-                ports = xencomm_map_no_alloc(xen_guest_handle(poll->ports),
-                                     sizeof(*xen_guest_handle(poll->ports)));
-                set_xen_guest_handle(poll->ports, (void *)ports);
-                break;
-        }
-        default:
-                printk(KERN_DEBUG "%s: unknown sched op %d\n", __func__, cmd);
-                return -ENOSYS;
-        }
-        desc = xencomm_map_no_alloc(arg, argsize);
-        if (desc == NULL)
-                return -EINVAL;
-        return xencomm_arch_hypercall_sched_op(cmd, desc);
-}
-EXPORT_SYMBOL_GPL(xencomm_hypercall_sched_op);
-int
-xencomm_hypercall_multicall(void *call_list, int nr_calls)
-{
-        int rc;
-        int i;
-        struct multicall_entry *mce;
-        struct xencomm_handle *desc;
-        XENCOMM_MINI_ALIGNED(xc_area, nr_calls * 2);
-        for (i = 0; i < nr_calls; i++) {
-                mce = (struct multicall_entry *)call_list + i;
-                switch (mce->op) {
-                case __HYPERVISOR_update_va_mapping:
-                case __HYPERVISOR_mmu_update:
-                        /* No-op on ia64.  */
-                        break;
-                case __HYPERVISOR_grant_table_op:
-                        rc = xencommize_grant_table_op
-                                (&xc_area,
-                                 mce->args[0], (void *)mce->args[1],
-                                 mce->args[2], &desc);
-                        if (rc)
-                                return rc;
-                        mce->args[1] = (unsigned long)desc;
-                        break;
-                case __HYPERVISOR_memory_op:
-                default:
-                        printk(KERN_DEBUG
-                               "%s: unhandled multicall op entry op %lu\n",
-                               __func__, mce->op);
-                        return -ENOSYS;
-                }
-        }
-        desc = xencomm_map_no_alloc(call_list,
-                                    nr_calls * sizeof(struct multicall_entry));
-        if (desc == NULL)
-                return -EINVAL;
-        return xencomm_arch_hypercall_multicall(desc, nr_calls);
-}
-EXPORT_SYMBOL_GPL(xencomm_hypercall_multicall);
-int
-xencomm_hypercall_callback_op(int cmd, void *arg)
-{
-        unsigned int argsize;
-        switch (cmd) {
-        case CALLBACKOP_register:
-                argsize = sizeof(struct callback_register);
-                break;
-        case CALLBACKOP_unregister:
-                argsize = sizeof(struct callback_unregister);
-                break;
-        default:
-                printk(KERN_DEBUG
-                       "%s: unknown callback op %d\n", __func__, cmd);
-                return -ENOSYS;
-        }
-        return xencomm_arch_hypercall_callback_op
-                (cmd, xencomm_map_no_alloc(arg, argsize));
-}
-static int
-xencommize_memory_reservation(struct xencomm_mini *xc_area,
-                              struct xen_memory_reservation *mop)
-{
-        struct xencomm_handle *desc;
-        desc = __xencomm_map_no_alloc(xen_guest_handle(mop->extent_start),
-                        mop->nr_extents *
-                        sizeof(*xen_guest_handle(mop->extent_start)),
-                        xc_area);
-        if (desc == NULL)
-                return -EINVAL;
-        set_xen_guest_handle(mop->extent_start, (void *)desc);
-        return 0;
-}
-int
-xencomm_hypercall_memory_op(unsigned int cmd, void *arg)
-{
-        GUEST_HANDLE(xen_pfn_t) extent_start_va[2] = { {NULL}, {NULL} };
-        struct xen_memory_reservation *xmr = NULL;
-        int rc;
-        struct xencomm_handle *desc;
-        unsigned int argsize;
-        XENCOMM_MINI_ALIGNED(xc_area, 2);
-        switch (cmd) {
-        case XENMEM_increase_reservation:
-        case XENMEM_decrease_reservation:
-        case XENMEM_populate_physmap:
-                xmr = (struct xen_memory_reservation *)arg;
-                set_xen_guest_handle(extent_start_va[0],
-                                     xen_guest_handle(xmr->extent_start));
-                argsize = sizeof(*xmr);
-                rc = xencommize_memory_reservation(xc_area, xmr);
-                if (rc)
-                        return rc;
-                xc_area++;
-                break;
-        case XENMEM_maximum_ram_page:
-                argsize = 0;
-                break;
-        case XENMEM_add_to_physmap:
-                argsize = sizeof(struct xen_add_to_physmap);
-                break;
-        default:
-                printk(KERN_DEBUG "%s: unknown memory op %d\n", __func__, cmd);
-                return -ENOSYS;
-        }
-        desc = xencomm_map_no_alloc(arg, argsize);
-        if (desc == NULL)
-                return -EINVAL;
-        rc = xencomm_arch_hypercall_memory_op(cmd, desc);
-        switch (cmd) {
-        case XENMEM_increase_reservation:
-        case XENMEM_decrease_reservation:
-        case XENMEM_populate_physmap:
-                set_xen_guest_handle(xmr->extent_start,
-                                     xen_guest_handle(extent_start_va[0]));
-                break;
-        }
-        return rc;
-}
-EXPORT_SYMBOL_GPL(xencomm_hypercall_memory_op);
-int
-xencomm_hypercall_suspend(unsigned long srec)
-{
-        struct sched_shutdown arg;
-        arg.reason = SHUTDOWN_suspend;
-        return xencomm_arch_hypercall_sched_op(
-                SCHEDOP_shutdown, xencomm_map_no_alloc(&arg, sizeof(arg)));
-}
-long
-xencomm_hypercall_vcpu_op(int cmd, int cpu, void *arg)
-{
-        unsigned int argsize;
-        switch (cmd) {
-        case VCPUOP_register_runstate_memory_area: {
-                struct vcpu_register_runstate_memory_area *area =
-                        (struct vcpu_register_runstate_memory_area *)arg;
-                argsize = sizeof(*arg);
-                set_xen_guest_handle(area->addr.h,
-                     (void *)xencomm_map_no_alloc(area->addr.v,
-                                                  sizeof(area->addr.v)));
-                break;
-        }
-        default:
-                printk(KERN_DEBUG "%s: unknown vcpu op %d\n", __func__, cmd);
-                return -ENOSYS;
-        }
-        return xencomm_arch_hypercall_vcpu_op(cmd, cpu,
-                                        xencomm_map_no_alloc(arg, argsize));
-}
-long
-xencomm_hypercall_opt_feature(void *arg)
-{
-        return xencomm_arch_hypercall_opt_feature(
-                xencomm_map_no_alloc(arg,
-                                     sizeof(struct xen_ia64_opt_feature)));
-}
diff --git a/arch/ia64/xen/xen_pv_ops.c b/arch/ia64/xen/xen_pv_ops.c
deleted file mode 100644
index 3e8d350fdf39..000000000000
--- a/arch/ia64/xen/xen_pv_ops.c
+++ /dev/null
@@ -1,1141 +0,0 @@
-/******************************************************************************
- * arch/ia64/xen/xen_pv_ops.c
- *
- * Copyright (c) 2008 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
- *
- */
-#include <linux/console.h>
-#include <linux/irq.h>
-#include <linux/kernel.h>
-#include <linux/pm.h>
-#include <linux/unistd.h>
-#include <asm/xen/hypervisor.h>
-#include <asm/xen/xencomm.h>
-#include <asm/xen/privop.h>
-#include "irq_xen.h"
-#include "time.h"
-/***************************************************************************
- * general info
- */
-static struct pv_info xen_info __initdata = {
-        .kernel_rpl = 2,        /* or 1: determin at runtime */
-        .paravirt_enabled = 1,
-        .name = "Xen/ia64",
-};
-#define IA64_RSC_PL_SHIFT       2
-#define IA64_RSC_PL_BIT_SIZE    2
-#define IA64_RSC_PL_MASK        \
-        (((1UL << IA64_RSC_PL_BIT_SIZE) - 1) << IA64_RSC_PL_SHIFT)
-static void __init
-xen_info_init(void)
-{
-        /* Xenified Linux/ia64 may run on pl = 1 or 2.
-         * determin at run time. */
-        unsigned long rsc = ia64_getreg(_IA64_REG_AR_RSC);
-        unsigned int rpl = (rsc & IA64_RSC_PL_MASK) >> IA64_RSC_PL_SHIFT;
-        xen_info.kernel_rpl = rpl;
-}
-/***************************************************************************
- * pv_init_ops
- * initialization hooks.
- */
-static void
-xen_panic_hypercall(struct unw_frame_info *info, void *arg)
-{
-        current->thread.ksp = (__u64)info->sw - 16;
-        HYPERVISOR_shutdown(SHUTDOWN_crash);
-        /* we're never actually going to get here... */
-}
-static int
-xen_panic_event(struct notifier_block *this, unsigned long event, void *ptr)
-{
-        unw_init_running(xen_panic_hypercall, NULL);
-        /* we're never actually going to get here... */
-        return NOTIFY_DONE;
-}
-static struct notifier_block xen_panic_block = {
-        xen_panic_event, NULL, 0 /* try to go last */
-};
-static void xen_pm_power_off(void)
-{
-        local_irq_disable();
-        HYPERVISOR_shutdown(SHUTDOWN_poweroff);
-}
-static void __init
-xen_banner(void)
-{
-        printk(KERN_INFO
-               "Running on Xen! pl = %d start_info_pfn=0x%lx nr_pages=%ld "
-               "flags=0x%x\n",
-               xen_info.kernel_rpl,
-               HYPERVISOR_shared_info->arch.start_info_pfn,
-               xen_start_info->nr_pages, xen_start_info->flags);
-}
-static int __init
-xen_reserve_memory(struct rsvd_region *region)
-{
-        region->start = (unsigned long)__va(
-                (HYPERVISOR_shared_info->arch.start_info_pfn << PAGE_SHIFT));
-        region->end   = region->start + PAGE_SIZE;
-        return 1;
-}
-static void __init
-xen_arch_setup_early(void)
-{
-        struct shared_info *s;
-        BUG_ON(!xen_pv_domain());
-        s = HYPERVISOR_shared_info;
-        xen_start_info = __va(s->arch.start_info_pfn << PAGE_SHIFT);
-        /* Must be done before any hypercall.  */
-        xencomm_initialize();
-        xen_setup_features();
-        /* Register a call for panic conditions. */
-        atomic_notifier_chain_register(&panic_notifier_list,
-                                       &xen_panic_block);
-        pm_power_off = xen_pm_power_off;
-        xen_ia64_enable_opt_feature();
-}
-static void __init
-xen_arch_setup_console(char **cmdline_p)
-{
-        add_preferred_console("xenboot", 0, NULL);
-        add_preferred_console("tty", 0, NULL);
-        /* use hvc_xen */
-        add_preferred_console("hvc", 0, NULL);
-#if !defined(CONFIG_VT) || !defined(CONFIG_DUMMY_CONSOLE)
-        conswitchp = NULL;
-#endif
-}
-static int __init
-xen_arch_setup_nomca(void)
-{
-        return 1;
-}
-static void __init
-xen_post_smp_prepare_boot_cpu(void)
-{
-        xen_setup_vcpu_info_placement();
-}
-#ifdef ASM_SUPPORTED
-static unsigned long __init_or_module
-xen_patch_bundle(void *sbundle, void *ebundle, unsigned long type);
-#endif
-static void __init
-xen_patch_branch(unsigned long tag, unsigned long type);
-static const struct pv_init_ops xen_init_ops __initconst = {
-        .banner = xen_banner,
-        .reserve_memory = xen_reserve_memory,
-        .arch_setup_early = xen_arch_setup_early,
-        .arch_setup_console = xen_arch_setup_console,
-        .arch_setup_nomca = xen_arch_setup_nomca,
-        .post_smp_prepare_boot_cpu = xen_post_smp_prepare_boot_cpu,
-#ifdef ASM_SUPPORTED
-        .patch_bundle = xen_patch_bundle,
-#endif
-        .patch_branch = xen_patch_branch,
-};
-/***************************************************************************
- * pv_fsys_data
- * addresses for fsys
- */
-extern unsigned long xen_fsyscall_table[NR_syscalls];
-extern char xen_fsys_bubble_down[];
-struct pv_fsys_data xen_fsys_data __initdata = {
-        .fsyscall_table = (unsigned long *)xen_fsyscall_table,
-        .fsys_bubble_down = (void *)xen_fsys_bubble_down,
-};
-/***************************************************************************
- * pv_patchdata
- * patchdata addresses
- */
-#define DECLARE(name)                                                   \
-        extern unsigned long __xen_start_gate_##name##_patchlist[];     \
-        extern unsigned long __xen_end_gate_##name##_patchlist[]
-DECLARE(fsyscall);
-DECLARE(brl_fsys_bubble_down);
-DECLARE(vtop);
-DECLARE(mckinley_e9);
-extern unsigned long __xen_start_gate_section[];
-#define ASSIGN(name)                                                    \
-        .start_##name##_patchlist =                                     \
-                (unsigned long)__xen_start_gate_##name##_patchlist,     \
-        .end_##name##_patchlist =                                       \
-                (unsigned long)__xen_end_gate_##name##_patchlist
-static struct pv_patchdata xen_patchdata __initdata = {
-        ASSIGN(fsyscall),
-        ASSIGN(brl_fsys_bubble_down),
-        ASSIGN(vtop),
-        ASSIGN(mckinley_e9),
-        .gate_section = (void*)__xen_start_gate_section,
-};
-/***************************************************************************
- * pv_cpu_ops
- * intrinsics hooks.
- */
-#ifndef ASM_SUPPORTED
-static void
-xen_set_itm_with_offset(unsigned long val)
-{
-        /* ia64_cpu_local_tick() calls this with interrupt enabled. */
-        /* WARN_ON(!irqs_disabled()); */
-        xen_set_itm(val - XEN_MAPPEDREGS->itc_offset);
-}
-static unsigned long
-xen_get_itm_with_offset(void)
-{
-        /* unused at this moment */
-        printk(KERN_DEBUG "%s is called.\n", __func__);
-        WARN_ON(!irqs_disabled());
-        return ia64_native_getreg(_IA64_REG_CR_ITM) +
-                XEN_MAPPEDREGS->itc_offset;
-}
-/* ia64_set_itc() is only called by
- * cpu_init() with ia64_set_itc(0) and ia64_sync_itc().
- * So XEN_MAPPEDRESG->itc_offset cal be considered as almost constant.
- */
-static void
-xen_set_itc(unsigned long val)
-{
-        unsigned long mitc;
-        WARN_ON(!irqs_disabled());
-        mitc = ia64_native_getreg(_IA64_REG_AR_ITC);
-        XEN_MAPPEDREGS->itc_offset = val - mitc;
-        XEN_MAPPEDREGS->itc_last = val;
-}
-static unsigned long
-xen_get_itc(void)
-{
-        unsigned long res;
-        unsigned long itc_offset;
-        unsigned long itc_last;
-        unsigned long ret_itc_last;
-        itc_offset = XEN_MAPPEDREGS->itc_offset;
-        do {
-                itc_last = XEN_MAPPEDREGS->itc_last;
-                res = ia64_native_getreg(_IA64_REG_AR_ITC);
-                res += itc_offset;
-                if (itc_last >= res)
-                        res = itc_last + 1;
-                ret_itc_last = cmpxchg(&XEN_MAPPEDREGS->itc_last,
-                                       itc_last, res);
-        } while (unlikely(ret_itc_last != itc_last));
-        return res;
-#if 0
-        /* ia64_itc_udelay() calls ia64_get_itc() with interrupt enabled.
-           Should it be paravirtualized instead? */
-        WARN_ON(!irqs_disabled());
-        itc_offset = XEN_MAPPEDREGS->itc_offset;
-        itc_last = XEN_MAPPEDREGS->itc_last;
-        res = ia64_native_getreg(_IA64_REG_AR_ITC);
-        res += itc_offset;
-        if (itc_last >= res)
-                res = itc_last + 1;
-        XEN_MAPPEDREGS->itc_last = res;
-        return res;
-#endif
-}
-static void xen_setreg(int regnum, unsigned long val)
-{
-        switch (regnum) {
-        case _IA64_REG_AR_KR0 ... _IA64_REG_AR_KR7:
-                xen_set_kr(regnum - _IA64_REG_AR_KR0, val);
-                break;
-        case _IA64_REG_AR_ITC:
-                xen_set_itc(val);
-                break;
-        case _IA64_REG_CR_TPR:
-                xen_set_tpr(val);
-                break;
-        case _IA64_REG_CR_ITM:
-                xen_set_itm_with_offset(val);
-                break;
-        case _IA64_REG_CR_EOI:
-                xen_eoi(val);
-                break;
-        default:
-                ia64_native_setreg_func(regnum, val);
-                break;
-        }
-}
-static unsigned long xen_getreg(int regnum)
-{
-        unsigned long res;
-        switch (regnum) {
-        case _IA64_REG_PSR:
-                res = xen_get_psr();
-                break;
-        case _IA64_REG_AR_ITC:
-                res = xen_get_itc();
-                break;
-        case _IA64_REG_CR_ITM:
-                res = xen_get_itm_with_offset();
-                break;
-        case _IA64_REG_CR_IVR:
-                res = xen_get_ivr();
-                break;
-        case _IA64_REG_CR_TPR:
-                res = xen_get_tpr();
-                break;
-        default:
-                res = ia64_native_getreg_func(regnum);
-                break;
-        }
-        return res;
-}
-/* turning on interrupts is a bit more complicated.. write to the
- * memory-mapped virtual psr.i bit first (to avoid race condition),
- * then if any interrupts were pending, we have to execute a hyperprivop
- * to ensure the pending interrupt gets delivered; else we're done! */
-static void
-xen_ssm_i(void)
-{
-        int old = xen_get_virtual_psr_i();
-        xen_set_virtual_psr_i(1);
-        barrier();
-        if (!old && xen_get_virtual_pend())
-                xen_hyper_ssm_i();
-}
-/* turning off interrupts can be paravirtualized simply by writing
- * to a memory-mapped virtual psr.i bit (implemented as a 16-bit bool) */
-static void
-xen_rsm_i(void)
-{
-        xen_set_virtual_psr_i(0);
-        barrier();
-}
-static unsigned long
-xen_get_psr_i(void)
-{
-        return xen_get_virtual_psr_i() ? IA64_PSR_I : 0;
-}
-static void
-xen_intrin_local_irq_restore(unsigned long mask)
-{
-        if (mask & IA64_PSR_I)
-                xen_ssm_i();
-        else
-                xen_rsm_i();
-}
-#else
-#define __DEFINE_FUNC(name, code)                                       \
-        extern const char xen_ ## name ## _direct_start[];              \
-        extern const char xen_ ## name ## _direct_end[];                \
-        asm (".align 32\n"                                              \
-             ".proc xen_" #name "\n"                                    \
-             "xen_" #name ":\n"                                         \
-             "xen_" #name "_direct_start:\n"                            \
-             code                                                       \
-             "xen_" #name "_direct_end:\n"                              \
-             "br.cond.sptk.many b6\n"                                   \
-             ".endp xen_" #name "\n")
-#define DEFINE_VOID_FUNC0(name, code)           \
-        extern void                             \
-        xen_ ## name (void);                    \
-        __DEFINE_FUNC(name, code)
-#define DEFINE_VOID_FUNC1(name, code)           \
-        extern void                             \
-        xen_ ## name (unsigned long arg);       \
-        __DEFINE_FUNC(name, code)
-#define DEFINE_VOID_FUNC1_VOID(name, code)      \
-        extern void                             \
-        xen_ ## name (void *arg);               \
-        __DEFINE_FUNC(name, code)
-#define DEFINE_VOID_FUNC2(name, code)           \
-        extern void                             \
-        xen_ ## name (unsigned long arg0,       \
-                      unsigned long arg1);      \
-        __DEFINE_FUNC(name, code)
-#define DEFINE_FUNC0(name, code)                \
-        extern unsigned long                    \
-        xen_ ## name (void);                    \
-        __DEFINE_FUNC(name, code)
-#define DEFINE_FUNC1(name, type, code)          \
-        extern unsigned long                    \
-        xen_ ## name (type arg);                \
-        __DEFINE_FUNC(name, code)
-#define XEN_PSR_I_ADDR_ADDR     (XSI_BASE + XSI_PSR_I_ADDR_OFS)
-/*
- * static void xen_set_itm_with_offset(unsigned long val)
- *        xen_set_itm(val - XEN_MAPPEDREGS->itc_offset);
- */
-/* 2 bundles */
-DEFINE_VOID_FUNC1(set_itm_with_offset,
-                  "mov r2 = " __stringify(XSI_BASE) " + "
-                  __stringify(XSI_ITC_OFFSET_OFS) "\n"
-                  ";;\n"
-                  "ld8 r3 = [r2]\n"
-                  ";;\n"
-                  "sub r8 = r8, r3\n"
-                  "break " __stringify(HYPERPRIVOP_SET_ITM) "\n");
-/*
- * static unsigned long xen_get_itm_with_offset(void)
- *    return ia64_native_getreg(_IA64_REG_CR_ITM) + XEN_MAPPEDREGS->itc_offset;
- */
-/* 2 bundles */
-DEFINE_FUNC0(get_itm_with_offset,
-             "mov r2 = " __stringify(XSI_BASE) " + "
-             __stringify(XSI_ITC_OFFSET_OFS) "\n"
-             ";;\n"
-             "ld8 r3 = [r2]\n"
-             "mov r8 = cr.itm\n"
-             ";;\n"
-             "add r8 = r8, r2\n");
-/*
- * static void xen_set_itc(unsigned long val)
- *      unsigned long mitc;
- *
- *      WARN_ON(!irqs_disabled());
- *      mitc = ia64_native_getreg(_IA64_REG_AR_ITC);
- *      XEN_MAPPEDREGS->itc_offset = val - mitc;
- *      XEN_MAPPEDREGS->itc_last = val;
- */
-/* 2 bundles */
-DEFINE_VOID_FUNC1(set_itc,
-                  "mov r2 = " __stringify(XSI_BASE) " + "
-                  __stringify(XSI_ITC_LAST_OFS) "\n"
-                  "mov r3 = ar.itc\n"
-                  ";;\n"
-                  "sub r3 = r8, r3\n"
-                  "st8 [r2] = r8, "
-                  __stringify(XSI_ITC_LAST_OFS) " - "
-                  __stringify(XSI_ITC_OFFSET_OFS) "\n"
-                  ";;\n"
-                  "st8 [r2] = r3\n");
-/*
- * static unsigned long xen_get_itc(void)
- *      unsigned long res;
- *      unsigned long itc_offset;
- *      unsigned long itc_last;
- *      unsigned long ret_itc_last;
- *
- *      itc_offset = XEN_MAPPEDREGS->itc_offset;
- *      do {
- *              itc_last = XEN_MAPPEDREGS->itc_last;
- *              res = ia64_native_getreg(_IA64_REG_AR_ITC);
- *              res += itc_offset;
- *              if (itc_last >= res)
- *                      res = itc_last + 1;
- *              ret_itc_last = cmpxchg(&XEN_MAPPEDREGS->itc_last,
- *                                     itc_last, res);
- *      } while (unlikely(ret_itc_last != itc_last));
- *      return res;
- */
-/* 5 bundles */
-DEFINE_FUNC0(get_itc,
-             "mov r2 = " __stringify(XSI_BASE) " + "
-             __stringify(XSI_ITC_OFFSET_OFS) "\n"
-             ";;\n"
-             "ld8 r9 = [r2], " __stringify(XSI_ITC_LAST_OFS) " - "
-             __stringify(XSI_ITC_OFFSET_OFS) "\n"
-                                        /* r9 = itc_offset */
-                                        /* r2 = XSI_ITC_OFFSET */
-             "888:\n"
-             "mov r8 = ar.itc\n"        /* res = ar.itc */
-             ";;\n"
-             "ld8 r3 = [r2]\n"          /* r3 = itc_last */
-             "add r8 = r8, r9\n"        /* res = ar.itc + itc_offset */
-             ";;\n"
-             "cmp.gtu p6, p0 = r3, r8\n"
-             ";;\n"
-             "(p6) add r8 = 1, r3\n"    /* if (itc_last > res) itc_last + 1 */
-             ";;\n"
-             "mov ar.ccv = r8\n"
-             ";;\n"
-             "cmpxchg8.acq r10 = [r2], r8, ar.ccv\n"
-             ";;\n"
-             "cmp.ne p6, p0 = r10, r3\n"
-             "(p6) hint @pause\n"
-             "(p6) br.cond.spnt 888b\n");
-DEFINE_VOID_FUNC1_VOID(fc,
-                       "break " __stringify(HYPERPRIVOP_FC) "\n");
-/*
- * psr_i_addr_addr = XEN_PSR_I_ADDR_ADDR
- * masked_addr = *psr_i_addr_addr
- * pending_intr_addr = masked_addr - 1
- * if (val & IA64_PSR_I) {
- *   masked = *masked_addr
- *   *masked_addr = 0:xen_set_virtual_psr_i(1)
- *   compiler barrier
- *   if (masked) {
- *      uint8_t pending = *pending_intr_addr;
- *      if (pending)
- *              XEN_HYPER_SSM_I
- *   }
- * } else {
- *   *masked_addr = 1:xen_set_virtual_psr_i(0)
- * }
- */
-/* 6 bundles */
-DEFINE_VOID_FUNC1(intrin_local_irq_restore,
-                  /* r8 = input value: 0 or IA64_PSR_I
-                   * p6 =  (flags & IA64_PSR_I)
-                   *    = if clause
-                   * p7 = !(flags & IA64_PSR_I)
-                   *    = else clause
-                   */
-                  "cmp.ne p6, p7 = r8, r0\n"
-                  "mov r9 = " __stringify(XEN_PSR_I_ADDR_ADDR) "\n"
-                  ";;\n"
-                  /* r9 = XEN_PSR_I_ADDR */
-                  "ld8 r9 = [r9]\n"
-                  ";;\n"
-                  /* r10 = masked previous value */
-                  "(p6) ld1.acq r10 = [r9]\n"
-                  ";;\n"
-                  /* p8 = !masked interrupt masked previously? */
-                  "(p6) cmp.ne.unc p8, p0 = r10, r0\n"
-                  /* p7 = else clause */
-                  "(p7) mov r11 = 1\n"
-                  ";;\n"
-                  /* masked = 1 */
-                  "(p7) st1.rel [r9] = r11\n"
-                  /* p6 = if clause */
-                  /* masked = 0
-                   * r9 = masked_addr - 1
-                   *    = pending_intr_addr
-                   */
-                  "(p8) st1.rel [r9] = r0, -1\n"
-                  ";;\n"
-                  /* r8 = pending_intr */
-                  "(p8) ld1.acq r11 = [r9]\n"
-                  ";;\n"
-                  /* p9 = interrupt pending? */
-                  "(p8) cmp.ne.unc p9, p10 = r11, r0\n"
-                  ";;\n"
-                  "(p10) mf\n"
-                  /* issue hypercall to trigger interrupt */
-                  "(p9) break " __stringify(HYPERPRIVOP_SSM_I) "\n");
-DEFINE_VOID_FUNC2(ptcga,
-                  "break " __stringify(HYPERPRIVOP_PTC_GA) "\n");
-DEFINE_VOID_FUNC2(set_rr,
-                  "break " __stringify(HYPERPRIVOP_SET_RR) "\n");
-/*
- * tmp = XEN_MAPPEDREGS->interrupt_mask_addr = XEN_PSR_I_ADDR_ADDR;
- * tmp = *tmp
- * tmp = *tmp;
- * psr_i = tmp? 0: IA64_PSR_I;
- */
-/* 4 bundles */
-DEFINE_FUNC0(get_psr_i,
-             "mov r9 = " __stringify(XEN_PSR_I_ADDR_ADDR) "\n"
-             ";;\n"
-             "ld8 r9 = [r9]\n"                  /* r9 = XEN_PSR_I_ADDR */
-             "mov r8 = 0\n"                     /* psr_i = 0 */
-             ";;\n"
-             "ld1.acq r9 = [r9]\n"              /* r9 = XEN_PSR_I */
-             ";;\n"
-             "cmp.eq.unc p6, p0 = r9, r0\n"     /* p6 = (XEN_PSR_I != 0) */
-             ";;\n"
-             "(p6) mov r8 = " __stringify(1 << IA64_PSR_I_BIT) "\n");
-DEFINE_FUNC1(thash, unsigned long,
-             "break " __stringify(HYPERPRIVOP_THASH) "\n");
-DEFINE_FUNC1(get_cpuid, int,
-             "break " __stringify(HYPERPRIVOP_GET_CPUID) "\n");
-DEFINE_FUNC1(get_pmd, int,
-             "break " __stringify(HYPERPRIVOP_GET_PMD) "\n");
-DEFINE_FUNC1(get_rr, unsigned long,
-             "break " __stringify(HYPERPRIVOP_GET_RR) "\n");
-/*
- * void xen_privop_ssm_i(void)
- *
- * int masked = !xen_get_virtual_psr_i();
- *      // masked = *(*XEN_MAPPEDREGS->interrupt_mask_addr)
- * xen_set_virtual_psr_i(1)
- *      // *(*XEN_MAPPEDREGS->interrupt_mask_addr) = 0
- * // compiler barrier
- * if (masked) {
- *      uint8_t* pend_int_addr =
- *              (uint8_t*)(*XEN_MAPPEDREGS->interrupt_mask_addr) - 1;
- *      uint8_t pending = *pend_int_addr;
- *      if (pending)
- *              XEN_HYPER_SSM_I
- * }
- */
-/* 4 bundles */
-DEFINE_VOID_FUNC0(ssm_i,
-                  "mov r8 = " __stringify(XEN_PSR_I_ADDR_ADDR) "\n"
-                  ";;\n"
-                  "ld8 r8 = [r8]\n"             /* r8 = XEN_PSR_I_ADDR */
-                  ";;\n"
-                  "ld1.acq r9 = [r8]\n"         /* r9 = XEN_PSR_I */
-                  ";;\n"
-                  "st1.rel [r8] = r0, -1\n"     /* psr_i = 0. enable interrupt
-                                                 * r8 = XEN_PSR_I_ADDR - 1
-                                                 *    = pend_int_addr
-                                                 */
-                  "cmp.eq.unc p0, p6 = r9, r0\n"/* p6 = !XEN_PSR_I
-                                                 * previously interrupt
-                                                 * masked?
-                                                 */
-                  ";;\n"
-                  "(p6) ld1.acq r8 = [r8]\n"    /* r8 = xen_pend_int */
-                  ";;\n"
-                  "(p6) cmp.eq.unc p6, p7 = r8, r0\n"   /*interrupt pending?*/
-                  ";;\n"
-                  /* issue hypercall to get interrupt */
-                  "(p7) break " __stringify(HYPERPRIVOP_SSM_I) "\n"
-                  ";;\n");
-/*
- * psr_i_addr_addr = XEN_MAPPEDREGS->interrupt_mask_addr
- *                 = XEN_PSR_I_ADDR_ADDR;
- * psr_i_addr = *psr_i_addr_addr;
- * *psr_i_addr = 1;
- */
-/* 2 bundles */
-DEFINE_VOID_FUNC0(rsm_i,
-                  "mov r8 = " __stringify(XEN_PSR_I_ADDR_ADDR) "\n"
-                                                /* r8 = XEN_PSR_I_ADDR */
-                  "mov r9 = 1\n"
-                  ";;\n"
-                  "ld8 r8 = [r8]\n"             /* r8 = XEN_PSR_I */
-                  ";;\n"
-                  "st1.rel [r8] = r9\n");       /* XEN_PSR_I = 1 */
-extern void
-xen_set_rr0_to_rr4(unsigned long val0, unsigned long val1,
-                   unsigned long val2, unsigned long val3,
-                   unsigned long val4);
-__DEFINE_FUNC(set_rr0_to_rr4,
-              "break " __stringify(HYPERPRIVOP_SET_RR0_TO_RR4) "\n");
-extern unsigned long xen_getreg(int regnum);
-#define __DEFINE_GET_REG(id, privop)                                    \
-        "mov r2 = " __stringify(_IA64_REG_ ## id) "\n"                  \
-        ";;\n"                                                          \
-        "cmp.eq p6, p0 = r2, r8\n"                                      \
-        ";;\n"                                                          \
-        "(p6) break " __stringify(HYPERPRIVOP_GET_ ## privop) "\n"      \
-        "(p6) br.cond.sptk.many b6\n"                                   \
-        ";;\n"
-__DEFINE_FUNC(getreg,
-              __DEFINE_GET_REG(PSR, PSR)
-              /* get_itc */
-              "mov r2 = " __stringify(_IA64_REG_AR_ITC) "\n"
-              ";;\n"
-              "cmp.eq p6, p0 = r2, r8\n"
-              ";;\n"
-              "(p6) br.cond.spnt xen_get_itc\n"
-              ";;\n"
-              /* get itm */
-              "mov r2 = " __stringify(_IA64_REG_CR_ITM) "\n"
-              ";;\n"
-              "cmp.eq p6, p0 = r2, r8\n"
-              ";;\n"
-              "(p6) br.cond.spnt xen_get_itm_with_offset\n"
-              ";;\n"
-              __DEFINE_GET_REG(CR_IVR, IVR)
-              __DEFINE_GET_REG(CR_TPR, TPR)
-              /* fall back */
-              "movl r2 = ia64_native_getreg_func\n"
-              ";;\n"
-              "mov b7 = r2\n"
-              ";;\n"
-              "br.cond.sptk.many b7\n");
-extern void xen_setreg(int regnum, unsigned long val);
-#define __DEFINE_SET_REG(id, privop)                                    \
-        "mov r2 = " __stringify(_IA64_REG_ ## id) "\n"                  \
-        ";;\n"                                                          \
-        "cmp.eq p6, p0 = r2, r9\n"                                      \
-        ";;\n"                                                          \
-        "(p6) break " __stringify(HYPERPRIVOP_ ## privop) "\n"          \
-        "(p6) br.cond.sptk.many b6\n"                                   \
-        ";;\n"
-__DEFINE_FUNC(setreg,
-              /* kr0 .. kr 7*/
-              /*
-               * if (_IA64_REG_AR_KR0 <= regnum &&
-               *     regnum <= _IA64_REG_AR_KR7) {
-               *     register __index asm ("r8") = regnum - _IA64_REG_AR_KR0
-               *     register __val asm ("r9") = val
-               *    "break HYPERPRIVOP_SET_KR"
-               * }
-               */
-              "mov r17 = r9\n"
-              "mov r2 = " __stringify(_IA64_REG_AR_KR0) "\n"
-              ";;\n"
-              "cmp.ge p6, p0 = r9, r2\n"
-              "sub r17 = r17, r2\n"
-              ";;\n"
-              "(p6) cmp.ge.unc p7, p0 = "
-              __stringify(_IA64_REG_AR_KR7) " - " __stringify(_IA64_REG_AR_KR0)
-              ", r17\n"
-              ";;\n"
-              "(p7) mov r9 = r8\n"
-              ";;\n"
-              "(p7) mov r8 = r17\n"
-              "(p7) break " __stringify(HYPERPRIVOP_SET_KR) "\n"
-              /* set itm */
-              "mov r2 = " __stringify(_IA64_REG_CR_ITM) "\n"
-              ";;\n"
-              "cmp.eq p6, p0 = r2, r8\n"
-              ";;\n"
-              "(p6) br.cond.spnt xen_set_itm_with_offset\n"
-              /* set itc */
-              "mov r2 = " __stringify(_IA64_REG_AR_ITC) "\n"
-              ";;\n"
-              "cmp.eq p6, p0 = r2, r8\n"
-              ";;\n"
-              "(p6) br.cond.spnt xen_set_itc\n"
-              __DEFINE_SET_REG(CR_TPR, SET_TPR)
-              __DEFINE_SET_REG(CR_EOI, EOI)
-              /* fall back */
-              "movl r2 = ia64_native_setreg_func\n"
-              ";;\n"
-              "mov b7 = r2\n"
-              ";;\n"
-              "br.cond.sptk.many b7\n");
-#endif
-static const struct pv_cpu_ops xen_cpu_ops __initconst = {
-        .fc             = xen_fc,
-        .thash          = xen_thash,
-        .get_cpuid      = xen_get_cpuid,
-        .get_pmd        = xen_get_pmd,
-        .getreg         = xen_getreg,
-        .setreg         = xen_setreg,
-        .ptcga          = xen_ptcga,
-        .get_rr         = xen_get_rr,
-        .set_rr         = xen_set_rr,
-        .set_rr0_to_rr4 = xen_set_rr0_to_rr4,
-        .ssm_i          = xen_ssm_i,
-        .rsm_i          = xen_rsm_i,
-        .get_psr_i      = xen_get_psr_i,
-        .intrin_local_irq_restore
-                        = xen_intrin_local_irq_restore,
-};
-/******************************************************************************
- * replacement of hand written assembly codes.
- */
-extern char xen_switch_to;
-extern char xen_leave_syscall;
-extern char xen_work_processed_syscall;
-extern char xen_leave_kernel;
-const struct pv_cpu_asm_switch xen_cpu_asm_switch = {
-        .switch_to              = (unsigned long)&xen_switch_to,
-        .leave_syscall          = (unsigned long)&xen_leave_syscall,
-        .work_processed_syscall = (unsigned long)&xen_work_processed_syscall,
-        .leave_kernel           = (unsigned long)&xen_leave_kernel,
-};
-/***************************************************************************
- * pv_iosapic_ops
- * iosapic read/write hooks.
- */
-static void
-xen_pcat_compat_init(void)
-{
-        /* nothing */
-}
-static struct irq_chip*
-xen_iosapic_get_irq_chip(unsigned long trigger)
-{
-        return NULL;
-}
-static unsigned int
-xen_iosapic_read(char __iomem *iosapic, unsigned int reg)
-{
-        struct physdev_apic apic_op;
-        int ret;
-        apic_op.apic_physbase = (unsigned long)iosapic -
-                                        __IA64_UNCACHED_OFFSET;
-        apic_op.reg = reg;
-        ret = HYPERVISOR_physdev_op(PHYSDEVOP_apic_read, &apic_op);
-        if (ret)
-                return ret;
-        return apic_op.value;
-}
-static void
-xen_iosapic_write(char __iomem *iosapic, unsigned int reg, u32 val)
-{
-        struct physdev_apic apic_op;
-        apic_op.apic_physbase = (unsigned long)iosapic -
-                                        __IA64_UNCACHED_OFFSET;
-        apic_op.reg = reg;
-        apic_op.value = val;
-        HYPERVISOR_physdev_op(PHYSDEVOP_apic_write, &apic_op);
-}
-static struct pv_iosapic_ops xen_iosapic_ops __initdata = {
-        .pcat_compat_init = xen_pcat_compat_init,
-        .__get_irq_chip = xen_iosapic_get_irq_chip,
-        .__read = xen_iosapic_read,
-        .__write = xen_iosapic_write,
-};
-/***************************************************************************
- * pv_ops initialization
- */
-void __init
-xen_setup_pv_ops(void)
-{
-        xen_info_init();
-        pv_info = xen_info;
-        pv_init_ops = xen_init_ops;
-        pv_fsys_data = xen_fsys_data;
-        pv_patchdata = xen_patchdata;
-        pv_cpu_ops = xen_cpu_ops;
-        pv_iosapic_ops = xen_iosapic_ops;
-        pv_irq_ops = xen_irq_ops;
-        pv_time_ops = xen_time_ops;
-        paravirt_cpu_asm_init(&xen_cpu_asm_switch);
-}
-#ifdef ASM_SUPPORTED
-/***************************************************************************
- * binary pacthing
- * pv_init_ops.patch_bundle
- */
-#define DEFINE_FUNC_GETREG(name, privop)                                \
-        DEFINE_FUNC0(get_ ## name,                                      \
-                     "break "__stringify(HYPERPRIVOP_GET_ ## privop) "\n")
-DEFINE_FUNC_GETREG(psr, PSR);
-DEFINE_FUNC_GETREG(eflag, EFLAG);
-DEFINE_FUNC_GETREG(ivr, IVR);
-DEFINE_FUNC_GETREG(tpr, TPR);
-#define DEFINE_FUNC_SET_KR(n)                                           \
-        DEFINE_VOID_FUNC0(set_kr ## n,                                  \
-                          ";;\n"                                        \
-                          "mov r9 = r8\n"                               \
-                          "mov r8 = " #n "\n"                           \
-                          "break " __stringify(HYPERPRIVOP_SET_KR) "\n")
-DEFINE_FUNC_SET_KR(0);
-DEFINE_FUNC_SET_KR(1);
-DEFINE_FUNC_SET_KR(2);
-DEFINE_FUNC_SET_KR(3);
-DEFINE_FUNC_SET_KR(4);
-DEFINE_FUNC_SET_KR(5);
-DEFINE_FUNC_SET_KR(6);
-DEFINE_FUNC_SET_KR(7);
-#define __DEFINE_FUNC_SETREG(name, privop)                              \
-        DEFINE_VOID_FUNC0(name,                                         \
-                          "break "__stringify(HYPERPRIVOP_ ## privop) "\n")
-#define DEFINE_FUNC_SETREG(name, privop)                        \
-        __DEFINE_FUNC_SETREG(set_ ## name, SET_ ## privop)
-DEFINE_FUNC_SETREG(eflag, EFLAG);
-DEFINE_FUNC_SETREG(tpr, TPR);
-__DEFINE_FUNC_SETREG(eoi, EOI);
-extern const char xen_check_events[];
-extern const char __xen_intrin_local_irq_restore_direct_start[];
-extern const char __xen_intrin_local_irq_restore_direct_end[];
-extern const unsigned long __xen_intrin_local_irq_restore_direct_reloc;
-asm (
-        ".align 32\n"
-        ".proc xen_check_events\n"
-        "xen_check_events:\n"
-        /* masked = 0
-         * r9 = masked_addr - 1
-         *    = pending_intr_addr
-         */
-        "st1.rel [r9] = r0, -1\n"
-        ";;\n"
-        /* r8 = pending_intr */
-        "ld1.acq r11 = [r9]\n"
-        ";;\n"
-        /* p9 = interrupt pending? */
-        "cmp.ne p9, p10 = r11, r0\n"
-        ";;\n"
-        "(p10) mf\n"
-        /* issue hypercall to trigger interrupt */
-        "(p9) break " __stringify(HYPERPRIVOP_SSM_I) "\n"
-        "br.cond.sptk.many b6\n"
-        ".endp xen_check_events\n"
-        "\n"
-        ".align 32\n"
-        ".proc __xen_intrin_local_irq_restore_direct\n"
-        "__xen_intrin_local_irq_restore_direct:\n"
-        "__xen_intrin_local_irq_restore_direct_start:\n"
-        "1:\n"
-        "{\n"
-        "cmp.ne p6, p7 = r8, r0\n"
-        "mov r17 = ip\n" /* get ip to calc return address */
-        "mov r9 = "__stringify(XEN_PSR_I_ADDR_ADDR) "\n"
-        ";;\n"
-        "}\n"
-        "{\n"
-        /* r9 = XEN_PSR_I_ADDR */
-        "ld8 r9 = [r9]\n"
-        ";;\n"
-        /* r10 = masked previous value */
-        "(p6) ld1.acq r10 = [r9]\n"
-        "adds r17 =  1f - 1b, r17\n" /* calculate return address */
-        ";;\n"
-        "}\n"
-        "{\n"
-        /* p8 = !masked interrupt masked previously? */
-        "(p6) cmp.ne.unc p8, p0 = r10, r0\n"
-        "\n"
-        /* p7 = else clause */
-        "(p7) mov r11 = 1\n"
-        ";;\n"
-        "(p8) mov b6 = r17\n" /* set return address */
-        "}\n"
-        "{\n"
-        /* masked = 1 */
-        "(p7) st1.rel [r9] = r11\n"
-        "\n"
-        "[99:]\n"
-        "(p8) brl.cond.dptk.few xen_check_events\n"
-        "}\n"
-        /* pv calling stub is 5 bundles. fill nop to adjust return address */
-        "{\n"
-        "nop 0\n"
-        "nop 0\n"
-        "nop 0\n"
-        "}\n"
-        "1:\n"
-        "__xen_intrin_local_irq_restore_direct_end:\n"
-        ".endp __xen_intrin_local_irq_restore_direct\n"
-        "\n"
-        ".align 8\n"
-        "__xen_intrin_local_irq_restore_direct_reloc:\n"
-        "data8 99b\n"
-);
-static struct paravirt_patch_bundle_elem xen_patch_bundle_elems[]
-__initdata_or_module =
-{
-#define XEN_PATCH_BUNDLE_ELEM(name, type)               \
-        {                                               \
-                (void*)xen_ ## name ## _direct_start,   \
-                (void*)xen_ ## name ## _direct_end,     \
-                PARAVIRT_PATCH_TYPE_ ## type,           \
-        }
-        XEN_PATCH_BUNDLE_ELEM(fc, FC),
-        XEN_PATCH_BUNDLE_ELEM(thash, THASH),
-        XEN_PATCH_BUNDLE_ELEM(get_cpuid, GET_CPUID),
-        XEN_PATCH_BUNDLE_ELEM(get_pmd, GET_PMD),
-        XEN_PATCH_BUNDLE_ELEM(ptcga, PTCGA),
-        XEN_PATCH_BUNDLE_ELEM(get_rr, GET_RR),
-        XEN_PATCH_BUNDLE_ELEM(set_rr, SET_RR),
-        XEN_PATCH_BUNDLE_ELEM(set_rr0_to_rr4, SET_RR0_TO_RR4),
-        XEN_PATCH_BUNDLE_ELEM(ssm_i, SSM_I),
-        XEN_PATCH_BUNDLE_ELEM(rsm_i, RSM_I),
-        XEN_PATCH_BUNDLE_ELEM(get_psr_i, GET_PSR_I),
-        {
-                (void*)__xen_intrin_local_irq_restore_direct_start,
-                (void*)__xen_intrin_local_irq_restore_direct_end,
-                PARAVIRT_PATCH_TYPE_INTRIN_LOCAL_IRQ_RESTORE,
-        },
-#define XEN_PATCH_BUNDLE_ELEM_GETREG(name, reg)                 \
-        {                                                       \
-                xen_get_ ## name ## _direct_start,              \
-                xen_get_ ## name ## _direct_end,                \
-                PARAVIRT_PATCH_TYPE_GETREG + _IA64_REG_ ## reg, \
-        }
-        XEN_PATCH_BUNDLE_ELEM_GETREG(psr, PSR),
-        XEN_PATCH_BUNDLE_ELEM_GETREG(eflag, AR_EFLAG),
-        XEN_PATCH_BUNDLE_ELEM_GETREG(ivr, CR_IVR),
-        XEN_PATCH_BUNDLE_ELEM_GETREG(tpr, CR_TPR),
-        XEN_PATCH_BUNDLE_ELEM_GETREG(itc, AR_ITC),
-        XEN_PATCH_BUNDLE_ELEM_GETREG(itm_with_offset, CR_ITM),
-#define __XEN_PATCH_BUNDLE_ELEM_SETREG(name, reg)               \
-        {                                                       \
-                xen_ ## name ## _direct_start,                  \
-                xen_ ## name ## _direct_end,                    \
-                PARAVIRT_PATCH_TYPE_SETREG + _IA64_REG_ ## reg, \
-        }
-#define XEN_PATCH_BUNDLE_ELEM_SETREG(name, reg)                 \
-        __XEN_PATCH_BUNDLE_ELEM_SETREG(set_ ## name, reg)
-        XEN_PATCH_BUNDLE_ELEM_SETREG(kr0, AR_KR0),
-        XEN_PATCH_BUNDLE_ELEM_SETREG(kr1, AR_KR1),
-        XEN_PATCH_BUNDLE_ELEM_SETREG(kr2, AR_KR2),
-        XEN_PATCH_BUNDLE_ELEM_SETREG(kr3, AR_KR3),
-        XEN_PATCH_BUNDLE_ELEM_SETREG(kr4, AR_KR4),
-        XEN_PATCH_BUNDLE_ELEM_SETREG(kr5, AR_KR5),
-        XEN_PATCH_BUNDLE_ELEM_SETREG(kr6, AR_KR6),
-        XEN_PATCH_BUNDLE_ELEM_SETREG(kr7, AR_KR7),
-        XEN_PATCH_BUNDLE_ELEM_SETREG(eflag, AR_EFLAG),
-        XEN_PATCH_BUNDLE_ELEM_SETREG(tpr, CR_TPR),
-        __XEN_PATCH_BUNDLE_ELEM_SETREG(eoi, CR_EOI),
-        XEN_PATCH_BUNDLE_ELEM_SETREG(itc, AR_ITC),
-        XEN_PATCH_BUNDLE_ELEM_SETREG(itm_with_offset, CR_ITM),
-};
-static unsigned long __init_or_module
-xen_patch_bundle(void *sbundle, void *ebundle, unsigned long type)
-{
-        const unsigned long nelems = sizeof(xen_patch_bundle_elems) /
-                sizeof(xen_patch_bundle_elems[0]);
-        unsigned long used;
-        const struct paravirt_patch_bundle_elem *found;
-        used = __paravirt_patch_apply_bundle(sbundle, ebundle, type,
-                                             xen_patch_bundle_elems, nelems,
-                                             &found);
-        if (found == NULL)
-                /* fallback */
-                return ia64_native_patch_bundle(sbundle, ebundle, type);
-        if (used == 0)
-                return used;
-        /* relocation */
-        switch (type) {
-        case PARAVIRT_PATCH_TYPE_INTRIN_LOCAL_IRQ_RESTORE: {
-                unsigned long reloc =
-                        __xen_intrin_local_irq_restore_direct_reloc;
-                unsigned long reloc_offset = reloc - (unsigned long)
-                        __xen_intrin_local_irq_restore_direct_start;
-                unsigned long tag = (unsigned long)sbundle + reloc_offset;
-                paravirt_patch_reloc_brl(tag, xen_check_events);
-                break;
-        }
-        default:
-                /* nothing */
-                break;
-        }
-        return used;
-}
-#endif /* ASM_SUPPOTED */
-const struct paravirt_patch_branch_target xen_branch_target[]
-__initconst = {
-#define PARAVIRT_BR_TARGET(name, type)                  \
-        {                                               \
-                &xen_ ## name,                          \
-                PARAVIRT_PATCH_TYPE_BR_ ## type,        \
-        }
-        PARAVIRT_BR_TARGET(switch_to, SWITCH_TO),
-        PARAVIRT_BR_TARGET(leave_syscall, LEAVE_SYSCALL),
-        PARAVIRT_BR_TARGET(work_processed_syscall, WORK_PROCESSED_SYSCALL),
-        PARAVIRT_BR_TARGET(leave_kernel, LEAVE_KERNEL),
-};
-static void __init
-xen_patch_branch(unsigned long tag, unsigned long type)
-{
-        __paravirt_patch_apply_branch(tag, type, xen_branch_target,
-                                        ARRAY_SIZE(xen_branch_target));
-}
diff --git a/arch/ia64/xen/xencomm.c b/arch/ia64/xen/xencomm.c
deleted file mode 100644
index 73d903ca2d64..000000000000
--- a/arch/ia64/xen/xencomm.c
+++ /dev/null
@@ -1,106 +0,0 @@
-/*
- * Copyright (C) 2006 Hollis Blanchard <hollisb@us.ibm.com>, IBM Corporation
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
- */
-#include <linux/mm.h>
-#include <linux/err.h>
-static unsigned long kernel_virtual_offset;
-static int is_xencomm_initialized;
-/* for xen early printk. It uses console io hypercall which uses xencomm.
- * However early printk may use it before xencomm initialization.
- */
-int
-xencomm_is_initialized(void)
-{
-        return is_xencomm_initialized;
-}
-void
-xencomm_initialize(void)
-{
-        kernel_virtual_offset = KERNEL_START - ia64_tpa(KERNEL_START);
-        is_xencomm_initialized = 1;
-}
-/* Translate virtual address to physical address.  */
-unsigned long
-xencomm_vtop(unsigned long vaddr)
-{
-        struct page *page;
-        struct vm_area_struct *vma;
-        if (vaddr == 0)
-                return 0UL;
-        if (REGION_NUMBER(vaddr) == 5) {
-                pgd_t *pgd;
-                pud_t *pud;
-                pmd_t *pmd;
-                pte_t *ptep;
-                /* On ia64, TASK_SIZE refers to current.  It is not initialized
-                   during boot.
-                   Furthermore the kernel is relocatable and __pa() doesn't
-                   work on  addresses.  */
-                if (vaddr >= KERNEL_START
-                    && vaddr < (KERNEL_START + KERNEL_TR_PAGE_SIZE))
-                        return vaddr - kernel_virtual_offset;
-                /* In kernel area -- virtually mapped.  */
-                pgd = pgd_offset_k(vaddr);
-                if (pgd_none(*pgd) || pgd_bad(*pgd))
-                        return ~0UL;
-                pud = pud_offset(pgd, vaddr);
-                if (pud_none(*pud) || pud_bad(*pud))
-                        return ~0UL;
-                pmd = pmd_offset(pud, vaddr);
-                if (pmd_none(*pmd) || pmd_bad(*pmd))
-                        return ~0UL;
-                ptep = pte_offset_kernel(pmd, vaddr);
-                if (!ptep)
-                        return ~0UL;
-                return (pte_val(*ptep) & _PFN_MASK) | (vaddr & ~PAGE_MASK);
-        }
-        if (vaddr > TASK_SIZE) {
-                /* percpu variables */
-                if (REGION_NUMBER(vaddr) == 7 &&
-                    REGION_OFFSET(vaddr) >= (1ULL << IA64_MAX_PHYS_BITS))
-                        ia64_tpa(vaddr);
-                /* kernel address */
-                return __pa(vaddr);
-        }
-        /* XXX double-check (lack of) locking */
-        vma = find_extend_vma(current->mm, vaddr);
-        if (!vma)
-                return ~0UL;
-        /* We assume the page is modified.  */
-        page = follow_page(vma, vaddr, FOLL_WRITE | FOLL_TOUCH);
-        if (IS_ERR_OR_NULL(page))
-                return ~0UL;
-        return (page_to_pfn(page) << PAGE_SHIFT) | (vaddr & ~PAGE_MASK);
-}
diff --git a/arch/ia64/xen/xenivt.S b/arch/ia64/xen/xenivt.S
deleted file mode 100644
index 3e71d50584d9..000000000000
--- a/arch/ia64/xen/xenivt.S
+++ /dev/null
@@ -1,52 +0,0 @@
-/*
- * arch/ia64/xen/ivt.S
- *
- * Copyright (C) 2005 Hewlett-Packard Co
- *      Dan Magenheimer <dan.magenheimer@hp.com>
- *
- * Copyright (c) 2008 Isaku Yamahata <yamahata at valinux co jp>
- *                    VA Linux Systems Japan K.K.
- *                    pv_ops.
- */
-#include <asm/asmmacro.h>
-#include <asm/kregs.h>
-#include <asm/pgtable.h>
-#include "../kernel/minstate.h"
-        .section .text,"ax"
-GLOBAL_ENTRY(xen_event_callback)
-        mov r31=pr              // prepare to save predicates
-        ;;
-        SAVE_MIN_WITH_COVER     // uses r31; defines r2 and r3
-        ;;
-        movl r3=XSI_PSR_IC
-        mov r14=1
-        ;;
-        st4 [r3]=r14
-        ;;
-        adds r3=8,r2            // set up second base pointer for SAVE_REST
-        srlz.i                  // ensure everybody knows psr.ic is back on
-        ;;
-        SAVE_REST
-        ;;
-1:
-        alloc r14=ar.pfs,0,0,1,0 // must be first in an insn group
-        add out0=16,sp          // pass pointer to pt_regs as first arg
-        ;;
-        br.call.sptk.many b0=xen_evtchn_do_upcall
-        ;;
-        movl r20=XSI_PSR_I_ADDR
-        ;;
-        ld8 r20=[r20]
-        ;;
-        adds r20=-1,r20         // vcpu_info->evtchn_upcall_pending
-        ;;
-        ld1 r20=[r20]
-        ;;
-        cmp.ne p6,p0=r20,r0     // if there are pending events,
-        (p6) br.spnt.few 1b     // call evtchn_do_upcall again.
-        br.sptk.many xen_leave_kernel   // we know ia64_leave_kernel is
-                                        // paravirtualized as xen_leave_kernel
-END(xen_event_callback)
diff --git a/arch/ia64/xen/xensetup.S b/arch/ia64/xen/xensetup.S
deleted file mode 100644
index e29519ebe2d2..000000000000
--- a/arch/ia64/xen/xensetup.S
+++ /dev/null
@@ -1,80 +0,0 @@
-/*
- * Support routines for Xen
- *
- * Copyright (C) 2005 Dan Magenheimer <dan.magenheimer@hp.com>
- */
-#include <asm/processor.h>
-#include <asm/asmmacro.h>
-#include <asm/pgtable.h>
-#include <asm/paravirt.h>
-#include <asm/xen/privop.h>
-#include <linux/elfnote.h>
-#include <linux/init.h>
-#include <xen/interface/elfnote.h>
-        .section .data..read_mostly
-        .align 8
-        .global xen_domain_type
-xen_domain_type:
-        data4 XEN_NATIVE_ASM
-        .previous
-        __INIT
-ENTRY(startup_xen)
-        // Calculate load offset.
-        // The constant, LOAD_OFFSET, can't be used because the boot
-        // loader doesn't always load to the LMA specified by the vmlinux.lds.
-        mov r9=ip       // must be the first instruction to make sure
-                        // that r9 = the physical address of startup_xen.
-                        // Usually r9 = startup_xen - LOAD_OFFSET
-        movl r8=startup_xen
-        ;;
-        sub r9=r9,r8    // Usually r9 = -LOAD_OFFSET.
-        mov r10=PARAVIRT_HYPERVISOR_TYPE_XEN
-        movl r11=_start
-        ;;
-        add r11=r11,r9
-        movl r8=hypervisor_type
-        ;;
-        add r8=r8,r9
-        mov b0=r11
-        ;;
-        st8 [r8]=r10
-        br.cond.sptk.many b0
-        ;;
-END(startup_xen)
-        ELFNOTE(Xen, XEN_ELFNOTE_GUEST_OS,      .asciz "linux")
-        ELFNOTE(Xen, XEN_ELFNOTE_GUEST_VERSION, .asciz "2.6")
-        ELFNOTE(Xen, XEN_ELFNOTE_XEN_VERSION,   .asciz "xen-3.0")
-        ELFNOTE(Xen, XEN_ELFNOTE_ENTRY,         data8.ua startup_xen - LOAD_OFFSET)
-#define isBP    p3      // are we the Bootstrap Processor?
-GLOBAL_ENTRY(xen_setup_hook)
-        mov r8=XEN_PV_DOMAIN_ASM
-(isBP)  movl r9=xen_domain_type;;
-(isBP)  st4 [r9]=r8
-        movl r10=xen_ivt;;
-        mov cr.iva=r10
-        /* Set xsi base.  */
-#define FW_HYPERCALL_SET_SHARED_INFO_VA                 0x600
-(isBP)  mov r2=FW_HYPERCALL_SET_SHARED_INFO_VA
-(isBP)  movl r28=XSI_BASE;;
-(isBP)  break 0x1000;;
-        /* setup pv_ops */
-(isBP)  mov r4=rp
-        ;;
-(isBP)  br.call.sptk.many rp=xen_setup_pv_ops
-        ;;
-(isBP)  mov rp=r4
-        ;;
-        br.ret.sptk.many rp
-        ;;
-END(xen_setup_hook)
diff --git a/arch/m32r/include/asm/barrier.h b/arch/m32r/include/asm/barrier.h
index 6976621efd3f..1a40265e8d88 100644
--- a/arch/m32r/include/asm/barrier.h
+++ b/arch/m32r/include/asm/barrier.h
@@ -11,84 +11,6 @@
 #define nop()  __asm__ __volatile__ ("nop" : : )
-/*
+#include <asm-generic/barrier.h>
- * Memory barrier.
- *
- * mb() prevents loads and stores being reordered across this point.
- * rmb() prevents loads being reordered across this point.
- * wmb() prevents stores being reordered across this point.
- */
-#define mb()   barrier()
-#define rmb()  mb()
-#define wmb()  mb()
-/**
- * read_barrier_depends - Flush all pending reads that subsequents reads
- * depend on.
- *
- * No data-dependent reads from memory-like regions are ever reordered
- * over this barrier.  All reads preceding this primitive are guaranteed
- * to access memory (but not necessarily other CPUs' caches) before any
- * reads following this primitive that depend on the data return by
- * any of the preceding reads.  This primitive is much lighter weight than
- * rmb() on most CPUs, and is never heavier weight than is
- * rmb().
- *
- * These ordering constraints are respected by both the local CPU
- * and the compiler.
- *
- * Ordering is not guaranteed by anything other than these primitives,
- * not even by data dependencies.  See the documentation for
- * memory_barrier() for examples and URLs to more information.
- *
- * For example, the following code would force ordering (the initial
- * value of "a" is zero, "b" is one, and "p" is "&a"):
- *
- * <programlisting>
- *      CPU 0                           CPU 1
- *
- *      b = 2;
- *      memory_barrier();
- *      p = &b;                         q = p;
- *                                      read_barrier_depends();
- *                                      d = *q;
- * </programlisting>
- *
- *
- * because the read of "*q" depends on the read of "p" and these
- * two reads are separated by a read_barrier_depends().  However,
- * the following code, with the same initial values for "a" and "b":
- *
- * <programlisting>
- *      CPU 0                           CPU 1
- *
- *      a = 2;
- *      memory_barrier();
- *      b = 3;                          y = b;
- *                                      read_barrier_depends();
- *                                      x = a;
- * </programlisting>
- *
- * does not enforce ordering, since there is no data dependency between
- * the read of "a" and the read of "b".  Therefore, on some CPUs, such
- * as Alpha, "y" could be set to 3 and "x" to 0.  Use rmb()
- * in cases like this where there are no data dependencies.
- **/
-#define read_barrier_depends()  do { } while (0)
-#ifdef CONFIG_SMP
-#define smp_mb()        mb()
-#define smp_rmb()       rmb()
-#define smp_wmb()       wmb()
-#define smp_read_barrier_depends()      read_barrier_depends()
-#define set_mb(var, value) do { (void) xchg(&var, value); } while (0)
-#else
-#define smp_mb()        barrier()
-#define smp_rmb()       barrier()
-#define smp_wmb()       barrier()
-#define smp_read_barrier_depends()      do { } while (0)
-#define set_mb(var, value) do { var = value; barrier(); } while (0)
-#endif
 #endif /* _ASM_M32R_BARRIER_H */
diff --git a/arch/m68k/Kconfig b/arch/m68k/Kconfig
index 75f25a8e3001..dbdd2231c75d 100644
--- a/arch/m68k/Kconfig
+++ b/arch/m68k/Kconfig
@@ -87,6 +87,30 @@ config MMU_SUN3
        bool
        depends on MMU && !MMU_MOTOROLA && !MMU_COLDFIRE
+config KEXEC
+        bool "kexec system call"
+        depends on M68KCLASSIC
+        help
+          kexec is a system call that implements the ability to shutdown your
+          current kernel, and to start another kernel.  It is like a reboot
+          but it is independent of the system firmware.   And like a reboot
+          you can start any kernel with it, not just Linux.
+          The name comes from the similarity to the exec system call.
+          It is an ongoing process to be certain the hardware in a machine
+          is properly shutdown, so do not be surprised if this code does not
+          initially work for you.  As of this writing the exact hardware
+          interface is strongly in flux, so no good recommendation can be
+          made.
+config BOOTINFO_PROC
+        bool "Export bootinfo in procfs"
+        depends on KEXEC && M68KCLASSIC
+        help
+          Say Y to export the bootinfo used to boot the kernel in a
+          "bootinfo" file in procfs.  This is useful with kexec.
 menu "Platform setup"
 source arch/m68k/Kconfig.cpu
diff --git a/arch/m68k/amiga/chipram.c b/arch/m68k/amiga/chipram.c
index 99449fbf9a72..ba03cec3f711 100644
--- a/arch/m68k/amiga/chipram.c
+++ b/arch/m68k/amiga/chipram.c
@@ -87,7 +87,7 @@ void *amiga_chip_alloc_res(unsigned long size, struct resource *res)
        atomic_sub(size, &chipavail);
        pr_debug("amiga_chip_alloc_res: returning %pR\n", res);
-        return (void *)ZTWO_VADDR(res->start);
+        return ZTWO_VADDR(res->start);
 }
 void amiga_chip_free(void *ptr)
diff --git a/arch/m68k/amiga/config.c b/arch/m68k/amiga/config.c
index b819390e29cd..9625b7132227 100644
--- a/arch/m68k/amiga/config.c
+++ b/arch/m68k/amiga/config.c
@@ -28,6 +28,8 @@
 #include <linux/keyboard.h>
 #include <asm/bootinfo.h>
+#include <asm/bootinfo-amiga.h>
+#include <asm/byteorder.h>
 #include <asm/setup.h>
 #include <asm/pgtable.h>
 #include <asm/amigahw.h>
@@ -140,46 +142,46 @@ static struct resource ram_resource[NUM_MEMINFO];
     *  Parse an Amiga-specific record in the bootinfo
     */
-int amiga_parse_bootinfo(const struct bi_record *record)
+int __init amiga_parse_bootinfo(const struct bi_record *record)
 {
        int unknown = 0;
-        const unsigned long *data = record->data;
+        const void *data = record->data;
-        switch (record->tag) {
+        switch (be16_to_cpu(record->tag)) {
        case BI_AMIGA_MODEL:
-                amiga_model = *data;
+                amiga_model = be32_to_cpup(data);
                break;
        case BI_AMIGA_ECLOCK:
-                amiga_eclock = *data;
+                amiga_eclock = be32_to_cpup(data);
                break;
        case BI_AMIGA_CHIPSET:
-                amiga_chipset = *data;
+                amiga_chipset = be32_to_cpup(data);
                break;
        case BI_AMIGA_CHIP_SIZE:
-                amiga_chip_size = *(const int *)data;
+                amiga_chip_size = be32_to_cpup(data);
                break;
        case BI_AMIGA_VBLANK:
-                amiga_vblank = *(const unsigned char *)data;
+                amiga_vblank = *(const __u8 *)data;
                break;
        case BI_AMIGA_PSFREQ:
-                amiga_psfreq = *(const unsigned char *)data;
+                amiga_psfreq = *(const __u8 *)data;
                break;
        case BI_AMIGA_AUTOCON:
 #ifdef CONFIG_ZORRO
                if (zorro_num_autocon < ZORRO_NUM_AUTO) {
-                        const struct ConfigDev *cd = (struct ConfigDev *)data;
+                        const struct ConfigDev *cd = data;
-                        struct zorro_dev *dev = &zorro_autocon[zorro_num_autocon++];
+                        struct zorro_dev_init *dev = &zorro_autocon_init[zorro_num_autocon++];
                        dev->rom = cd->cd_Rom;
-                        dev->slotaddr = cd->cd_SlotAddr;
+                        dev->slotaddr = be16_to_cpu(cd->cd_SlotAddr);
-                        dev->slotsize = cd->cd_SlotSize;
+                        dev->slotsize = be16_to_cpu(cd->cd_SlotSize);
-                        dev->resource.start = (unsigned long)cd->cd_BoardAddr;
+                        dev->boardaddr = be32_to_cpu(cd->cd_BoardAddr);
-                        dev->resource.end = dev->resource.start + cd->cd_BoardSize - 1;
+                        dev->boardsize = be32_to_cpu(cd->cd_BoardSize);
                } else
                        printk("amiga_parse_bootinfo: too many AutoConfig devices\n");
 #endif /* CONFIG_ZORRO */
@@ -358,6 +360,14 @@ static void __init amiga_identify(void)
 #undef AMIGAHW_ANNOUNCE
 }
+static unsigned long amiga_random_get_entropy(void)
+{
+        /* VPOSR/VHPOSR provide at least 17 bits of data changing at 1.79 MHz */
+        return *(unsigned long *)&amiga_custom.vposr;
+}
    /*
     *  Setup the Amiga configuration info
     */
@@ -395,6 +405,8 @@ void __init config_amiga(void)
        mach_heartbeat = amiga_heartbeat;
 #endif
+        mach_random_get_entropy = amiga_random_get_entropy;
        /* Fill in the clock value (based on the 700 kHz E-Clock) */
        amiga_colorclock = 5*amiga_eclock;      /* 3.5 MHz */
@@ -608,6 +620,8 @@ static void amiga_mem_console_write(struct console *co, const char *s,
 static int __init amiga_savekmsg_setup(char *arg)
 {
+        bool registered;
        if (!MACH_IS_AMIGA || strcmp(arg, "mem"))
                return 0;
@@ -618,14 +632,16 @@ static int __init amiga_savekmsg_setup(char *arg)
        /* Just steal the block, the chipram allocator isn't functional yet */
        amiga_chip_size -= SAVEKMSG_MAXMEM;
-        savekmsg = (void *)ZTWO_VADDR(CHIP_PHYSADDR + amiga_chip_size);
+        savekmsg = ZTWO_VADDR(CHIP_PHYSADDR + amiga_chip_size);
        savekmsg->magic1 = SAVEKMSG_MAGIC1;
        savekmsg->magic2 = SAVEKMSG_MAGIC2;
        savekmsg->magicptr = ZTWO_PADDR(savekmsg);
        savekmsg->size = 0;
+        registered = !!amiga_console_driver.write;
        amiga_console_driver.write = amiga_mem_console_write;
-        register_console(&amiga_console_driver);
+        if (!registered)
+                register_console(&amiga_console_driver);
        return 0;
 }
@@ -707,11 +723,16 @@ void amiga_serial_gets(struct console *co, char *s, int len)
 static int __init amiga_debug_setup(char *arg)
 {
-        if (MACH_IS_AMIGA && !strcmp(arg, "ser")) {
+        bool registered;
-                /* no initialization required (?) */
-                amiga_console_driver.write = amiga_serial_console_write;
+        if (!MACH_IS_AMIGA || strcmp(arg, "ser"))
+                return 0;
+        /* no initialization required (?) */
+        registered = !!amiga_console_driver.write;
+        amiga_console_driver.write = amiga_serial_console_write;
+        if (!registered)
                register_console(&amiga_console_driver);
-        }
        return 0;
 }
diff --git a/arch/m68k/amiga/platform.c b/arch/m68k/amiga/platform.c
index dacd9f911f71..d34029d7b058 100644
--- a/arch/m68k/amiga/platform.c
+++ b/arch/m68k/amiga/platform.c
@@ -13,6 +13,7 @@
 #include <asm/amigahw.h>
 #include <asm/amigayle.h>
+#include <asm/byteorder.h>
 #ifdef CONFIG_ZORRO
@@ -66,10 +67,12 @@ static int __init z_dev_present(zorro_id id)
 {
        unsigned int i;
-        for (i = 0; i < zorro_num_autocon; i++)
+        for (i = 0; i < zorro_num_autocon; i++) {
-                if (zorro_autocon[i].rom.er_Manufacturer == ZORRO_MANUF(id) &&
+                const struct ExpansionRom *rom = &zorro_autocon_init[i].rom;
-                    zorro_autocon[i].rom.er_Product == ZORRO_PROD(id))
+                if (be16_to_cpu(rom->er_Manufacturer) == ZORRO_MANUF(id) &&
+                    rom->er_Product == ZORRO_PROD(id))
                        return 1;
+        }
        return 0;
 }
diff --git a/arch/m68k/apollo/config.c b/arch/m68k/apollo/config.c
index 3ea56b90e718..9268c0f96376 100644
--- a/arch/m68k/apollo/config.c
+++ b/arch/m68k/apollo/config.c
@@ -1,3 +1,4 @@
+#include <linux/init.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
@@ -9,6 +10,8 @@
 #include <asm/setup.h>
 #include <asm/bootinfo.h>
+#include <asm/bootinfo-apollo.h>
+#include <asm/byteorder.h>
 #include <asm/pgtable.h>
 #include <asm/apollohw.h>
 #include <asm/irq.h>
@@ -43,26 +46,25 @@ static const char *apollo_models[] = {
        [APOLLO_DN4500-APOLLO_DN3000] = "DN4500 (Roadrunner)"
 };
-int apollo_parse_bootinfo(const struct bi_record *record) {
+int __init apollo_parse_bootinfo(const struct bi_record *record)
+{
        int unknown = 0;
-        const unsigned long *data = record->data;
+        const void *data = record->data;
-        switch(record->tag) {
+        switch (be16_to_cpu(record->tag)) {
-                case BI_APOLLO_MODEL:
+        case BI_APOLLO_MODEL:
-                        apollo_model=*data;
+                apollo_model = be32_to_cpup(data);
-                        break;
+                break;
-                default:
+        default:
-                         unknown=1;
+                 unknown=1;
        }
        return unknown;
 }
-void dn_setup_model(void) {
+static void __init dn_setup_model(void)
+{
        printk("Apollo hardware found: ");
        printk("[%s]\n", apollo_models[apollo_model - APOLLO_DN3000]);
diff --git a/arch/m68k/atari/ataints.c b/arch/m68k/atari/ataints.c
index 20cde4e9fc77..3e73a63c066f 100644
--- a/arch/m68k/atari/ataints.c
+++ b/arch/m68k/atari/ataints.c
@@ -333,6 +333,9 @@ void __init atari_init_IRQ(void)
        m68k_setup_irq_controller(&atari_mfptimer_chip, handle_simple_irq,
                                  IRQ_MFP_TIMER1, 8);
+        irq_set_status_flags(IRQ_MFP_TIMER1, IRQ_IS_POLLED);
+        irq_set_status_flags(IRQ_MFP_TIMER2, IRQ_IS_POLLED);
        /* prepare timer D data for use as poll interrupt */
        /* set Timer D data Register - needs to be > 0 */
        st_mfp.tim_dt_d = 254;  /* < 100 Hz */
diff --git a/arch/m68k/atari/config.c b/arch/m68k/atari/config.c
index fb2d0bd9b3ad..01a62161b08a 100644
--- a/arch/m68k/atari/config.c
+++ b/arch/m68k/atari/config.c
@@ -37,6 +37,8 @@
 #include <linux/module.h>
 #include <asm/bootinfo.h>
+#include <asm/bootinfo-atari.h>
+#include <asm/byteorder.h>
 #include <asm/setup.h>
 #include <asm/atarihw.h>
 #include <asm/atariints.h>
@@ -129,14 +131,14 @@ static int __init scc_test(volatile char *ctla)
 int __init atari_parse_bootinfo(const struct bi_record *record)
 {
        int unknown = 0;
-        const u_long *data = record->data;
+        const void *data = record->data;
-        switch (record->tag) {
+        switch (be16_to_cpu(record->tag)) {
        case BI_ATARI_MCH_COOKIE:
-                atari_mch_cookie = *data;
+                atari_mch_cookie = be32_to_cpup(data);
                break;
        case BI_ATARI_MCH_TYPE:
-                atari_mch_type = *data;
+                atari_mch_type = be32_to_cpup(data);
                break;
        default:
                unknown = 1;
diff --git a/arch/m68k/atari/debug.c b/arch/m68k/atari/debug.c
index a547ba9683d1..03cb5e08d7cf 100644
--- a/arch/m68k/atari/debug.c
+++ b/arch/m68k/atari/debug.c
@@ -287,6 +287,8 @@ static void __init atari_init_midi_port(int cflag)
 static int __init atari_debug_setup(char *arg)
 {
+        bool registered;
        if (!MACH_IS_ATARI)
                return 0;
@@ -294,6 +296,7 @@ static int __init atari_debug_setup(char *arg)
                /* defaults to ser2 for a Falcon and ser1 otherwise */
                arg = MACH_IS_FALCON ? "ser2" : "ser1";
+        registered = !!atari_console_driver.write;
        if (!strcmp(arg, "ser1")) {
                /* ST-MFP Modem1 serial port */
                atari_init_mfp_port(B9600|CS8);
@@ -317,7 +320,7 @@ static int __init atari_debug_setup(char *arg)
                sound_ym.wd_data = sound_ym.rd_data_reg_sel | 0x20; /* strobe H */
                atari_console_driver.write = atari_par_console_write;
        }
-        if (atari_console_driver.write)
+        if (atari_console_driver.write && !registered)
                register_console(&atari_console_driver);
        return 0;
diff --git a/arch/m68k/bvme6000/config.c b/arch/m68k/bvme6000/config.c
index 8943aa4c18e6..478623dbb209 100644
--- a/arch/m68k/bvme6000/config.c
+++ b/arch/m68k/bvme6000/config.c
@@ -28,6 +28,8 @@
 #include <linux/bcd.h>
 #include <asm/bootinfo.h>
+#include <asm/bootinfo-vme.h>
+#include <asm/byteorder.h>
 #include <asm/pgtable.h>
 #include <asm/setup.h>
 #include <asm/irq.h>
@@ -50,9 +52,9 @@ void bvme6000_set_vectors (void);
 static irq_handler_t tick_handler;
-int bvme6000_parse_bootinfo(const struct bi_record *bi)
+int __init bvme6000_parse_bootinfo(const struct bi_record *bi)
 {
-        if (bi->tag == BI_VME_TYPE)
+        if (be16_to_cpu(bi->tag) == BI_VME_TYPE)
                return 0;
        else
                return 1;
diff --git a/arch/m68k/configs/amiga_defconfig b/arch/m68k/configs/amiga_defconfig
index 19325e117eea..559ff3af8ff7 100644
--- a/arch/m68k/configs/amiga_defconfig
+++ b/arch/m68k/configs/amiga_defconfig
@@ -52,7 +52,6 @@ CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
 CONFIG_NET_IPGRE=m
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -63,11 +62,11 @@ CONFIG_INET_XFRM_MODE_BEET=m
 # CONFIG_INET_LRO is not set
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
-CONFIG_IPV6_PRIVACY=y
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_VTI=m
 CONFIG_IPV6_GRE=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
@@ -85,6 +84,17 @@ CONFIG_NF_CONNTRACK_PPTP=m
 CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_TABLES=m
+CONFIG_NFT_EXTHDR=m
+CONFIG_NFT_META=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_RBTREE=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_COMPAT=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -98,6 +108,7 @@ CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
 CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
@@ -130,6 +141,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -144,11 +156,18 @@ CONFIG_IP_SET_HASH_IP=m
 CONFIG_IP_SET_HASH_IPPORT=m
 CONFIG_IP_SET_HASH_IPPORTIP=m
 CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NETPORTNET=m
 CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_TABLES_IPV4=m
+CONFIG_NFT_REJECT_IPV4=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NF_TABLES_ARP=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -156,6 +175,7 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -170,6 +190,9 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_TABLES_IPV6=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -183,11 +206,13 @@ CONFIG_IP6_NF_MATCH_RT=m
 CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_IP_DCCP=m
 # CONFIG_IP_DCCP_CCID3 is not set
 CONFIG_SCTP_COOKIE_HMAC_SHA1=y
@@ -195,10 +220,13 @@ CONFIG_RDS=m
 CONFIG_RDS_TCP=m
 CONFIG_L2TP=m
 CONFIG_ATALK=m
+CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
+CONFIG_BATMAN_ADV_NC=y
+CONFIG_NETLINK_DIAG=m
+CONFIG_NET_MPLS_GSO=m
 # CONFIG_WIRELESS is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 # CONFIG_FW_LOADER_USER_HELPER is not set
@@ -216,6 +244,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_ATA_OVER_ETH=m
+CONFIG_DUMMY_IRQ=m
 CONFIG_IDE=y
 CONFIG_IDE_GD_ATAPI=y
 CONFIG_BLK_DEV_IDECD=y
@@ -262,6 +291,7 @@ CONFIG_EQUALIZER=m
 CONFIG_NET_TEAM=m
 CONFIG_NET_TEAM_MODE_BROADCAST=m
 CONFIG_NET_TEAM_MODE_ROUNDROBIN=m
+CONFIG_NET_TEAM_MODE_RANDOM=m
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
 CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_VXLAN=m
@@ -271,10 +301,10 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_3COM is not set
 CONFIG_A2065=y
 CONFIG_ARIADNE=y
+# CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
 # CONFIG_NET_VENDOR_CIRRUS is not set
-# CONFIG_NET_VENDOR_FUJITSU is not set
 # CONFIG_NET_VENDOR_HP is not set
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
@@ -285,6 +315,7 @@ CONFIG_ZORRO8390=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -311,7 +342,6 @@ CONFIG_JOYSTICK_AMIGA=m
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_M68K_BEEP=m
 # CONFIG_SERIO is not set
-CONFIG_VT_HW_CONSOLE_BINDING=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_PRINTER=m
@@ -345,10 +375,6 @@ CONFIG_HEARTBEAT=y
 CONFIG_PROC_HARDWARE=y
 CONFIG_AMIGA_BUILTIN_SERIAL=y
 CONFIG_SERIAL_CONSOLE=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
 CONFIG_EXT4_FS=y
 CONFIG_REISERFS_FS=m
 CONFIG_JFS_FS=m
@@ -385,7 +411,7 @@ CONFIG_QNX6FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_SWAP=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
@@ -444,10 +470,10 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_ASYNC_RAID6_TEST=m
+CONFIG_TEST_STRING_HELPERS=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
@@ -480,6 +506,8 @@ CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_LZ4HC=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
diff --git a/arch/m68k/configs/apollo_defconfig b/arch/m68k/configs/apollo_defconfig
index 14dc6ccda7f4..cb1f55df69b6 100644
--- a/arch/m68k/configs/apollo_defconfig
+++ b/arch/m68k/configs/apollo_defconfig
@@ -50,7 +50,6 @@ CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
 CONFIG_NET_IPGRE=m
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -61,11 +60,11 @@ CONFIG_INET_XFRM_MODE_BEET=m
 # CONFIG_INET_LRO is not set
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
-CONFIG_IPV6_PRIVACY=y
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_VTI=m
 CONFIG_IPV6_GRE=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
@@ -83,6 +82,17 @@ CONFIG_NF_CONNTRACK_PPTP=m
 CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_TABLES=m
+CONFIG_NFT_EXTHDR=m
+CONFIG_NFT_META=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_RBTREE=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_COMPAT=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -96,6 +106,7 @@ CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
 CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
@@ -128,6 +139,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -142,11 +154,18 @@ CONFIG_IP_SET_HASH_IP=m
 CONFIG_IP_SET_HASH_IPPORT=m
 CONFIG_IP_SET_HASH_IPPORTIP=m
 CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NETPORTNET=m
 CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_TABLES_IPV4=m
+CONFIG_NFT_REJECT_IPV4=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NF_TABLES_ARP=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -154,6 +173,7 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -168,6 +188,9 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_TABLES_IPV6=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -181,11 +204,13 @@ CONFIG_IP6_NF_MATCH_RT=m
 CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_IP_DCCP=m
 # CONFIG_IP_DCCP_CCID3 is not set
 CONFIG_SCTP_COOKIE_HMAC_SHA1=y
@@ -193,10 +218,13 @@ CONFIG_RDS=m
 CONFIG_RDS_TCP=m
 CONFIG_L2TP=m
 CONFIG_ATALK=m
+CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
+CONFIG_BATMAN_ADV_NC=y
+CONFIG_NETLINK_DIAG=m
+CONFIG_NET_MPLS_GSO=m
 # CONFIG_WIRELESS is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 # CONFIG_FW_LOADER_USER_HELPER is not set
@@ -208,6 +236,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_ATA_OVER_ETH=m
+CONFIG_DUMMY_IRQ=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_SCSI_TGT=m
@@ -244,12 +273,14 @@ CONFIG_EQUALIZER=m
 CONFIG_NET_TEAM=m
 CONFIG_NET_TEAM_MODE_BROADCAST=m
 CONFIG_NET_TEAM_MODE_ROUNDROBIN=m
+CONFIG_NET_TEAM_MODE_RANDOM=m
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
 CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_VXLAN=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
+# CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
 # CONFIG_NET_VENDOR_INTEL is not set
@@ -258,6 +289,7 @@ CONFIG_VETH=m
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -279,7 +311,6 @@ CONFIG_INPUT_EVDEV=m
 # CONFIG_MOUSE_PS2 is not set
 CONFIG_MOUSE_SERIAL=m
 CONFIG_SERIO=m
-CONFIG_VT_HW_CONSOLE_BINDING=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_DEVKMEM is not set
 # CONFIG_HW_RANDOM is not set
@@ -302,10 +333,6 @@ CONFIG_RTC_DRV_GENERIC=m
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_HEARTBEAT=y
 CONFIG_PROC_HARDWARE=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
 CONFIG_EXT4_FS=y
 CONFIG_REISERFS_FS=m
 CONFIG_JFS_FS=m
@@ -342,7 +369,7 @@ CONFIG_QNX6FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_SWAP=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
@@ -401,10 +428,10 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_ASYNC_RAID6_TEST=m
+CONFIG_TEST_STRING_HELPERS=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
@@ -437,6 +464,8 @@ CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_LZ4HC=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
diff --git a/arch/m68k/configs/atari_defconfig b/arch/m68k/configs/atari_defconfig
index 6d5370c914b2..e880cfbb62d9 100644
--- a/arch/m68k/configs/atari_defconfig
+++ b/arch/m68k/configs/atari_defconfig
@@ -49,7 +49,6 @@ CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
 CONFIG_NET_IPGRE=m
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -60,11 +59,11 @@ CONFIG_INET_XFRM_MODE_BEET=m
 # CONFIG_INET_LRO is not set
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
-CONFIG_IPV6_PRIVACY=y
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_VTI=m
 CONFIG_IPV6_GRE=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
@@ -82,6 +81,17 @@ CONFIG_NF_CONNTRACK_PPTP=m
 CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_TABLES=m
+CONFIG_NFT_EXTHDR=m
+CONFIG_NFT_META=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_RBTREE=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_COMPAT=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -95,6 +105,7 @@ CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
 CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
@@ -127,6 +138,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -141,11 +153,18 @@ CONFIG_IP_SET_HASH_IP=m
 CONFIG_IP_SET_HASH_IPPORT=m
 CONFIG_IP_SET_HASH_IPPORTIP=m
 CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NETPORTNET=m
 CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_TABLES_IPV4=m
+CONFIG_NFT_REJECT_IPV4=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NF_TABLES_ARP=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -153,6 +172,7 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -167,6 +187,9 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_TABLES_IPV6=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -180,11 +203,13 @@ CONFIG_IP6_NF_MATCH_RT=m
 CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_IP_DCCP=m
 # CONFIG_IP_DCCP_CCID3 is not set
 CONFIG_SCTP_COOKIE_HMAC_SHA1=y
@@ -192,10 +217,13 @@ CONFIG_RDS=m
 CONFIG_RDS_TCP=m
 CONFIG_L2TP=m
 CONFIG_ATALK=m
+CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
+CONFIG_BATMAN_ADV_NC=y
+CONFIG_NETLINK_DIAG=m
+CONFIG_NET_MPLS_GSO=m
 # CONFIG_WIRELESS is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 # CONFIG_FW_LOADER_USER_HELPER is not set
@@ -211,6 +239,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_ATA_OVER_ETH=m
+CONFIG_DUMMY_IRQ=m
 CONFIG_IDE=y
 CONFIG_IDE_GD_ATAPI=y
 CONFIG_BLK_DEV_IDECD=y
@@ -249,10 +278,10 @@ CONFIG_TCM_PSCSI=m
 CONFIG_NETDEVICES=y
 CONFIG_DUMMY=m
 CONFIG_EQUALIZER=m
-CONFIG_MII=y
 CONFIG_NET_TEAM=m
 CONFIG_NET_TEAM_MODE_BROADCAST=m
 CONFIG_NET_TEAM_MODE_ROUNDROBIN=m
+CONFIG_NET_TEAM_MODE_RANDOM=m
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
 CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_VXLAN=m
@@ -260,6 +289,7 @@ CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 CONFIG_ATARILANCE=y
+# CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
 # CONFIG_NET_VENDOR_INTEL is not set
@@ -267,6 +297,7 @@ CONFIG_ATARILANCE=y
 # CONFIG_NET_VENDOR_MICREL is not set
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -291,7 +322,6 @@ CONFIG_MOUSE_ATARI=m
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_M68K_BEEP=m
 # CONFIG_SERIO is not set
-CONFIG_VT_HW_CONSOLE_BINDING=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_PRINTER=m
@@ -320,10 +350,6 @@ CONFIG_NFBLOCK=y
 CONFIG_NFCON=y
 CONFIG_NFETH=y
 CONFIG_ATARI_DSP56K=m
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
 CONFIG_EXT4_FS=y
 CONFIG_REISERFS_FS=m
 CONFIG_JFS_FS=m
@@ -360,7 +386,7 @@ CONFIG_QNX6FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_SWAP=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
@@ -419,10 +445,10 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_ASYNC_RAID6_TEST=m
+CONFIG_TEST_STRING_HELPERS=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
@@ -455,6 +481,8 @@ CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_LZ4HC=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
diff --git a/arch/m68k/configs/bvme6000_defconfig b/arch/m68k/configs/bvme6000_defconfig
index c015ddb6fd80..4aa4f45e52a8 100644
--- a/arch/m68k/configs/bvme6000_defconfig
+++ b/arch/m68k/configs/bvme6000_defconfig
@@ -48,7 +48,6 @@ CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
 CONFIG_NET_IPGRE=m
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -59,11 +58,11 @@ CONFIG_INET_XFRM_MODE_BEET=m
 # CONFIG_INET_LRO is not set
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
-CONFIG_IPV6_PRIVACY=y
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_VTI=m
 CONFIG_IPV6_GRE=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
@@ -81,6 +80,17 @@ CONFIG_NF_CONNTRACK_PPTP=m
 CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_TABLES=m
+CONFIG_NFT_EXTHDR=m
+CONFIG_NFT_META=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_RBTREE=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_COMPAT=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -94,6 +104,7 @@ CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
 CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
@@ -126,6 +137,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -140,11 +152,18 @@ CONFIG_IP_SET_HASH_IP=m
 CONFIG_IP_SET_HASH_IPPORT=m
 CONFIG_IP_SET_HASH_IPPORTIP=m
 CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NETPORTNET=m
 CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_TABLES_IPV4=m
+CONFIG_NFT_REJECT_IPV4=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NF_TABLES_ARP=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -152,6 +171,7 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -166,6 +186,9 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_TABLES_IPV6=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -179,11 +202,13 @@ CONFIG_IP6_NF_MATCH_RT=m
 CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_IP_DCCP=m
 # CONFIG_IP_DCCP_CCID3 is not set
 CONFIG_SCTP_COOKIE_HMAC_SHA1=y
@@ -191,10 +216,13 @@ CONFIG_RDS=m
 CONFIG_RDS_TCP=m
 CONFIG_L2TP=m
 CONFIG_ATALK=m
+CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
+CONFIG_BATMAN_ADV_NC=y
+CONFIG_NETLINK_DIAG=m
+CONFIG_NET_MPLS_GSO=m
 # CONFIG_WIRELESS is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 # CONFIG_FW_LOADER_USER_HELPER is not set
@@ -206,6 +234,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_ATA_OVER_ETH=m
+CONFIG_DUMMY_IRQ=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_SCSI_TGT=m
@@ -243,12 +272,14 @@ CONFIG_EQUALIZER=m
 CONFIG_NET_TEAM=m
 CONFIG_NET_TEAM_MODE_BROADCAST=m
 CONFIG_NET_TEAM_MODE_ROUNDROBIN=m
+CONFIG_NET_TEAM_MODE_RANDOM=m
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
 CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_VXLAN=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
+# CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
 CONFIG_BVME6000_NET=y
@@ -257,6 +288,7 @@ CONFIG_BVME6000_NET=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -294,10 +326,6 @@ CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_GENERIC=m
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_PROC_HARDWARE=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
 CONFIG_EXT4_FS=y
 CONFIG_REISERFS_FS=m
 CONFIG_JFS_FS=m
@@ -334,7 +362,7 @@ CONFIG_QNX6FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_SWAP=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
@@ -393,10 +421,10 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_ASYNC_RAID6_TEST=m
+CONFIG_TEST_STRING_HELPERS=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
@@ -429,6 +457,8 @@ CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_LZ4HC=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
diff --git a/arch/m68k/configs/hp300_defconfig b/arch/m68k/configs/hp300_defconfig
index ec7382d8afff..7cd9d9f456fb 100644
--- a/arch/m68k/configs/hp300_defconfig
+++ b/arch/m68k/configs/hp300_defconfig
@@ -50,7 +50,6 @@ CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
 CONFIG_NET_IPGRE=m
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -61,11 +60,11 @@ CONFIG_INET_XFRM_MODE_BEET=m
 # CONFIG_INET_LRO is not set
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
-CONFIG_IPV6_PRIVACY=y
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_VTI=m
 CONFIG_IPV6_GRE=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
@@ -83,6 +82,17 @@ CONFIG_NF_CONNTRACK_PPTP=m
 CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_TABLES=m
+CONFIG_NFT_EXTHDR=m
+CONFIG_NFT_META=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_RBTREE=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_COMPAT=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -96,6 +106,7 @@ CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
 CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
@@ -128,6 +139,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -142,11 +154,18 @@ CONFIG_IP_SET_HASH_IP=m
 CONFIG_IP_SET_HASH_IPPORT=m
 CONFIG_IP_SET_HASH_IPPORTIP=m
 CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NETPORTNET=m
 CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_TABLES_IPV4=m
+CONFIG_NFT_REJECT_IPV4=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NF_TABLES_ARP=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -154,6 +173,7 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -168,6 +188,9 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_TABLES_IPV6=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -181,11 +204,13 @@ CONFIG_IP6_NF_MATCH_RT=m
 CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_IP_DCCP=m
 # CONFIG_IP_DCCP_CCID3 is not set
 CONFIG_SCTP_COOKIE_HMAC_SHA1=y
@@ -193,10 +218,13 @@ CONFIG_RDS=m
 CONFIG_RDS_TCP=m
 CONFIG_L2TP=m
 CONFIG_ATALK=m
+CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
+CONFIG_BATMAN_ADV_NC=y
+CONFIG_NETLINK_DIAG=m
+CONFIG_NET_MPLS_GSO=m
 # CONFIG_WIRELESS is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 # CONFIG_FW_LOADER_USER_HELPER is not set
@@ -208,6 +236,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_ATA_OVER_ETH=m
+CONFIG_DUMMY_IRQ=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_SCSI_TGT=m
@@ -244,6 +273,7 @@ CONFIG_EQUALIZER=m
 CONFIG_NET_TEAM=m
 CONFIG_NET_TEAM_MODE_BROADCAST=m
 CONFIG_NET_TEAM_MODE_ROUNDROBIN=m
+CONFIG_NET_TEAM_MODE_RANDOM=m
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
 CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_VXLAN=m
@@ -251,6 +281,7 @@ CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 CONFIG_HPLANCE=y
+# CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
 # CONFIG_NET_VENDOR_INTEL is not set
@@ -259,6 +290,7 @@ CONFIG_HPLANCE=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -282,7 +314,6 @@ CONFIG_MOUSE_SERIAL=m
 CONFIG_INPUT_MISC=y
 CONFIG_HP_SDC_RTC=m
 CONFIG_SERIO_SERPORT=m
-CONFIG_VT_HW_CONSOLE_BINDING=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_DEVKMEM is not set
 # CONFIG_HW_RANDOM is not set
@@ -304,10 +335,6 @@ CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_GENERIC=m
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_PROC_HARDWARE=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
 CONFIG_EXT4_FS=y
 CONFIG_REISERFS_FS=m
 CONFIG_JFS_FS=m
@@ -344,7 +371,7 @@ CONFIG_QNX6FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_SWAP=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
@@ -403,10 +430,10 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_ASYNC_RAID6_TEST=m
+CONFIG_TEST_STRING_HELPERS=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
@@ -439,6 +466,8 @@ CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_LZ4HC=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
diff --git a/arch/m68k/configs/mac_defconfig b/arch/m68k/configs/mac_defconfig
index 7d46fbec7042..31f5bd061d14 100644
--- a/arch/m68k/configs/mac_defconfig
+++ b/arch/m68k/configs/mac_defconfig
@@ -49,7 +49,6 @@ CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
 CONFIG_NET_IPGRE=m
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -60,11 +59,11 @@ CONFIG_INET_XFRM_MODE_BEET=m
 # CONFIG_INET_LRO is not set
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
-CONFIG_IPV6_PRIVACY=y
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_VTI=m
 CONFIG_IPV6_GRE=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
@@ -82,6 +81,17 @@ CONFIG_NF_CONNTRACK_PPTP=m
 CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_TABLES=m
+CONFIG_NFT_EXTHDR=m
+CONFIG_NFT_META=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_RBTREE=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_COMPAT=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -95,6 +105,7 @@ CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
 CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
@@ -127,6 +138,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -141,11 +153,18 @@ CONFIG_IP_SET_HASH_IP=m
 CONFIG_IP_SET_HASH_IPPORT=m
 CONFIG_IP_SET_HASH_IPPORTIP=m
 CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NETPORTNET=m
 CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_TABLES_IPV4=m
+CONFIG_NFT_REJECT_IPV4=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NF_TABLES_ARP=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -153,6 +172,7 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -167,6 +187,9 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_TABLES_IPV6=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -180,11 +203,13 @@ CONFIG_IP6_NF_MATCH_RT=m
 CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_IP_DCCP=m
 # CONFIG_IP_DCCP_CCID3 is not set
 CONFIG_SCTP_COOKIE_HMAC_SHA1=y
@@ -195,11 +220,13 @@ CONFIG_ATALK=m
 CONFIG_DEV_APPLETALK=m
 CONFIG_IPDDP=m
 CONFIG_IPDDP_ENCAP=y
-CONFIG_IPDDP_DECAP=y
+CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
+CONFIG_BATMAN_ADV_NC=y
+CONFIG_NETLINK_DIAG=m
+CONFIG_NET_MPLS_GSO=m
 # CONFIG_WIRELESS is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 # CONFIG_FW_LOADER_USER_HELPER is not set
@@ -212,6 +239,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_ATA_OVER_ETH=m
+CONFIG_DUMMY_IRQ=m
 CONFIG_IDE=y
 CONFIG_IDE_GD_ATAPI=y
 CONFIG_BLK_DEV_IDECD=y
@@ -261,6 +289,7 @@ CONFIG_EQUALIZER=m
 CONFIG_NET_TEAM=m
 CONFIG_NET_TEAM_MODE_BROADCAST=m
 CONFIG_NET_TEAM_MODE_ROUNDROBIN=m
+CONFIG_NET_TEAM_MODE_RANDOM=m
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
 CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_VXLAN=m
@@ -268,6 +297,7 @@ CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 CONFIG_MACMACE=y
+# CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
 CONFIG_MAC89x0=y
@@ -279,6 +309,7 @@ CONFIG_MAC8390=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -302,7 +333,6 @@ CONFIG_MOUSE_SERIAL=m
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_M68K_BEEP=m
 CONFIG_SERIO=m
-CONFIG_VT_HW_CONSOLE_BINDING=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_PMACZILOG=y
@@ -327,10 +357,6 @@ CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_GENERIC=m
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_PROC_HARDWARE=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
 CONFIG_EXT4_FS=y
 CONFIG_REISERFS_FS=m
 CONFIG_JFS_FS=m
@@ -367,7 +393,7 @@ CONFIG_QNX6FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_SWAP=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
@@ -426,10 +452,11 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_ASYNC_RAID6_TEST=m
+CONFIG_TEST_STRING_HELPERS=m
+CONFIG_EARLY_PRINTK=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
@@ -462,6 +489,8 @@ CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_LZ4HC=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
diff --git a/arch/m68k/configs/multi_defconfig b/arch/m68k/configs/multi_defconfig
index b17a8837f0e1..4e5adff326ee 100644
--- a/arch/m68k/configs/multi_defconfig
+++ b/arch/m68k/configs/multi_defconfig
@@ -58,7 +58,6 @@ CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
 CONFIG_NET_IPGRE=m
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -69,11 +68,11 @@ CONFIG_INET_XFRM_MODE_BEET=m
 # CONFIG_INET_LRO is not set
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
-CONFIG_IPV6_PRIVACY=y
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_VTI=m
 CONFIG_IPV6_GRE=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
@@ -91,6 +90,17 @@ CONFIG_NF_CONNTRACK_PPTP=m
 CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_TABLES=m
+CONFIG_NFT_EXTHDR=m
+CONFIG_NFT_META=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_RBTREE=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_COMPAT=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -104,6 +114,7 @@ CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
 CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
@@ -136,6 +147,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -150,11 +162,18 @@ CONFIG_IP_SET_HASH_IP=m
 CONFIG_IP_SET_HASH_IPPORT=m
 CONFIG_IP_SET_HASH_IPPORTIP=m
 CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NETPORTNET=m
 CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_TABLES_IPV4=m
+CONFIG_NFT_REJECT_IPV4=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NF_TABLES_ARP=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -162,6 +181,7 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -176,6 +196,9 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_TABLES_IPV6=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -189,11 +212,13 @@ CONFIG_IP6_NF_MATCH_RT=m
 CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_IP_DCCP=m
 # CONFIG_IP_DCCP_CCID3 is not set
 CONFIG_SCTP_COOKIE_HMAC_SHA1=y
@@ -204,11 +229,13 @@ CONFIG_ATALK=m
 CONFIG_DEV_APPLETALK=m
 CONFIG_IPDDP=m
 CONFIG_IPDDP_ENCAP=y
-CONFIG_IPDDP_DECAP=y
+CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
+CONFIG_BATMAN_ADV_NC=y
+CONFIG_NETLINK_DIAG=m
+CONFIG_NET_MPLS_GSO=m
 # CONFIG_WIRELESS is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 # CONFIG_FW_LOADER_USER_HELPER is not set
@@ -230,6 +257,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_ATA_OVER_ETH=m
+CONFIG_DUMMY_IRQ=m
 CONFIG_IDE=y
 CONFIG_IDE_GD_ATAPI=y
 CONFIG_BLK_DEV_IDECD=y
@@ -290,10 +318,10 @@ CONFIG_MAC_EMUMOUSEBTN=y
 CONFIG_NETDEVICES=y
 CONFIG_DUMMY=m
 CONFIG_EQUALIZER=m
-CONFIG_MII=y
 CONFIG_NET_TEAM=m
 CONFIG_NET_TEAM_MODE_BROADCAST=m
 CONFIG_NET_TEAM_MODE_ROUNDROBIN=m
+CONFIG_NET_TEAM_MODE_RANDOM=m
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
 CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_VXLAN=m
@@ -308,10 +336,10 @@ CONFIG_HPLANCE=y
 CONFIG_MVME147_NET=y
 CONFIG_SUN3LANCE=y
 CONFIG_MACMACE=y
+# CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
 CONFIG_MAC89x0=y
-# CONFIG_NET_VENDOR_FUJITSU is not set
 # CONFIG_NET_VENDOR_HP is not set
 CONFIG_BVME6000_NET=y
 CONFIG_MVME16x_NET=y
@@ -325,6 +353,7 @@ CONFIG_APNE=y
 CONFIG_ZORRO8390=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PLIP=m
 CONFIG_PPP=m
@@ -357,7 +386,6 @@ CONFIG_INPUT_MISC=y
 CONFIG_INPUT_M68K_BEEP=m
 CONFIG_HP_SDC_RTC=m
 CONFIG_SERIO_Q40KBD=y
-CONFIG_VT_HW_CONSOLE_BINDING=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_PMACZILOG=y
@@ -405,10 +433,6 @@ CONFIG_NFETH=y
 CONFIG_ATARI_DSP56K=m
 CONFIG_AMIGA_BUILTIN_SERIAL=y
 CONFIG_SERIAL_CONSOLE=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
 CONFIG_EXT4_FS=y
 CONFIG_REISERFS_FS=m
 CONFIG_JFS_FS=m
@@ -445,7 +469,7 @@ CONFIG_QNX6FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_SWAP=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
@@ -504,10 +528,11 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_ASYNC_RAID6_TEST=m
+CONFIG_TEST_STRING_HELPERS=m
+CONFIG_EARLY_PRINTK=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
@@ -540,6 +565,8 @@ CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_LZ4HC=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
diff --git a/arch/m68k/configs/mvme147_defconfig b/arch/m68k/configs/mvme147_defconfig
index 5586c6529fce..02cdbac5565e 100644
--- a/arch/m68k/configs/mvme147_defconfig
+++ b/arch/m68k/configs/mvme147_defconfig
@@ -47,7 +47,6 @@ CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
 CONFIG_NET_IPGRE=m
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -58,11 +57,11 @@ CONFIG_INET_XFRM_MODE_BEET=m
 # CONFIG_INET_LRO is not set
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
-CONFIG_IPV6_PRIVACY=y
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_VTI=m
 CONFIG_IPV6_GRE=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
@@ -80,6 +79,17 @@ CONFIG_NF_CONNTRACK_PPTP=m
 CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_TABLES=m
+CONFIG_NFT_EXTHDR=m
+CONFIG_NFT_META=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_RBTREE=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_COMPAT=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -93,6 +103,7 @@ CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
 CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
@@ -125,6 +136,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -139,11 +151,18 @@ CONFIG_IP_SET_HASH_IP=m
 CONFIG_IP_SET_HASH_IPPORT=m
 CONFIG_IP_SET_HASH_IPPORTIP=m
 CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NETPORTNET=m
 CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_TABLES_IPV4=m
+CONFIG_NFT_REJECT_IPV4=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NF_TABLES_ARP=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -151,6 +170,7 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -165,6 +185,9 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_TABLES_IPV6=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -178,11 +201,13 @@ CONFIG_IP6_NF_MATCH_RT=m
 CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_IP_DCCP=m
 # CONFIG_IP_DCCP_CCID3 is not set
 CONFIG_SCTP_COOKIE_HMAC_SHA1=y
@@ -190,10 +215,13 @@ CONFIG_RDS=m
 CONFIG_RDS_TCP=m
 CONFIG_L2TP=m
 CONFIG_ATALK=m
+CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
+CONFIG_BATMAN_ADV_NC=y
+CONFIG_NETLINK_DIAG=m
+CONFIG_NET_MPLS_GSO=m
 # CONFIG_WIRELESS is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 # CONFIG_FW_LOADER_USER_HELPER is not set
@@ -205,6 +233,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_ATA_OVER_ETH=m
+CONFIG_DUMMY_IRQ=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_SCSI_TGT=m
@@ -242,6 +271,7 @@ CONFIG_EQUALIZER=m
 CONFIG_NET_TEAM=m
 CONFIG_NET_TEAM_MODE_BROADCAST=m
 CONFIG_NET_TEAM_MODE_ROUNDROBIN=m
+CONFIG_NET_TEAM_MODE_RANDOM=m
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
 CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_VXLAN=m
@@ -249,6 +279,7 @@ CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 CONFIG_MVME147_NET=y
+# CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
 # CONFIG_NET_VENDOR_INTEL is not set
@@ -257,6 +288,7 @@ CONFIG_MVME147_NET=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -294,10 +326,6 @@ CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_GENERIC=m
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_PROC_HARDWARE=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
 CONFIG_EXT4_FS=y
 CONFIG_REISERFS_FS=m
 CONFIG_JFS_FS=m
@@ -334,7 +362,7 @@ CONFIG_QNX6FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_SWAP=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
@@ -393,10 +421,10 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_ASYNC_RAID6_TEST=m
+CONFIG_TEST_STRING_HELPERS=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
@@ -429,6 +457,8 @@ CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_LZ4HC=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
diff --git a/arch/m68k/configs/mvme16x_defconfig b/arch/m68k/configs/mvme16x_defconfig
index e5e8262bbacd..05a990a9dbd4 100644
--- a/arch/m68k/configs/mvme16x_defconfig
+++ b/arch/m68k/configs/mvme16x_defconfig
@@ -48,7 +48,6 @@ CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
 CONFIG_NET_IPGRE=m
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -59,11 +58,11 @@ CONFIG_INET_XFRM_MODE_BEET=m
 # CONFIG_INET_LRO is not set
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
-CONFIG_IPV6_PRIVACY=y
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_VTI=m
 CONFIG_IPV6_GRE=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
@@ -81,6 +80,17 @@ CONFIG_NF_CONNTRACK_PPTP=m
 CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_TABLES=m
+CONFIG_NFT_EXTHDR=m
+CONFIG_NFT_META=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_RBTREE=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_COMPAT=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -94,6 +104,7 @@ CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
 CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
@@ -126,6 +137,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -140,11 +152,18 @@ CONFIG_IP_SET_HASH_IP=m
 CONFIG_IP_SET_HASH_IPPORT=m
 CONFIG_IP_SET_HASH_IPPORTIP=m
 CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NETPORTNET=m
 CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_TABLES_IPV4=m
+CONFIG_NFT_REJECT_IPV4=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NF_TABLES_ARP=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -152,6 +171,7 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -166,6 +186,9 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_TABLES_IPV6=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -179,11 +202,13 @@ CONFIG_IP6_NF_MATCH_RT=m
 CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_IP_DCCP=m
 # CONFIG_IP_DCCP_CCID3 is not set
 CONFIG_SCTP_COOKIE_HMAC_SHA1=y
@@ -191,10 +216,13 @@ CONFIG_RDS=m
 CONFIG_RDS_TCP=m
 CONFIG_L2TP=m
 CONFIG_ATALK=m
+CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
+CONFIG_BATMAN_ADV_NC=y
+CONFIG_NETLINK_DIAG=m
+CONFIG_NET_MPLS_GSO=m
 # CONFIG_WIRELESS is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 # CONFIG_FW_LOADER_USER_HELPER is not set
@@ -206,6 +234,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_ATA_OVER_ETH=m
+CONFIG_DUMMY_IRQ=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_SCSI_TGT=m
@@ -243,12 +272,14 @@ CONFIG_EQUALIZER=m
 CONFIG_NET_TEAM=m
 CONFIG_NET_TEAM_MODE_BROADCAST=m
 CONFIG_NET_TEAM_MODE_ROUNDROBIN=m
+CONFIG_NET_TEAM_MODE_RANDOM=m
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
 CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_VXLAN=m
 CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
+# CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
 CONFIG_MVME16x_NET=y
@@ -257,6 +288,7 @@ CONFIG_MVME16x_NET=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -294,10 +326,6 @@ CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_GENERIC=m
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_PROC_HARDWARE=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
 CONFIG_EXT4_FS=y
 CONFIG_REISERFS_FS=m
 CONFIG_JFS_FS=m
@@ -334,7 +362,7 @@ CONFIG_QNX6FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_SWAP=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
@@ -393,10 +421,11 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_ASYNC_RAID6_TEST=m
+CONFIG_TEST_STRING_HELPERS=m
+CONFIG_EARLY_PRINTK=y
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
@@ -429,6 +458,8 @@ CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_LZ4HC=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
diff --git a/arch/m68k/configs/q40_defconfig b/arch/m68k/configs/q40_defconfig
index be1496ed9b66..568e2a98f976 100644
--- a/arch/m68k/configs/q40_defconfig
+++ b/arch/m68k/configs/q40_defconfig
@@ -48,7 +48,6 @@ CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
 CONFIG_NET_IPGRE=m
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -59,11 +58,11 @@ CONFIG_INET_XFRM_MODE_BEET=m
 # CONFIG_INET_LRO is not set
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
-CONFIG_IPV6_PRIVACY=y
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_VTI=m
 CONFIG_IPV6_GRE=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
@@ -81,6 +80,17 @@ CONFIG_NF_CONNTRACK_PPTP=m
 CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_TABLES=m
+CONFIG_NFT_EXTHDR=m
+CONFIG_NFT_META=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_RBTREE=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_COMPAT=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -94,6 +104,7 @@ CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
 CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
@@ -126,6 +137,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -140,11 +152,18 @@ CONFIG_IP_SET_HASH_IP=m
 CONFIG_IP_SET_HASH_IPPORT=m
 CONFIG_IP_SET_HASH_IPPORTIP=m
 CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NETPORTNET=m
 CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_TABLES_IPV4=m
+CONFIG_NFT_REJECT_IPV4=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NF_TABLES_ARP=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -152,6 +171,7 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -166,6 +186,9 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_TABLES_IPV6=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -179,11 +202,13 @@ CONFIG_IP6_NF_MATCH_RT=m
 CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_IP_DCCP=m
 # CONFIG_IP_DCCP_CCID3 is not set
 CONFIG_SCTP_COOKIE_HMAC_SHA1=y
@@ -191,10 +216,13 @@ CONFIG_RDS=m
 CONFIG_RDS_TCP=m
 CONFIG_L2TP=m
 CONFIG_ATALK=m
+CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
+CONFIG_BATMAN_ADV_NC=y
+CONFIG_NETLINK_DIAG=m
+CONFIG_NET_MPLS_GSO=m
 # CONFIG_WIRELESS is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 # CONFIG_FW_LOADER_USER_HELPER is not set
@@ -209,6 +237,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_ATA_OVER_ETH=m
+CONFIG_DUMMY_IRQ=m
 CONFIG_IDE=y
 CONFIG_IDE_GD_ATAPI=y
 CONFIG_BLK_DEV_IDECD=y
@@ -249,6 +278,7 @@ CONFIG_EQUALIZER=m
 CONFIG_NET_TEAM=m
 CONFIG_NET_TEAM_MODE_BROADCAST=m
 CONFIG_NET_TEAM_MODE_ROUNDROBIN=m
+CONFIG_NET_TEAM_MODE_RANDOM=m
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
 CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_VXLAN=m
@@ -257,10 +287,10 @@ CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 # CONFIG_NET_VENDOR_3COM is not set
 # CONFIG_NET_VENDOR_AMD is not set
+# CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
 # CONFIG_NET_VENDOR_CIRRUS is not set
-# CONFIG_NET_VENDOR_FUJITSU is not set
 # CONFIG_NET_VENDOR_HP is not set
 # CONFIG_NET_VENDOR_INTEL is not set
 # CONFIG_NET_VENDOR_MARVELL is not set
@@ -269,6 +299,7 @@ CONFIG_NE2000=m
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_SMSC is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PLIP=m
 CONFIG_PPP=m
@@ -293,7 +324,6 @@ CONFIG_MOUSE_SERIAL=m
 CONFIG_INPUT_MISC=y
 CONFIG_INPUT_M68K_BEEP=m
 CONFIG_SERIO_Q40KBD=y
-CONFIG_VT_HW_CONSOLE_BINDING=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_DEVKMEM is not set
 CONFIG_PRINTER=m
@@ -318,10 +348,6 @@ CONFIG_RTC_DRV_GENERIC=m
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_HEARTBEAT=y
 CONFIG_PROC_HARDWARE=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
 CONFIG_EXT4_FS=y
 CONFIG_REISERFS_FS=m
 CONFIG_JFS_FS=m
@@ -358,7 +384,7 @@ CONFIG_QNX6FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_SWAP=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
@@ -417,10 +443,10 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_ASYNC_RAID6_TEST=m
+CONFIG_TEST_STRING_HELPERS=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
@@ -453,6 +479,8 @@ CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_LZ4HC=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
diff --git a/arch/m68k/configs/sun3_defconfig b/arch/m68k/configs/sun3_defconfig
index 54674d61e001..60b0aeac5742 100644
--- a/arch/m68k/configs/sun3_defconfig
+++ b/arch/m68k/configs/sun3_defconfig
@@ -45,7 +45,6 @@ CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
 CONFIG_NET_IPGRE=m
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -56,11 +55,11 @@ CONFIG_INET_XFRM_MODE_BEET=m
 # CONFIG_INET_LRO is not set
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
-CONFIG_IPV6_PRIVACY=y
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_VTI=m
 CONFIG_IPV6_GRE=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
@@ -78,6 +77,17 @@ CONFIG_NF_CONNTRACK_PPTP=m
 CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_TABLES=m
+CONFIG_NFT_EXTHDR=m
+CONFIG_NFT_META=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_RBTREE=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_COMPAT=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -91,6 +101,7 @@ CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
 CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
@@ -123,6 +134,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -137,11 +149,18 @@ CONFIG_IP_SET_HASH_IP=m
 CONFIG_IP_SET_HASH_IPPORT=m
 CONFIG_IP_SET_HASH_IPPORTIP=m
 CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NETPORTNET=m
 CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_TABLES_IPV4=m
+CONFIG_NFT_REJECT_IPV4=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NF_TABLES_ARP=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -149,6 +168,7 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -163,6 +183,9 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_TABLES_IPV6=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -176,11 +199,13 @@ CONFIG_IP6_NF_MATCH_RT=m
 CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_IP_DCCP=m
 # CONFIG_IP_DCCP_CCID3 is not set
 CONFIG_SCTP_COOKIE_HMAC_SHA1=y
@@ -188,10 +213,13 @@ CONFIG_RDS=m
 CONFIG_RDS_TCP=m
 CONFIG_L2TP=m
 CONFIG_ATALK=m
+CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
+CONFIG_BATMAN_ADV_NC=y
+CONFIG_NETLINK_DIAG=m
+CONFIG_NET_MPLS_GSO=m
 # CONFIG_WIRELESS is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 # CONFIG_FW_LOADER_USER_HELPER is not set
@@ -203,6 +231,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_ATA_OVER_ETH=m
+CONFIG_DUMMY_IRQ=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_SCSI_TGT=m
@@ -240,6 +269,7 @@ CONFIG_EQUALIZER=m
 CONFIG_NET_TEAM=m
 CONFIG_NET_TEAM_MODE_BROADCAST=m
 CONFIG_NET_TEAM_MODE_ROUNDROBIN=m
+CONFIG_NET_TEAM_MODE_RANDOM=m
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
 CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_VXLAN=m
@@ -247,6 +277,7 @@ CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 CONFIG_SUN3LANCE=y
+# CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 CONFIG_SUN3_82586=y
 # CONFIG_NET_VENDOR_MARVELL is not set
@@ -255,6 +286,7 @@ CONFIG_SUN3_82586=y
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
 # CONFIG_NET_VENDOR_SUN is not set
+# CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -276,7 +308,6 @@ CONFIG_INPUT_EVDEV=m
 CONFIG_KEYBOARD_SUNKBD=y
 # CONFIG_MOUSE_PS2 is not set
 CONFIG_MOUSE_SERIAL=m
-CONFIG_VT_HW_CONSOLE_BINDING=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_DEVKMEM is not set
 # CONFIG_HW_RANDOM is not set
@@ -296,10 +327,6 @@ CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_GENERIC=m
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_PROC_HARDWARE=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
 CONFIG_EXT4_FS=y
 CONFIG_REISERFS_FS=m
 CONFIG_JFS_FS=m
@@ -336,7 +363,7 @@ CONFIG_QNX6FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_SWAP=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
@@ -395,10 +422,10 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_ASYNC_RAID6_TEST=m
+CONFIG_TEST_STRING_HELPERS=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
@@ -431,6 +458,8 @@ CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_LZ4HC=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
diff --git a/arch/m68k/configs/sun3x_defconfig b/arch/m68k/configs/sun3x_defconfig
index 832d9539f441..21bda331eebb 100644
--- a/arch/m68k/configs/sun3x_defconfig
+++ b/arch/m68k/configs/sun3x_defconfig
@@ -45,7 +45,6 @@ CONFIG_IP_PNP_RARP=y
 CONFIG_NET_IPIP=m
 CONFIG_NET_IPGRE_DEMUX=m
 CONFIG_NET_IPGRE=m
-CONFIG_SYN_COOKIES=y
 CONFIG_NET_IPVTI=m
 CONFIG_INET_AH=m
 CONFIG_INET_ESP=m
@@ -56,11 +55,11 @@ CONFIG_INET_XFRM_MODE_BEET=m
 # CONFIG_INET_LRO is not set
 CONFIG_INET_DIAG=m
 CONFIG_INET_UDP_DIAG=m
-CONFIG_IPV6_PRIVACY=y
 CONFIG_IPV6_ROUTER_PREF=y
 CONFIG_INET6_AH=m
 CONFIG_INET6_ESP=m
 CONFIG_INET6_IPCOMP=m
+CONFIG_IPV6_VTI=m
 CONFIG_IPV6_GRE=m
 CONFIG_NETFILTER=y
 CONFIG_NF_CONNTRACK=m
@@ -78,6 +77,17 @@ CONFIG_NF_CONNTRACK_PPTP=m
 CONFIG_NF_CONNTRACK_SANE=m
 CONFIG_NF_CONNTRACK_SIP=m
 CONFIG_NF_CONNTRACK_TFTP=m
+CONFIG_NF_TABLES=m
+CONFIG_NFT_EXTHDR=m
+CONFIG_NFT_META=m
+CONFIG_NFT_CT=m
+CONFIG_NFT_RBTREE=m
+CONFIG_NFT_HASH=m
+CONFIG_NFT_COUNTER=m
+CONFIG_NFT_LOG=m
+CONFIG_NFT_LIMIT=m
+CONFIG_NFT_NAT=m
+CONFIG_NFT_COMPAT=m
 CONFIG_NETFILTER_XT_SET=m
 CONFIG_NETFILTER_XT_TARGET_CHECKSUM=m
 CONFIG_NETFILTER_XT_TARGET_CLASSIFY=m
@@ -91,6 +101,7 @@ CONFIG_NETFILTER_XT_TARGET_NFLOG=m
 CONFIG_NETFILTER_XT_TARGET_NFQUEUE=m
 CONFIG_NETFILTER_XT_TARGET_NOTRACK=m
 CONFIG_NETFILTER_XT_TARGET_TEE=m
+CONFIG_NETFILTER_XT_TARGET_TPROXY=m
 CONFIG_NETFILTER_XT_TARGET_TRACE=m
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=m
 CONFIG_NETFILTER_XT_TARGET_TCPOPTSTRIP=m
@@ -123,6 +134,7 @@ CONFIG_NETFILTER_XT_MATCH_QUOTA=m
 CONFIG_NETFILTER_XT_MATCH_RATEEST=m
 CONFIG_NETFILTER_XT_MATCH_REALM=m
 CONFIG_NETFILTER_XT_MATCH_RECENT=m
+CONFIG_NETFILTER_XT_MATCH_SOCKET=m
 CONFIG_NETFILTER_XT_MATCH_STATE=m
 CONFIG_NETFILTER_XT_MATCH_STATISTIC=m
 CONFIG_NETFILTER_XT_MATCH_STRING=m
@@ -137,11 +149,18 @@ CONFIG_IP_SET_HASH_IP=m
 CONFIG_IP_SET_HASH_IPPORT=m
 CONFIG_IP_SET_HASH_IPPORTIP=m
 CONFIG_IP_SET_HASH_IPPORTNET=m
+CONFIG_IP_SET_HASH_NETPORTNET=m
 CONFIG_IP_SET_HASH_NET=m
+CONFIG_IP_SET_HASH_NETNET=m
 CONFIG_IP_SET_HASH_NETPORT=m
 CONFIG_IP_SET_HASH_NETIFACE=m
 CONFIG_IP_SET_LIST_SET=m
 CONFIG_NF_CONNTRACK_IPV4=m
+CONFIG_NF_TABLES_IPV4=m
+CONFIG_NFT_REJECT_IPV4=m
+CONFIG_NFT_CHAIN_ROUTE_IPV4=m
+CONFIG_NFT_CHAIN_NAT_IPV4=m
+CONFIG_NF_TABLES_ARP=m
 CONFIG_IP_NF_IPTABLES=m
 CONFIG_IP_NF_MATCH_AH=m
 CONFIG_IP_NF_MATCH_ECN=m
@@ -149,6 +168,7 @@ CONFIG_IP_NF_MATCH_RPFILTER=m
 CONFIG_IP_NF_MATCH_TTL=m
 CONFIG_IP_NF_FILTER=m
 CONFIG_IP_NF_TARGET_REJECT=m
+CONFIG_IP_NF_TARGET_SYNPROXY=m
 CONFIG_IP_NF_TARGET_ULOG=m
 CONFIG_NF_NAT_IPV4=m
 CONFIG_IP_NF_TARGET_MASQUERADE=m
@@ -163,6 +183,9 @@ CONFIG_IP_NF_ARPTABLES=m
 CONFIG_IP_NF_ARPFILTER=m
 CONFIG_IP_NF_ARP_MANGLE=m
 CONFIG_NF_CONNTRACK_IPV6=m
+CONFIG_NF_TABLES_IPV6=m
+CONFIG_NFT_CHAIN_ROUTE_IPV6=m
+CONFIG_NFT_CHAIN_NAT_IPV6=m
 CONFIG_IP6_NF_IPTABLES=m
 CONFIG_IP6_NF_MATCH_AH=m
 CONFIG_IP6_NF_MATCH_EUI64=m
@@ -176,11 +199,13 @@ CONFIG_IP6_NF_MATCH_RT=m
 CONFIG_IP6_NF_TARGET_HL=m
 CONFIG_IP6_NF_FILTER=m
 CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_IP6_NF_TARGET_SYNPROXY=m
 CONFIG_IP6_NF_MANGLE=m
 CONFIG_IP6_NF_RAW=m
 CONFIG_NF_NAT_IPV6=m
 CONFIG_IP6_NF_TARGET_MASQUERADE=m
 CONFIG_IP6_NF_TARGET_NPT=m
+CONFIG_NF_TABLES_BRIDGE=m
 CONFIG_IP_DCCP=m
 # CONFIG_IP_DCCP_CCID3 is not set
 CONFIG_SCTP_COOKIE_HMAC_SHA1=y
@@ -188,10 +213,13 @@ CONFIG_RDS=m
 CONFIG_RDS_TCP=m
 CONFIG_L2TP=m
 CONFIG_ATALK=m
+CONFIG_DNS_RESOLVER=y
 CONFIG_BATMAN_ADV=m
 CONFIG_BATMAN_ADV_DAT=y
+CONFIG_BATMAN_ADV_NC=y
+CONFIG_NETLINK_DIAG=m
+CONFIG_NET_MPLS_GSO=m
 # CONFIG_WIRELESS is not set
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_DEVTMPFS=y
 # CONFIG_FIRMWARE_IN_KERNEL is not set
 # CONFIG_FW_LOADER_USER_HELPER is not set
@@ -203,6 +231,7 @@ CONFIG_BLK_DEV_NBD=m
 CONFIG_BLK_DEV_RAM=y
 CONFIG_CDROM_PKTCDVD=m
 CONFIG_ATA_OVER_ETH=m
+CONFIG_DUMMY_IRQ=m
 CONFIG_RAID_ATTRS=m
 CONFIG_SCSI=y
 CONFIG_SCSI_TGT=m
@@ -240,6 +269,7 @@ CONFIG_EQUALIZER=m
 CONFIG_NET_TEAM=m
 CONFIG_NET_TEAM_MODE_BROADCAST=m
 CONFIG_NET_TEAM_MODE_ROUNDROBIN=m
+CONFIG_NET_TEAM_MODE_RANDOM=m
 CONFIG_NET_TEAM_MODE_ACTIVEBACKUP=m
 CONFIG_NET_TEAM_MODE_LOADBALANCE=m
 CONFIG_VXLAN=m
@@ -247,6 +277,7 @@ CONFIG_NETCONSOLE=m
 CONFIG_NETCONSOLE_DYNAMIC=y
 CONFIG_VETH=m
 CONFIG_SUN3LANCE=y
+# CONFIG_NET_VENDOR_ARC is not set
 # CONFIG_NET_CADENCE is not set
 # CONFIG_NET_VENDOR_BROADCOM is not set
 # CONFIG_NET_VENDOR_INTEL is not set
@@ -255,6 +286,7 @@ CONFIG_SUN3LANCE=y
 # CONFIG_NET_VENDOR_NATSEMI is not set
 # CONFIG_NET_VENDOR_SEEQ is not set
 # CONFIG_NET_VENDOR_STMICRO is not set
+# CONFIG_NET_VENDOR_VIA is not set
 # CONFIG_NET_VENDOR_WIZNET is not set
 CONFIG_PPP=m
 CONFIG_PPP_BSDCOMP=m
@@ -276,7 +308,6 @@ CONFIG_INPUT_EVDEV=m
 CONFIG_KEYBOARD_SUNKBD=y
 # CONFIG_MOUSE_PS2 is not set
 CONFIG_MOUSE_SERIAL=m
-CONFIG_VT_HW_CONSOLE_BINDING=y
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_DEVKMEM is not set
 # CONFIG_HW_RANDOM is not set
@@ -296,10 +327,6 @@ CONFIG_RTC_CLASS=y
 CONFIG_RTC_DRV_GENERIC=m
 # CONFIG_IOMMU_SUPPORT is not set
 CONFIG_PROC_HARDWARE=y
-CONFIG_EXT2_FS=y
-CONFIG_EXT3_FS=y
-# CONFIG_EXT3_DEFAULTS_TO_ORDERED is not set
-# CONFIG_EXT3_FS_XATTR is not set
 CONFIG_EXT4_FS=y
 CONFIG_REISERFS_FS=m
 CONFIG_JFS_FS=m
@@ -336,7 +363,7 @@ CONFIG_QNX6FS_FS=m
 CONFIG_SYSV_FS=m
 CONFIG_UFS_FS=m
 CONFIG_NFS_FS=y
-CONFIG_NFS_V4=y
+CONFIG_NFS_V4=m
 CONFIG_NFS_SWAP=y
 CONFIG_ROOT_NFS=y
 CONFIG_NFSD=m
@@ -395,10 +422,10 @@ CONFIG_NLS_MAC_TURKISH=m
 CONFIG_DLM=m
 CONFIG_MAGIC_SYSRQ=y
 CONFIG_ASYNC_RAID6_TEST=m
+CONFIG_TEST_STRING_HELPERS=m
 CONFIG_ENCRYPTED_KEYS=m
 CONFIG_CRYPTO_MANAGER=y
 CONFIG_CRYPTO_USER=m
-CONFIG_CRYPTO_NULL=m
 CONFIG_CRYPTO_CRYPTD=m
 CONFIG_CRYPTO_TEST=m
 CONFIG_CRYPTO_CCM=m
@@ -431,6 +458,8 @@ CONFIG_CRYPTO_TEA=m
 CONFIG_CRYPTO_TWOFISH=m
 CONFIG_CRYPTO_ZLIB=m
 CONFIG_CRYPTO_LZO=m
+CONFIG_CRYPTO_LZ4=m
+CONFIG_CRYPTO_LZ4HC=m
 # CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_USER_API_HASH=m
 CONFIG_CRYPTO_USER_API_SKCIPHER=m
diff --git a/arch/m68k/emu/natfeat.c b/arch/m68k/emu/natfeat.c
index 121a6660ad4e..71b78ecee75c 100644
--- a/arch/m68k/emu/natfeat.c
+++ b/arch/m68k/emu/natfeat.c
@@ -9,6 +9,7 @@
 * the GNU General Public License (GPL), incorporated herein by reference.
 */
+#include <linux/init.h>
 #include <linux/types.h>
 #include <linux/console.h>
 #include <linux/string.h>
@@ -70,7 +71,7 @@ static void nf_poweroff(void)
                nf_call(id);
 }
-void nf_init(void)
+void __init nf_init(void)
 {
        unsigned long id, version;
        char buf[256];
diff --git a/arch/m68k/hp300/config.c b/arch/m68k/hp300/config.c
index b7609f791522..2e5a787ea11b 100644
--- a/arch/m68k/hp300/config.c
+++ b/arch/m68k/hp300/config.c
@@ -14,6 +14,8 @@
 #include <linux/console.h>
 #include <asm/bootinfo.h>
+#include <asm/bootinfo-hp300.h>
+#include <asm/byteorder.h>
 #include <asm/machdep.h>
 #include <asm/blinken.h>
 #include <asm/io.h>                               /* readb() and writeb() */
@@ -70,15 +72,15 @@ extern int hp300_setup_serial_console(void) __init;
 int __init hp300_parse_bootinfo(const struct bi_record *record)
 {
        int unknown = 0;
-        const unsigned long *data = record->data;
+        const void *data = record->data;
-        switch (record->tag) {
+        switch (be16_to_cpu(record->tag)) {
        case BI_HP300_MODEL:
-                hp300_model = *data;
+                hp300_model = be32_to_cpup(data);
                break;
        case BI_HP300_UART_SCODE:
-                hp300_uart_scode = *data;
+                hp300_uart_scode = be32_to_cpup(data);
                break;
        case BI_HP300_UART_ADDR:
diff --git a/arch/m68k/include/asm/amigahw.h b/arch/m68k/include/asm/amigahw.h
index 7a19b5686a4a..5ad568110f17 100644
--- a/arch/m68k/include/asm/amigahw.h
+++ b/arch/m68k/include/asm/amigahw.h
@@ -18,26 +18,7 @@
 #include <linux/ioport.h>
-    /*
+#include <asm/bootinfo-amiga.h>
-     *  Different Amiga models
-     */
-#define AMI_UNKNOWN     (0)
-#define AMI_500         (1)
-#define AMI_500PLUS     (2)
-#define AMI_600         (3)
-#define AMI_1000        (4)
-#define AMI_1200        (5)
-#define AMI_2000        (6)
-#define AMI_2500        (7)
-#define AMI_3000        (8)
-#define AMI_3000T       (9)
-#define AMI_3000PLUS    (10)
-#define AMI_4000        (11)
-#define AMI_4000T       (12)
-#define AMI_CDTV        (13)
-#define AMI_CD32        (14)
-#define AMI_DRACO       (15)
    /*
@@ -46,11 +27,6 @@
 extern unsigned long amiga_chipset;
-#define CS_STONEAGE     (0)
-#define CS_OCS          (1)
-#define CS_ECS          (2)
-#define CS_AGA          (3)
    /*
     *  Miscellaneous
@@ -266,7 +242,7 @@ struct CIA {
 #define zTwoBase (0x80000000)
 #define ZTWO_PADDR(x) (((unsigned long)(x))-zTwoBase)
-#define ZTWO_VADDR(x) (((unsigned long)(x))+zTwoBase)
+#define ZTWO_VADDR(x) ((void __iomem *)(((unsigned long)(x))+zTwoBase))
 #define CUSTOM_PHYSADDR     (0xdff000)
 #define amiga_custom ((*(volatile struct CUSTOM *)(zTwoBase+CUSTOM_PHYSADDR)))
diff --git a/arch/m68k/include/asm/apollohw.h b/arch/m68k/include/asm/apollohw.h
index 6c19e0c22411..87fc899d32ee 100644
--- a/arch/m68k/include/asm/apollohw.h
+++ b/arch/m68k/include/asm/apollohw.h
@@ -5,18 +5,11 @@
 #include <linux/types.h>
-/*
+#include <asm/bootinfo-apollo.h>
-   apollo models
-*/
 extern u_long apollo_model;
-#define APOLLO_UNKNOWN (0)
-#define APOLLO_DN3000 (1)
-#define APOLLO_DN3010 (2)
-#define APOLLO_DN3500 (3)
-#define APOLLO_DN4000 (4)
-#define APOLLO_DN4500 (5)
 /*
   see scn2681 data sheet for more info.
diff --git a/arch/m68k/include/asm/atarihw.h b/arch/m68k/include/asm/atarihw.h
index d887050e6da6..972c8f33f055 100644
--- a/arch/m68k/include/asm/atarihw.h
+++ b/arch/m68k/include/asm/atarihw.h
@@ -21,7 +21,7 @@
 #define _LINUX_ATARIHW_H_
 #include <linux/types.h>
-#include <asm/bootinfo.h>
+#include <asm/bootinfo-atari.h>
 #include <asm/raw_io.h>
 extern u_long atari_mch_cookie;
diff --git a/arch/m68k/include/asm/barrier.h b/arch/m68k/include/asm/barrier.h
index 445ce22c23cb..15c5f77c1614 100644
--- a/arch/m68k/include/asm/barrier.h
+++ b/arch/m68k/include/asm/barrier.h
@@ -1,20 +1,8 @@
 #ifndef _M68K_BARRIER_H
 #define _M68K_BARRIER_H
-/*
- * Force strict CPU ordering.
- * Not really required on m68k...
- */
 #define nop()           do { asm volatile ("nop"); barrier(); } while (0)
-#define mb()            barrier()
-#define rmb()           barrier()
-#define wmb()           barrier()
-#define read_barrier_depends()  ((void)0)
-#define set_mb(var, value)      ({ (var) = (value); wmb(); })
-#define smp_mb()        barrier()
+#include <asm-generic/barrier.h>
-#define smp_rmb()       barrier()
-#define smp_wmb()       barrier()
-#define smp_read_barrier_depends()      ((void)0)
 #endif /* _M68K_BARRIER_H */
diff --git a/arch/m68k/include/asm/bootinfo.h b/arch/m68k/include/asm/bootinfo.h
index 67e7a78ad96b..8e213267f8e7 100644
--- a/arch/m68k/include/asm/bootinfo.h
+++ b/arch/m68k/include/asm/bootinfo.h
@@ -6,373 +6,23 @@
 ** This file is subject to the terms and conditions of the GNU General Public
 ** License.  See the file COPYING in the main directory of this archive
 ** for more details.
-**
-** Created 09/29/92 by Greg Harp
-**
-** 5/2/94 Roman Hodek:
-**   Added bi_atari part of the machine dependent union bi_un; for now it
-**   contains just a model field to distinguish between TT and Falcon.
-** 26/7/96 Roman Zippel:
-**   Renamed to setup.h; added some useful macros to allow gcc some
-**   optimizations if possible.
-** 5/10/96 Geert Uytterhoeven:
-**   Redesign of the boot information structure; renamed to bootinfo.h again
-** 27/11/96 Geert Uytterhoeven:
-**   Backwards compatibility with bootinfo interface version 1.0
 */
 #ifndef _M68K_BOOTINFO_H
 #define _M68K_BOOTINFO_H
+#include <uapi/asm/bootinfo.h>
-    /*
-     *  Bootinfo definitions
-     *
-     *  This is an easily parsable and extendable structure containing all
-     *  information to be passed from the bootstrap to the kernel.
-     *
-     *  This way I hope to keep all future changes back/forewards compatible.
-     *  Thus, keep your fingers crossed...
-     *
-     *  This structure is copied right after the kernel bss by the bootstrap
-     *  routine.
-     */
 #ifndef __ASSEMBLY__
-struct bi_record {
+#ifdef CONFIG_BOOTINFO_PROC
-    unsigned short tag;                 /* tag ID */
+extern void save_bootinfo(const struct bi_record *bi);
-    unsigned short size;                /* size of record (in bytes) */
+#else
-    unsigned long data[0];              /* data */
+static inline void save_bootinfo(const struct bi_record *bi) {}
-};
-#endif /* __ASSEMBLY__ */
-    /*
-     *  Tag Definitions
-     *
-     *  Machine independent tags start counting from 0x0000
-     *  Machine dependent tags start counting from 0x8000
-     */
-#define BI_LAST                 0x0000  /* last record (sentinel) */
-#define BI_MACHTYPE             0x0001  /* machine type (u_long) */
-#define BI_CPUTYPE              0x0002  /* cpu type (u_long) */
-#define BI_FPUTYPE              0x0003  /* fpu type (u_long) */
-#define BI_MMUTYPE              0x0004  /* mmu type (u_long) */
-#define BI_MEMCHUNK             0x0005  /* memory chunk address and size */
-                                        /* (struct mem_info) */
-#define BI_RAMDISK              0x0006  /* ramdisk address and size */
-                                        /* (struct mem_info) */
-#define BI_COMMAND_LINE         0x0007  /* kernel command line parameters */
-                                        /* (string) */
-    /*
-     *  Amiga-specific tags
-     */
-#define BI_AMIGA_MODEL          0x8000  /* model (u_long) */
-#define BI_AMIGA_AUTOCON        0x8001  /* AutoConfig device */
-                                        /* (struct ConfigDev) */
-#define BI_AMIGA_CHIP_SIZE      0x8002  /* size of Chip RAM (u_long) */
-#define BI_AMIGA_VBLANK         0x8003  /* VBLANK frequency (u_char) */
-#define BI_AMIGA_PSFREQ         0x8004  /* power supply frequency (u_char) */
-#define BI_AMIGA_ECLOCK         0x8005  /* EClock frequency (u_long) */
-#define BI_AMIGA_CHIPSET        0x8006  /* native chipset present (u_long) */
-#define BI_AMIGA_SERPER         0x8007  /* serial port period (u_short) */
-    /*
-     *  Atari-specific tags
-     */
-#define BI_ATARI_MCH_COOKIE     0x8000  /* _MCH cookie from TOS (u_long) */
-#define BI_ATARI_MCH_TYPE       0x8001  /* special machine type (u_long) */
-                                        /* (values are ATARI_MACH_* defines */
-/* mch_cookie values (upper word) */
-#define ATARI_MCH_ST            0
-#define ATARI_MCH_STE           1
-#define ATARI_MCH_TT            2
-#define ATARI_MCH_FALCON        3
-/* mch_type values */
-#define ATARI_MACH_NORMAL       0       /* no special machine type */
-#define ATARI_MACH_MEDUSA       1       /* Medusa 040 */
-#define ATARI_MACH_HADES        2       /* Hades 040 or 060 */
-#define ATARI_MACH_AB40         3       /* Afterburner040 on Falcon */
-    /*
-     *  VME-specific tags
-     */
-#define BI_VME_TYPE             0x8000  /* VME sub-architecture (u_long) */
-#define BI_VME_BRDINFO          0x8001  /* VME board information (struct) */
-/* BI_VME_TYPE codes */
-#define VME_TYPE_TP34V          0x0034  /* Tadpole TP34V */
-#define VME_TYPE_MVME147        0x0147  /* Motorola MVME147 */
-#define VME_TYPE_MVME162        0x0162  /* Motorola MVME162 */
-#define VME_TYPE_MVME166        0x0166  /* Motorola MVME166 */
-#define VME_TYPE_MVME167        0x0167  /* Motorola MVME167 */
-#define VME_TYPE_MVME172        0x0172  /* Motorola MVME172 */
-#define VME_TYPE_MVME177        0x0177  /* Motorola MVME177 */
-#define VME_TYPE_BVME4000       0x4000  /* BVM Ltd. BVME4000 */
-#define VME_TYPE_BVME6000       0x6000  /* BVM Ltd. BVME6000 */
-/* BI_VME_BRDINFO is a 32 byte struct as returned by the Bug code on
- * Motorola VME boards.  Contains board number, Bug version, board
- * configuration options, etc.  See include/asm/mvme16xhw.h for details.
- */
-    /*
-     *  Macintosh-specific tags (all u_long)
-     */
-#define BI_MAC_MODEL            0x8000  /* Mac Gestalt ID (model type) */
-#define BI_MAC_VADDR            0x8001  /* Mac video base address */
-#define BI_MAC_VDEPTH           0x8002  /* Mac video depth */
-#define BI_MAC_VROW             0x8003  /* Mac video rowbytes */
-#define BI_MAC_VDIM             0x8004  /* Mac video dimensions */
-#define BI_MAC_VLOGICAL         0x8005  /* Mac video logical base */
-#define BI_MAC_SCCBASE          0x8006  /* Mac SCC base address */
-#define BI_MAC_BTIME            0x8007  /* Mac boot time */
-#define BI_MAC_GMTBIAS          0x8008  /* Mac GMT timezone offset */
-#define BI_MAC_MEMSIZE          0x8009  /* Mac RAM size (sanity check) */
-#define BI_MAC_CPUID            0x800a  /* Mac CPU type (sanity check) */
-#define BI_MAC_ROMBASE          0x800b  /* Mac system ROM base address */
-    /*
-     *  Macintosh hardware profile data - unused, see macintosh.h for
-     *  reasonable type values
-     */
-#define BI_MAC_VIA1BASE         0x8010  /* Mac VIA1 base address (always present) */
-#define BI_MAC_VIA2BASE         0x8011  /* Mac VIA2 base address (type varies) */
-#define BI_MAC_VIA2TYPE         0x8012  /* Mac VIA2 type (VIA, RBV, OSS) */
-#define BI_MAC_ADBTYPE          0x8013  /* Mac ADB interface type */
-#define BI_MAC_ASCBASE          0x8014  /* Mac Apple Sound Chip base address */
-#define BI_MAC_SCSI5380         0x8015  /* Mac NCR 5380 SCSI (base address, multi) */
-#define BI_MAC_SCSIDMA          0x8016  /* Mac SCSI DMA (base address) */
-#define BI_MAC_SCSI5396         0x8017  /* Mac NCR 53C96 SCSI (base address, multi) */
-#define BI_MAC_IDETYPE          0x8018  /* Mac IDE interface type */
-#define BI_MAC_IDEBASE          0x8019  /* Mac IDE interface base address */
-#define BI_MAC_NUBUS            0x801a  /* Mac Nubus type (none, regular, pseudo) */
-#define BI_MAC_SLOTMASK         0x801b  /* Mac Nubus slots present */
-#define BI_MAC_SCCTYPE          0x801c  /* Mac SCC serial type (normal, IOP) */
-#define BI_MAC_ETHTYPE          0x801d  /* Mac builtin ethernet type (Sonic, MACE */
-#define BI_MAC_ETHBASE          0x801e  /* Mac builtin ethernet base address */
-#define BI_MAC_PMU              0x801f  /* Mac power management / poweroff hardware */
-#define BI_MAC_IOP_SWIM         0x8020  /* Mac SWIM floppy IOP */
-#define BI_MAC_IOP_ADB          0x8021  /* Mac ADB IOP */
-    /*
-     * Mac: compatibility with old booter data format (temporarily)
-     * Fields unused with the new bootinfo can be deleted now; instead of
-     * adding new fields the struct might be splitted into a hardware address
-     * part and a hardware type part
-     */
-#ifndef __ASSEMBLY__
-struct mac_booter_data
-{
-        unsigned long videoaddr;
-        unsigned long videorow;
-        unsigned long videodepth;
-        unsigned long dimensions;
-        unsigned long args;
-        unsigned long boottime;
-        unsigned long gmtbias;
-        unsigned long bootver;
-        unsigned long videological;
-        unsigned long sccbase;
-        unsigned long id;
-        unsigned long memsize;
-        unsigned long serialmf;
-        unsigned long serialhsk;
-        unsigned long serialgpi;
-        unsigned long printmf;
-        unsigned long printhsk;
-        unsigned long printgpi;
-        unsigned long cpuid;
-        unsigned long rombase;
-        unsigned long adbdelay;
-        unsigned long timedbra;
-};
-extern struct mac_booter_data
-        mac_bi_data;
 #endif
-    /*
-     *  Apollo-specific tags
-     */
-#define BI_APOLLO_MODEL         0x8000  /* model (u_long) */
-    /*
-     *  HP300-specific tags
-     */
-#define BI_HP300_MODEL          0x8000  /* model (u_long) */
-#define BI_HP300_UART_SCODE     0x8001  /* UART select code (u_long) */
-#define BI_HP300_UART_ADDR      0x8002  /* phys. addr of UART (u_long) */
-    /*
-     * Stuff for bootinfo interface versioning
-     *
-     * At the start of kernel code, a 'struct bootversion' is located.
-     * bootstrap checks for a matching version of the interface before booting
-     * a kernel, to avoid user confusion if kernel and bootstrap don't work
-     * together :-)
-     *
-     * If incompatible changes are made to the bootinfo interface, the major
-     * number below should be stepped (and the minor reset to 0) for the
-     * appropriate machine. If a change is backward-compatible, the minor
-     * should be stepped. "Backwards-compatible" means that booting will work,
-     * but certain features may not.
-     */
-#define BOOTINFOV_MAGIC                 0x4249561A      /* 'BIV^Z' */
-#define MK_BI_VERSION(major,minor)      (((major)<<16)+(minor))
-#define BI_VERSION_MAJOR(v)             (((v) >> 16) & 0xffff)
-#define BI_VERSION_MINOR(v)             ((v) & 0xffff)
-#ifndef __ASSEMBLY__
-struct bootversion {
-    unsigned short branch;
-    unsigned long magic;
-    struct {
-        unsigned long machtype;
-        unsigned long version;
-    } machversions[0];
-};
 #endif /* __ASSEMBLY__ */
-#define AMIGA_BOOTI_VERSION    MK_BI_VERSION( 2, 0 )
-#define ATARI_BOOTI_VERSION    MK_BI_VERSION( 2, 1 )
-#define MAC_BOOTI_VERSION      MK_BI_VERSION( 2, 0 )
-#define MVME147_BOOTI_VERSION  MK_BI_VERSION( 2, 0 )
-#define MVME16x_BOOTI_VERSION  MK_BI_VERSION( 2, 0 )
-#define BVME6000_BOOTI_VERSION MK_BI_VERSION( 2, 0 )
-#define Q40_BOOTI_VERSION      MK_BI_VERSION( 2, 0 )
-#define HP300_BOOTI_VERSION    MK_BI_VERSION( 2, 0 )
-#ifdef BOOTINFO_COMPAT_1_0
-    /*
-     *  Backwards compatibility with bootinfo interface version 1.0
-     */
-#define COMPAT_AMIGA_BOOTI_VERSION    MK_BI_VERSION( 1, 0 )
-#define COMPAT_ATARI_BOOTI_VERSION    MK_BI_VERSION( 1, 0 )
-#define COMPAT_MAC_BOOTI_VERSION      MK_BI_VERSION( 1, 0 )
-#include <linux/zorro.h>
-#define COMPAT_NUM_AUTO    16
-struct compat_bi_Amiga {
-    int model;
-    int num_autocon;
-    struct ConfigDev autocon[COMPAT_NUM_AUTO];
-    unsigned long chip_size;
-    unsigned char vblank;
-    unsigned char psfreq;
-    unsigned long eclock;
-    unsigned long chipset;
-    unsigned long hw_present;
-};
-struct compat_bi_Atari {
-    unsigned long hw_present;
-    unsigned long mch_cookie;
-};
-#ifndef __ASSEMBLY__
-struct compat_bi_Macintosh
-{
-        unsigned long videoaddr;
-        unsigned long videorow;
-        unsigned long videodepth;
-        unsigned long dimensions;
-        unsigned long args;
-        unsigned long boottime;
-        unsigned long gmtbias;
-        unsigned long bootver;
-        unsigned long videological;
-        unsigned long sccbase;
-        unsigned long id;
-        unsigned long memsize;
-        unsigned long serialmf;
-        unsigned long serialhsk;
-        unsigned long serialgpi;
-        unsigned long printmf;
-        unsigned long printhsk;
-        unsigned long printgpi;
-        unsigned long cpuid;
-        unsigned long rombase;
-        unsigned long adbdelay;
-        unsigned long timedbra;
-};
-#endif
-struct compat_mem_info {
-    unsigned long addr;
-    unsigned long size;
-};
-#define COMPAT_NUM_MEMINFO  4
-#define COMPAT_CPUB_68020 0
-#define COMPAT_CPUB_68030 1
-#define COMPAT_CPUB_68040 2
-#define COMPAT_CPUB_68060 3
-#define COMPAT_FPUB_68881 5
-#define COMPAT_FPUB_68882 6
-#define COMPAT_FPUB_68040 7
-#define COMPAT_FPUB_68060 8
-#define COMPAT_CPU_68020    (1<<COMPAT_CPUB_68020)
-#define COMPAT_CPU_68030    (1<<COMPAT_CPUB_68030)
-#define COMPAT_CPU_68040    (1<<COMPAT_CPUB_68040)
-#define COMPAT_CPU_68060    (1<<COMPAT_CPUB_68060)
-#define COMPAT_CPU_MASK     (31)
-#define COMPAT_FPU_68881    (1<<COMPAT_FPUB_68881)
-#define COMPAT_FPU_68882    (1<<COMPAT_FPUB_68882)
-#define COMPAT_FPU_68040    (1<<COMPAT_FPUB_68040)
-#define COMPAT_FPU_68060    (1<<COMPAT_FPUB_68060)
-#define COMPAT_FPU_MASK     (0xfe0)
-#define COMPAT_CL_SIZE      (256)
-struct compat_bootinfo {
-    unsigned long machtype;
-    unsigned long cputype;
-    struct compat_mem_info memory[COMPAT_NUM_MEMINFO];
-    int num_memory;
-    unsigned long ramdisk_size;
-    unsigned long ramdisk_addr;
-    char command_line[COMPAT_CL_SIZE];
-    union {
-        struct compat_bi_Amiga     bi_ami;
-        struct compat_bi_Atari     bi_ata;
-        struct compat_bi_Macintosh bi_mac;
-    } bi_un;
-};
-#define bi_amiga        bi_un.bi_ami
-#define bi_atari        bi_un.bi_ata
-#define bi_mac          bi_un.bi_mac
-#endif /* BOOTINFO_COMPAT_1_0 */
 #endif /* _M68K_BOOTINFO_H */
diff --git a/arch/m68k/include/asm/hp300hw.h b/arch/m68k/include/asm/hp300hw.h
index d998ea67c19c..64f5271dd7be 100644
--- a/arch/m68k/include/asm/hp300hw.h
+++ b/arch/m68k/include/asm/hp300hw.h
@@ -1,25 +1,9 @@
 #ifndef _M68K_HP300HW_H
 #define _M68K_HP300HW_H
-extern unsigned long hp300_model;
+#include <asm/bootinfo-hp300.h>
-/* This information was taken from NetBSD */
-#define HP_320          (0)     /* 16MHz 68020+HP MMU+16K external cache */
-#define HP_330          (1)     /* 16MHz 68020+68851 MMU */
-#define HP_340          (2)     /* 16MHz 68030 */
-#define HP_345          (3)     /* 50MHz 68030+32K external cache */
-#define HP_350          (4)     /* 25MHz 68020+HP MMU+32K external cache */
-#define HP_360          (5)     /* 25MHz 68030 */
-#define HP_370          (6)     /* 33MHz 68030+64K external cache */
-#define HP_375          (7)     /* 50MHz 68030+32K external cache */
-#define HP_380          (8)     /* 25MHz 68040 */
-#define HP_385          (9)     /* 33MHz 68040 */
-#define HP_400          (10)    /* 50MHz 68030+32K external cache */
+extern unsigned long hp300_model;
-#define HP_425T         (11)    /* 25MHz 68040 - model 425t */
-#define HP_425S         (12)    /* 25MHz 68040 - model 425s */
-#define HP_425E         (13)    /* 25MHz 68040 - model 425e */
-#define HP_433T         (14)    /* 33MHz 68040 - model 433t */
-#define HP_433S         (15)    /* 33MHz 68040 - model 433s */
 #endif /* _M68K_HP300HW_H */
diff --git a/arch/m68k/include/asm/kexec.h b/arch/m68k/include/asm/kexec.h
new file mode 100644
index 000000000000..3df97abac147
--- /dev/null
+++ b/arch/m68k/include/asm/kexec.h
@@ -0,0 +1,29 @@
+#ifndef _ASM_M68K_KEXEC_H
+#define _ASM_M68K_KEXEC_H
+#ifdef CONFIG_KEXEC
+/* Maximum physical address we can use pages from */
+#define KEXEC_SOURCE_MEMORY_LIMIT (-1UL)
+/* Maximum address we can reach in physical address mode */
+#define KEXEC_DESTINATION_MEMORY_LIMIT (-1UL)
+/* Maximum address we can use for the control code buffer */
+#define KEXEC_CONTROL_MEMORY_LIMIT (-1UL)
+#define KEXEC_CONTROL_PAGE_SIZE 4096
+#define KEXEC_ARCH KEXEC_ARCH_68K
+#ifndef __ASSEMBLY__
+static inline void crash_setup_regs(struct pt_regs *newregs,
+                                    struct pt_regs *oldregs)
+{
+        /* Dummy implementation for now */
+}
+#endif /* __ASSEMBLY__ */
+#endif /* CONFIG_KEXEC */
+#endif /* _ASM_M68K_KEXEC_H */
diff --git a/arch/m68k/include/asm/mac_via.h b/arch/m68k/include/asm/mac_via.h
index aeeedf8b2d25..fe3fc9ae1b69 100644
--- a/arch/m68k/include/asm/mac_via.h
+++ b/arch/m68k/include/asm/mac_via.h
@@ -254,6 +254,8 @@
 extern volatile __u8 *via1,*via2;
 extern int rbv_present,via_alt_mapping;
+struct irq_desc;
 extern void via_register_interrupts(void);
 extern void via_irq_enable(int);
 extern void via_irq_disable(int);
diff --git a/arch/m68k/include/asm/macintosh.h b/arch/m68k/include/asm/macintosh.h
index 682a1a2ff55f..d323b2c2d07d 100644
--- a/arch/m68k/include/asm/macintosh.h
+++ b/arch/m68k/include/asm/macintosh.h
@@ -4,6 +4,9 @@
 #include <linux/seq_file.h>
 #include <linux/interrupt.h>
+#include <asm/bootinfo-mac.h>
 /*
 *      Apple Macintoshisms
 */
@@ -74,65 +77,29 @@ struct mac_model
 #define MAC_FLOPPY_SWIM_IOP     3
 #define MAC_FLOPPY_AV           4
-/*
+extern struct mac_model *macintosh_config;
- *      Gestalt numbers
- */
-#define MAC_MODEL_II            6
-#define MAC_MODEL_IIX           7
-#define MAC_MODEL_IICX          8
-#define MAC_MODEL_SE30          9
-#define MAC_MODEL_IICI          11
-#define MAC_MODEL_IIFX          13      /* And well numbered it is too */
-#define MAC_MODEL_IISI          18
-#define MAC_MODEL_LC            19
-#define MAC_MODEL_Q900          20
-#define MAC_MODEL_PB170         21
-#define MAC_MODEL_Q700          22
-#define MAC_MODEL_CLII          23      /* aka: P200 */
-#define MAC_MODEL_PB140         25
-#define MAC_MODEL_Q950          26      /* aka: WGS95 */
-#define MAC_MODEL_LCIII         27      /* aka: P450 */
-#define MAC_MODEL_PB210         29
-#define MAC_MODEL_C650          30
-#define MAC_MODEL_PB230         32
-#define MAC_MODEL_PB180         33
-#define MAC_MODEL_PB160         34
-#define MAC_MODEL_Q800          35      /* aka: WGS80 */
-#define MAC_MODEL_Q650          36
-#define MAC_MODEL_LCII          37      /* aka: P400/405/410/430 */
-#define MAC_MODEL_PB250         38
-#define MAC_MODEL_IIVI          44
-#define MAC_MODEL_P600          45      /* aka: P600CD */
-#define MAC_MODEL_IIVX          48
-#define MAC_MODEL_CCL           49      /* aka: P250 */
-#define MAC_MODEL_PB165C        50
-#define MAC_MODEL_C610          52      /* aka: WGS60 */
-#define MAC_MODEL_Q610          53
-#define MAC_MODEL_PB145         54      /* aka: PB145B */
-#define MAC_MODEL_P520          56      /* aka: LC520 */
-#define MAC_MODEL_C660          60
-#define MAC_MODEL_P460          62      /* aka: LCIII+, P466/P467 */
-#define MAC_MODEL_PB180C        71
-#define MAC_MODEL_PB520         72      /* aka: PB520C, PB540, PB540C, PB550C */
-#define MAC_MODEL_PB270C        77
-#define MAC_MODEL_Q840          78
-#define MAC_MODEL_P550          80      /* aka: LC550, P560 */
-#define MAC_MODEL_CCLII         83      /* aka: P275 */
-#define MAC_MODEL_PB165         84
-#define MAC_MODEL_PB190         85      /* aka: PB190CS */
-#define MAC_MODEL_TV            88
-#define MAC_MODEL_P475          89      /* aka: LC475, P476 */
-#define MAC_MODEL_P475F         90      /* aka: P475 w/ FPU (no LC040) */
-#define MAC_MODEL_P575          92      /* aka: LC575, P577/P578 */
-#define MAC_MODEL_Q605          94
-#define MAC_MODEL_Q605_ACC      95      /* Q605 accelerated to 33 MHz */
-#define MAC_MODEL_Q630          98      /* aka: LC630, P630/631/635/636/637/638/640 */
-#define MAC_MODEL_P588          99      /* aka: LC580, P580 */
-#define MAC_MODEL_PB280         102
-#define MAC_MODEL_PB280C        103
-#define MAC_MODEL_PB150         115
-extern struct mac_model *macintosh_config;
+    /*
+     * Internal representation of the Mac hardware, filled in from bootinfo
+     */
+struct mac_booter_data
+{
+        unsigned long videoaddr;
+        unsigned long videorow;
+        unsigned long videodepth;
+        unsigned long dimensions;
+        unsigned long boottime;
+        unsigned long gmtbias;
+        unsigned long videological;
+        unsigned long sccbase;
+        unsigned long id;
+        unsigned long memsize;
+        unsigned long cpuid;
+        unsigned long rombase;
+};
+extern struct mac_booter_data mac_bi_data;
 #endif
diff --git a/arch/m68k/include/asm/mc146818rtc.h b/arch/m68k/include/asm/mc146818rtc.h
index 9f70a01f73dc..05b43bf5cdf3 100644
--- a/arch/m68k/include/asm/mc146818rtc.h
+++ b/arch/m68k/include/asm/mc146818rtc.h
@@ -10,16 +10,16 @@
 #include <asm/atarihw.h>
-#define RTC_PORT(x)     (TT_RTC_BAS + 2*(x))
+#define ATARI_RTC_PORT(x)       (TT_RTC_BAS + 2*(x))
 #define RTC_ALWAYS_BCD  0
 #define CMOS_READ(addr) ({ \
-atari_outb_p((addr),RTC_PORT(0)); \
+atari_outb_p((addr), ATARI_RTC_PORT(0)); \
-atari_inb_p(RTC_PORT(1)); \
+atari_inb_p(ATARI_RTC_PORT(1)); \
 })
 #define CMOS_WRITE(val, addr) ({ \
-atari_outb_p((addr),RTC_PORT(0)); \
+atari_outb_p((addr), ATARI_RTC_PORT(0)); \
-atari_outb_p((val),RTC_PORT(1)); \
+atari_outb_p((val), ATARI_RTC_PORT(1)); \
 })
 #endif /* CONFIG_ATARI */
diff --git a/arch/m68k/include/asm/mvme16xhw.h b/arch/m68k/include/asm/mvme16xhw.h
index 6117f56653d2..1eb89de631e5 100644
--- a/arch/m68k/include/asm/mvme16xhw.h
+++ b/arch/m68k/include/asm/mvme16xhw.h
@@ -3,23 +3,6 @@
 #include <asm/irq.h>
-/* Board ID data structure - pointer to this retrieved from Bug by head.S */
-/* Note, bytes 12 and 13 are board no in BCD (0162,0166,0167,0177,etc) */
-extern long mvme_bdid_ptr;
-typedef struct {
-        char    bdid[4];
-        u_char  rev, mth, day, yr;
-        u_short size, reserved;
-        u_short brdno;
-        char brdsuffix[2];
-        u_long  options;
-        u_short clun, dlun, ctype, dnum;
-        u_long  option2;
-} t_bdid, *p_bdid;
 typedef struct {
        u_char  ack_icr,
diff --git a/arch/m68k/include/asm/setup.h b/arch/m68k/include/asm/setup.h
index 65e78a2dad64..8f2023f8c1c4 100644
--- a/arch/m68k/include/asm/setup.h
+++ b/arch/m68k/include/asm/setup.h
@@ -22,6 +22,7 @@
 #ifndef _M68K_SETUP_H
 #define _M68K_SETUP_H
+#include <uapi/asm/bootinfo.h>
 #include <uapi/asm/setup.h>
@@ -297,14 +298,14 @@ extern int m68k_is040or060;
 #define NUM_MEMINFO     4
 #ifndef __ASSEMBLY__
-struct mem_info {
+struct m68k_mem_info {
        unsigned long addr;             /* physical address of memory chunk */
        unsigned long size;             /* length of memory chunk (in bytes) */
 };
 extern int m68k_num_memory;             /* # of memory blocks found (and used) */
 extern int m68k_realnum_memory;         /* real # of memory blocks found */
-extern struct mem_info m68k_memory[NUM_MEMINFO];/* memory description */
+extern struct m68k_mem_info m68k_memory[NUM_MEMINFO];/* memory description */
 #endif
 #endif /* _M68K_SETUP_H */
diff --git a/arch/m68k/include/asm/timex.h b/arch/m68k/include/asm/timex.h
index 6759dad954f6..efc1f4892357 100644
--- a/arch/m68k/include/asm/timex.h
+++ b/arch/m68k/include/asm/timex.h
@@ -28,4 +28,14 @@ static inline cycles_t get_cycles(void)
        return 0;
 }
+extern unsigned long (*mach_random_get_entropy)(void);
+static inline unsigned long random_get_entropy(void)
+{
+        if (mach_random_get_entropy)
+                return mach_random_get_entropy();
+        return 0;
+}
+#define random_get_entropy      random_get_entropy
 #endif
diff --git a/arch/m68k/include/uapi/asm/Kbuild b/arch/m68k/include/uapi/asm/Kbuild
index 1fef45ada097..6a2d257bdfb2 100644
--- a/arch/m68k/include/uapi/asm/Kbuild
+++ b/arch/m68k/include/uapi/asm/Kbuild
@@ -11,6 +11,14 @@ generic-y += termbits.h
 generic-y += termios.h
 header-y += a.out.h
+header-y += bootinfo.h
+header-y += bootinfo-amiga.h
+header-y += bootinfo-apollo.h
+header-y += bootinfo-atari.h
+header-y += bootinfo-hp300.h
+header-y += bootinfo-mac.h
+header-y += bootinfo-q40.h
+header-y += bootinfo-vme.h
 header-y += byteorder.h
 header-y += cachectl.h
 header-y += fcntl.h
diff --git a/arch/m68k/include/uapi/asm/bootinfo-amiga.h b/arch/m68k/include/uapi/asm/bootinfo-amiga.h
new file mode 100644
index 000000000000..daad3c58d2da
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/bootinfo-amiga.h
@@ -0,0 +1,63 @@
+/*
+** asm/bootinfo-amiga.h -- Amiga-specific boot information definitions
+*/
+#ifndef _UAPI_ASM_M68K_BOOTINFO_AMIGA_H
+#define _UAPI_ASM_M68K_BOOTINFO_AMIGA_H
+    /*
+     *  Amiga-specific tags
+     */
+#define BI_AMIGA_MODEL          0x8000  /* model (__be32) */
+#define BI_AMIGA_AUTOCON        0x8001  /* AutoConfig device */
+                                        /* (AmigaOS struct ConfigDev) */
+#define BI_AMIGA_CHIP_SIZE      0x8002  /* size of Chip RAM (__be32) */
+#define BI_AMIGA_VBLANK         0x8003  /* VBLANK frequency (__u8) */
+#define BI_AMIGA_PSFREQ         0x8004  /* power supply frequency (__u8) */
+#define BI_AMIGA_ECLOCK         0x8005  /* EClock frequency (__be32) */
+#define BI_AMIGA_CHIPSET        0x8006  /* native chipset present (__be32) */
+#define BI_AMIGA_SERPER         0x8007  /* serial port period (__be16) */
+    /*
+     *  Amiga models (BI_AMIGA_MODEL)
+     */
+#define AMI_UNKNOWN             0
+#define AMI_500                 1
+#define AMI_500PLUS             2
+#define AMI_600                 3
+#define AMI_1000                4
+#define AMI_1200                5
+#define AMI_2000                6
+#define AMI_2500                7
+#define AMI_3000                8
+#define AMI_3000T               9
+#define AMI_3000PLUS            10
+#define AMI_4000                11
+#define AMI_4000T               12
+#define AMI_CDTV                13
+#define AMI_CD32                14
+#define AMI_DRACO               15
+    /*
+     *  Amiga chipsets (BI_AMIGA_CHIPSET)
+     */
+#define CS_STONEAGE             0
+#define CS_OCS                  1
+#define CS_ECS                  2
+#define CS_AGA                  3
+    /*
+     *  Latest Amiga bootinfo version
+     */
+#define AMIGA_BOOTI_VERSION     MK_BI_VERSION(2, 0)
+#endif /* _UAPI_ASM_M68K_BOOTINFO_AMIGA_H */
diff --git a/arch/m68k/include/uapi/asm/bootinfo-apollo.h b/arch/m68k/include/uapi/asm/bootinfo-apollo.h
new file mode 100644
index 000000000000..a93e0af1c6fe
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/bootinfo-apollo.h
@@ -0,0 +1,28 @@
+/*
+** asm/bootinfo-apollo.h -- Apollo-specific boot information definitions
+*/
+#ifndef _UAPI_ASM_M68K_BOOTINFO_APOLLO_H
+#define _UAPI_ASM_M68K_BOOTINFO_APOLLO_H
+    /*
+     *  Apollo-specific tags
+     */
+#define BI_APOLLO_MODEL         0x8000  /* model (__be32) */
+    /*
+     *  Apollo models (BI_APOLLO_MODEL)
+     */
+#define APOLLO_UNKNOWN          0
+#define APOLLO_DN3000           1
+#define APOLLO_DN3010           2
+#define APOLLO_DN3500           3
+#define APOLLO_DN4000           4
+#define APOLLO_DN4500           5
+#endif /* _UAPI_ASM_M68K_BOOTINFO_APOLLO_H */
diff --git a/arch/m68k/include/uapi/asm/bootinfo-atari.h b/arch/m68k/include/uapi/asm/bootinfo-atari.h
new file mode 100644
index 000000000000..a817854049bb
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/bootinfo-atari.h
@@ -0,0 +1,44 @@
+/*
+** asm/bootinfo-atari.h -- Atari-specific boot information definitions
+*/
+#ifndef _UAPI_ASM_M68K_BOOTINFO_ATARI_H
+#define _UAPI_ASM_M68K_BOOTINFO_ATARI_H
+    /*
+     *  Atari-specific tags
+     */
+#define BI_ATARI_MCH_COOKIE     0x8000  /* _MCH cookie from TOS (__be32) */
+#define BI_ATARI_MCH_TYPE       0x8001  /* special machine type (__be32) */
+    /*
+     *  mch_cookie values (upper word of BI_ATARI_MCH_COOKIE)
+     */
+#define ATARI_MCH_ST            0
+#define ATARI_MCH_STE           1
+#define ATARI_MCH_TT            2
+#define ATARI_MCH_FALCON        3
+    /*
+     *  Atari machine types (BI_ATARI_MCH_TYPE)
+     */
+#define ATARI_MACH_NORMAL       0       /* no special machine type */
+#define ATARI_MACH_MEDUSA       1       /* Medusa 040 */
+#define ATARI_MACH_HADES        2       /* Hades 040 or 060 */
+#define ATARI_MACH_AB40         3       /* Afterburner040 on Falcon */
+    /*
+     *  Latest Atari bootinfo version
+     */
+#define ATARI_BOOTI_VERSION     MK_BI_VERSION(2, 1)
+#endif /* _UAPI_ASM_M68K_BOOTINFO_ATARI_H */
diff --git a/arch/m68k/include/uapi/asm/bootinfo-hp300.h b/arch/m68k/include/uapi/asm/bootinfo-hp300.h
new file mode 100644
index 000000000000..c90cb71ed89a
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/bootinfo-hp300.h
@@ -0,0 +1,50 @@
+/*
+** asm/bootinfo-hp300.h -- HP9000/300-specific boot information definitions
+*/
+#ifndef _UAPI_ASM_M68K_BOOTINFO_HP300_H
+#define _UAPI_ASM_M68K_BOOTINFO_HP300_H
+    /*
+     *  HP9000/300-specific tags
+     */
+#define BI_HP300_MODEL          0x8000  /* model (__be32) */
+#define BI_HP300_UART_SCODE     0x8001  /* UART select code (__be32) */
+#define BI_HP300_UART_ADDR      0x8002  /* phys. addr of UART (__be32) */
+    /*
+     *  HP9000/300 and /400 models (BI_HP300_MODEL)
+     *
+     * This information was taken from NetBSD
+     */
+#define HP_320          0       /* 16MHz 68020+HP MMU+16K external cache */
+#define HP_330          1       /* 16MHz 68020+68851 MMU */
+#define HP_340          2       /* 16MHz 68030 */
+#define HP_345          3       /* 50MHz 68030+32K external cache */
+#define HP_350          4       /* 25MHz 68020+HP MMU+32K external cache */
+#define HP_360          5       /* 25MHz 68030 */
+#define HP_370          6       /* 33MHz 68030+64K external cache */
+#define HP_375          7       /* 50MHz 68030+32K external cache */
+#define HP_380          8       /* 25MHz 68040 */
+#define HP_385          9       /* 33MHz 68040 */
+#define HP_400          10      /* 50MHz 68030+32K external cache */
+#define HP_425T         11      /* 25MHz 68040 - model 425t */
+#define HP_425S         12      /* 25MHz 68040 - model 425s */
+#define HP_425E         13      /* 25MHz 68040 - model 425e */
+#define HP_433T         14      /* 33MHz 68040 - model 433t */
+#define HP_433S         15      /* 33MHz 68040 - model 433s */
+    /*
+     *  Latest HP9000/300 bootinfo version
+     */
+#define HP300_BOOTI_VERSION     MK_BI_VERSION(2, 0)
+#endif /* _UAPI_ASM_M68K_BOOTINFO_HP300_H */
diff --git a/arch/m68k/include/uapi/asm/bootinfo-mac.h b/arch/m68k/include/uapi/asm/bootinfo-mac.h
new file mode 100644
index 000000000000..b44ff73898a9
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/bootinfo-mac.h
@@ -0,0 +1,119 @@
+/*
+** asm/bootinfo-mac.h -- Macintosh-specific boot information definitions
+*/
+#ifndef _UAPI_ASM_M68K_BOOTINFO_MAC_H
+#define _UAPI_ASM_M68K_BOOTINFO_MAC_H
+    /*
+     *  Macintosh-specific tags (all __be32)
+     */
+#define BI_MAC_MODEL            0x8000  /* Mac Gestalt ID (model type) */
+#define BI_MAC_VADDR            0x8001  /* Mac video base address */
+#define BI_MAC_VDEPTH           0x8002  /* Mac video depth */
+#define BI_MAC_VROW             0x8003  /* Mac video rowbytes */
+#define BI_MAC_VDIM             0x8004  /* Mac video dimensions */
+#define BI_MAC_VLOGICAL         0x8005  /* Mac video logical base */
+#define BI_MAC_SCCBASE          0x8006  /* Mac SCC base address */
+#define BI_MAC_BTIME            0x8007  /* Mac boot time */
+#define BI_MAC_GMTBIAS          0x8008  /* Mac GMT timezone offset */
+#define BI_MAC_MEMSIZE          0x8009  /* Mac RAM size (sanity check) */
+#define BI_MAC_CPUID            0x800a  /* Mac CPU type (sanity check) */
+#define BI_MAC_ROMBASE          0x800b  /* Mac system ROM base address */
+    /*
+     *  Macintosh hardware profile data - unused, see macintosh.h for
+     *  reasonable type values
+     */
+#define BI_MAC_VIA1BASE         0x8010  /* Mac VIA1 base address (always present) */
+#define BI_MAC_VIA2BASE         0x8011  /* Mac VIA2 base address (type varies) */
+#define BI_MAC_VIA2TYPE         0x8012  /* Mac VIA2 type (VIA, RBV, OSS) */
+#define BI_MAC_ADBTYPE          0x8013  /* Mac ADB interface type */
+#define BI_MAC_ASCBASE          0x8014  /* Mac Apple Sound Chip base address */
+#define BI_MAC_SCSI5380         0x8015  /* Mac NCR 5380 SCSI (base address, multi) */
+#define BI_MAC_SCSIDMA          0x8016  /* Mac SCSI DMA (base address) */
+#define BI_MAC_SCSI5396         0x8017  /* Mac NCR 53C96 SCSI (base address, multi) */
+#define BI_MAC_IDETYPE          0x8018  /* Mac IDE interface type */
+#define BI_MAC_IDEBASE          0x8019  /* Mac IDE interface base address */
+#define BI_MAC_NUBUS            0x801a  /* Mac Nubus type (none, regular, pseudo) */
+#define BI_MAC_SLOTMASK         0x801b  /* Mac Nubus slots present */
+#define BI_MAC_SCCTYPE          0x801c  /* Mac SCC serial type (normal, IOP) */
+#define BI_MAC_ETHTYPE          0x801d  /* Mac builtin ethernet type (Sonic, MACE */
+#define BI_MAC_ETHBASE          0x801e  /* Mac builtin ethernet base address */
+#define BI_MAC_PMU              0x801f  /* Mac power management / poweroff hardware */
+#define BI_MAC_IOP_SWIM         0x8020  /* Mac SWIM floppy IOP */
+#define BI_MAC_IOP_ADB          0x8021  /* Mac ADB IOP */
+    /*
+     * Macintosh Gestalt numbers (BI_MAC_MODEL)
+     */
+#define MAC_MODEL_II            6
+#define MAC_MODEL_IIX           7
+#define MAC_MODEL_IICX          8
+#define MAC_MODEL_SE30          9
+#define MAC_MODEL_IICI          11
+#define MAC_MODEL_IIFX          13      /* And well numbered it is too */
+#define MAC_MODEL_IISI          18
+#define MAC_MODEL_LC            19
+#define MAC_MODEL_Q900          20
+#define MAC_MODEL_PB170         21
+#define MAC_MODEL_Q700          22
+#define MAC_MODEL_CLII          23      /* aka: P200 */
+#define MAC_MODEL_PB140         25
+#define MAC_MODEL_Q950          26      /* aka: WGS95 */
+#define MAC_MODEL_LCIII         27      /* aka: P450 */
+#define MAC_MODEL_PB210         29
+#define MAC_MODEL_C650          30
+#define MAC_MODEL_PB230         32
+#define MAC_MODEL_PB180         33
+#define MAC_MODEL_PB160         34
+#define MAC_MODEL_Q800          35      /* aka: WGS80 */
+#define MAC_MODEL_Q650          36
+#define MAC_MODEL_LCII          37      /* aka: P400/405/410/430 */
+#define MAC_MODEL_PB250         38
+#define MAC_MODEL_IIVI          44
+#define MAC_MODEL_P600          45      /* aka: P600CD */
+#define MAC_MODEL_IIVX          48
+#define MAC_MODEL_CCL           49      /* aka: P250 */
+#define MAC_MODEL_PB165C        50
+#define MAC_MODEL_C610          52      /* aka: WGS60 */
+#define MAC_MODEL_Q610          53
+#define MAC_MODEL_PB145         54      /* aka: PB145B */
+#define MAC_MODEL_P520          56      /* aka: LC520 */
+#define MAC_MODEL_C660          60
+#define MAC_MODEL_P460          62      /* aka: LCIII+, P466/P467 */
+#define MAC_MODEL_PB180C        71
+#define MAC_MODEL_PB520         72      /* aka: PB520C, PB540, PB540C, PB550C */
+#define MAC_MODEL_PB270C        77
+#define MAC_MODEL_Q840          78
+#define MAC_MODEL_P550          80      /* aka: LC550, P560 */
+#define MAC_MODEL_CCLII         83      /* aka: P275 */
+#define MAC_MODEL_PB165         84
+#define MAC_MODEL_PB190         85      /* aka: PB190CS */
+#define MAC_MODEL_TV            88
+#define MAC_MODEL_P475          89      /* aka: LC475, P476 */
+#define MAC_MODEL_P475F         90      /* aka: P475 w/ FPU (no LC040) */
+#define MAC_MODEL_P575          92      /* aka: LC575, P577/P578 */
+#define MAC_MODEL_Q605          94
+#define MAC_MODEL_Q605_ACC      95      /* Q605 accelerated to 33 MHz */
+#define MAC_MODEL_Q630          98      /* aka: LC630, P630/631/635/636/637/638/640 */
+#define MAC_MODEL_P588          99      /* aka: LC580, P580 */
+#define MAC_MODEL_PB280         102
+#define MAC_MODEL_PB280C        103
+#define MAC_MODEL_PB150         115
+    /*
+     *  Latest Macintosh bootinfo version
+     */
+#define MAC_BOOTI_VERSION       MK_BI_VERSION(2, 0)
+#endif /* _UAPI_ASM_M68K_BOOTINFO_MAC_H */
diff --git a/arch/m68k/include/uapi/asm/bootinfo-q40.h b/arch/m68k/include/uapi/asm/bootinfo-q40.h
new file mode 100644
index 000000000000..c79fea7e555b
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/bootinfo-q40.h
@@ -0,0 +1,16 @@
+/*
+** asm/bootinfo-q40.h -- Q40-specific boot information definitions
+*/
+#ifndef _UAPI_ASM_M68K_BOOTINFO_Q40_H
+#define _UAPI_ASM_M68K_BOOTINFO_Q40_H
+    /*
+     *  Latest Q40 bootinfo version
+     */
+#define Q40_BOOTI_VERSION       MK_BI_VERSION(2, 0)
+#endif /* _UAPI_ASM_M68K_BOOTINFO_Q40_H */
diff --git a/arch/m68k/include/uapi/asm/bootinfo-vme.h b/arch/m68k/include/uapi/asm/bootinfo-vme.h
new file mode 100644
index 000000000000..a135eb41d672
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/bootinfo-vme.h
@@ -0,0 +1,70 @@
+/*
+** asm/bootinfo-vme.h -- VME-specific boot information definitions
+*/
+#ifndef _UAPI_ASM_M68K_BOOTINFO_VME_H
+#define _UAPI_ASM_M68K_BOOTINFO_VME_H
+#include <linux/types.h>
+    /*
+     *  VME-specific tags
+     */
+#define BI_VME_TYPE             0x8000  /* VME sub-architecture (__be32) */
+#define BI_VME_BRDINFO          0x8001  /* VME board information (struct) */
+    /*
+     *  VME models (BI_VME_TYPE)
+     */
+#define VME_TYPE_TP34V          0x0034  /* Tadpole TP34V */
+#define VME_TYPE_MVME147        0x0147  /* Motorola MVME147 */
+#define VME_TYPE_MVME162        0x0162  /* Motorola MVME162 */
+#define VME_TYPE_MVME166        0x0166  /* Motorola MVME166 */
+#define VME_TYPE_MVME167        0x0167  /* Motorola MVME167 */
+#define VME_TYPE_MVME172        0x0172  /* Motorola MVME172 */
+#define VME_TYPE_MVME177        0x0177  /* Motorola MVME177 */
+#define VME_TYPE_BVME4000       0x4000  /* BVM Ltd. BVME4000 */
+#define VME_TYPE_BVME6000       0x6000  /* BVM Ltd. BVME6000 */
+#ifndef __ASSEMBLY__
+/*
+ * Board ID data structure - pointer to this retrieved from Bug by head.S
+ *
+ * BI_VME_BRDINFO is a 32 byte struct as returned by the Bug code on
+ * Motorola VME boards.  Contains board number, Bug version, board
+ * configuration options, etc.
+ *
+ * Note, bytes 12 and 13 are board no in BCD (0162,0166,0167,0177,etc)
+ */
+typedef struct {
+        char    bdid[4];
+        __u8    rev, mth, day, yr;
+        __be16  size, reserved;
+        __be16  brdno;
+        char    brdsuffix[2];
+        __be32  options;
+        __be16  clun, dlun, ctype, dnum;
+        __be32  option2;
+} t_bdid, *p_bdid;
+#endif /* __ASSEMBLY__ */
+    /*
+     *  Latest VME bootinfo versions
+     */
+#define MVME147_BOOTI_VERSION   MK_BI_VERSION(2, 0)
+#define MVME16x_BOOTI_VERSION   MK_BI_VERSION(2, 0)
+#define BVME6000_BOOTI_VERSION  MK_BI_VERSION(2, 0)
+#endif /* _UAPI_ASM_M68K_BOOTINFO_VME_H */
diff --git a/arch/m68k/include/uapi/asm/bootinfo.h b/arch/m68k/include/uapi/asm/bootinfo.h
new file mode 100644
index 000000000000..cdeb26a015b0
--- /dev/null
+++ b/arch/m68k/include/uapi/asm/bootinfo.h
@@ -0,0 +1,174 @@
+/*
+ * asm/bootinfo.h -- Definition of the Linux/m68k boot information structure
+ *
+ * Copyright 1992 by Greg Harp
+ *
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file COPYING in the main directory of this archive
+ * for more details.
+ */
+#ifndef _UAPI_ASM_M68K_BOOTINFO_H
+#define _UAPI_ASM_M68K_BOOTINFO_H
+#include <linux/types.h>
+#ifndef __ASSEMBLY__
+    /*
+     *  Bootinfo definitions
+     *
+     *  This is an easily parsable and extendable structure containing all
+     *  information to be passed from the bootstrap to the kernel.
+     *
+     *  This way I hope to keep all future changes back/forewards compatible.
+     *  Thus, keep your fingers crossed...
+     *
+     *  This structure is copied right after the kernel by the bootstrap
+     *  routine.
+     */
+struct bi_record {
+        __be16 tag;                     /* tag ID */
+        __be16 size;                    /* size of record (in bytes) */
+        __be32 data[0];                 /* data */
+};
+struct mem_info {
+        __be32 addr;                    /* physical address of memory chunk */
+        __be32 size;                    /* length of memory chunk (in bytes) */
+};
+#endif /* __ASSEMBLY__ */
+    /*
+     *  Tag Definitions
+     *
+     *  Machine independent tags start counting from 0x0000
+     *  Machine dependent tags start counting from 0x8000
+     */
+#define BI_LAST                 0x0000  /* last record (sentinel) */
+#define BI_MACHTYPE             0x0001  /* machine type (__be32) */
+#define BI_CPUTYPE              0x0002  /* cpu type (__be32) */
+#define BI_FPUTYPE              0x0003  /* fpu type (__be32) */
+#define BI_MMUTYPE              0x0004  /* mmu type (__be32) */
+#define BI_MEMCHUNK             0x0005  /* memory chunk address and size */
+                                        /* (struct mem_info) */
+#define BI_RAMDISK              0x0006  /* ramdisk address and size */
+                                        /* (struct mem_info) */
+#define BI_COMMAND_LINE         0x0007  /* kernel command line parameters */
+                                        /* (string) */
+    /*
+     *  Linux/m68k Architectures (BI_MACHTYPE)
+     */
+#define MACH_AMIGA              1
+#define MACH_ATARI              2
+#define MACH_MAC                3
+#define MACH_APOLLO             4
+#define MACH_SUN3               5
+#define MACH_MVME147            6
+#define MACH_MVME16x            7
+#define MACH_BVME6000           8
+#define MACH_HP300              9
+#define MACH_Q40                10
+#define MACH_SUN3X              11
+#define MACH_M54XX              12
+    /*
+     *  CPU, FPU and MMU types (BI_CPUTYPE, BI_FPUTYPE, BI_MMUTYPE)
+     *
+     *  Note: we may rely on the following equalities:
+     *
+     *      CPU_68020 == MMU_68851
+     *      CPU_68030 == MMU_68030
+     *      CPU_68040 == FPU_68040 == MMU_68040
+     *      CPU_68060 == FPU_68060 == MMU_68060
+     */
+#define CPUB_68020              0
+#define CPUB_68030              1
+#define CPUB_68040              2
+#define CPUB_68060              3
+#define CPUB_COLDFIRE           4
+#define CPU_68020               (1 << CPUB_68020)
+#define CPU_68030               (1 << CPUB_68030)
+#define CPU_68040               (1 << CPUB_68040)
+#define CPU_68060               (1 << CPUB_68060)
+#define CPU_COLDFIRE            (1 << CPUB_COLDFIRE)
+#define FPUB_68881              0
+#define FPUB_68882              1
+#define FPUB_68040              2       /* Internal FPU */
+#define FPUB_68060              3       /* Internal FPU */
+#define FPUB_SUNFPA             4       /* Sun-3 FPA */
+#define FPUB_COLDFIRE           5       /* ColdFire FPU */
+#define FPU_68881               (1 << FPUB_68881)
+#define FPU_68882               (1 << FPUB_68882)
+#define FPU_68040               (1 << FPUB_68040)
+#define FPU_68060               (1 << FPUB_68060)
+#define FPU_SUNFPA              (1 << FPUB_SUNFPA)
+#define FPU_COLDFIRE            (1 << FPUB_COLDFIRE)
+#define MMUB_68851              0
+#define MMUB_68030              1       /* Internal MMU */
+#define MMUB_68040              2       /* Internal MMU */
+#define MMUB_68060              3       /* Internal MMU */
+#define MMUB_APOLLO             4       /* Custom Apollo */
+#define MMUB_SUN3               5       /* Custom Sun-3 */
+#define MMUB_COLDFIRE           6       /* Internal MMU */
+#define MMU_68851               (1 << MMUB_68851)
+#define MMU_68030               (1 << MMUB_68030)
+#define MMU_68040               (1 << MMUB_68040)
+#define MMU_68060               (1 << MMUB_68060)
+#define MMU_SUN3                (1 << MMUB_SUN3)
+#define MMU_APOLLO              (1 << MMUB_APOLLO)
+#define MMU_COLDFIRE            (1 << MMUB_COLDFIRE)
+    /*
+     * Stuff for bootinfo interface versioning
+     *
+     * At the start of kernel code, a 'struct bootversion' is located.
+     * bootstrap checks for a matching version of the interface before booting
+     * a kernel, to avoid user confusion if kernel and bootstrap don't work
+     * together :-)
+     *
+     * If incompatible changes are made to the bootinfo interface, the major
+     * number below should be stepped (and the minor reset to 0) for the
+     * appropriate machine. If a change is backward-compatible, the minor
+     * should be stepped. "Backwards-compatible" means that booting will work,
+     * but certain features may not.
+     */
+#define BOOTINFOV_MAGIC                 0x4249561A      /* 'BIV^Z' */
+#define MK_BI_VERSION(major, minor)     (((major) << 16) + (minor))
+#define BI_VERSION_MAJOR(v)             (((v) >> 16) & 0xffff)
+#define BI_VERSION_MINOR(v)             ((v) & 0xffff)
+#ifndef __ASSEMBLY__
+struct bootversion {
+        __be16 branch;
+        __be32 magic;
+        struct {
+                __be32 machtype;
+                __be32 version;
+        } machversions[0];
+} __packed;
+#endif /* __ASSEMBLY__ */
+#endif /* _UAPI_ASM_M68K_BOOTINFO_H */
diff --git a/arch/m68k/include/uapi/asm/setup.h b/arch/m68k/include/uapi/asm/setup.h
index 85579bff455c..6a6dc636761e 100644
--- a/arch/m68k/include/uapi/asm/setup.h
+++ b/arch/m68k/include/uapi/asm/setup.h
@@ -6,98 +6,11 @@
 ** This file is subject to the terms and conditions of the GNU General Public
 ** License.  See the file COPYING in the main directory of this archive
 ** for more details.
-**
-** Created 09/29/92 by Greg Harp
-**
-** 5/2/94 Roman Hodek:
-**   Added bi_atari part of the machine dependent union bi_un; for now it
-**   contains just a model field to distinguish between TT and Falcon.
-** 26/7/96 Roman Zippel:
-**   Renamed to setup.h; added some useful macros to allow gcc some
-**   optimizations if possible.
-** 5/10/96 Geert Uytterhoeven:
-**   Redesign of the boot information structure; moved boot information
-**   structure to bootinfo.h
 */
 #ifndef _UAPI_M68K_SETUP_H
 #define _UAPI_M68K_SETUP_H
-    /*
-     *  Linux/m68k Architectures
-     */
-#define MACH_AMIGA    1
-#define MACH_ATARI    2
-#define MACH_MAC      3
-#define MACH_APOLLO   4
-#define MACH_SUN3     5
-#define MACH_MVME147  6
-#define MACH_MVME16x  7
-#define MACH_BVME6000 8
-#define MACH_HP300    9
-#define MACH_Q40     10
-#define MACH_SUN3X   11
-#define MACH_M54XX   12
 #define COMMAND_LINE_SIZE 256
-    /*
-     *  CPU, FPU and MMU types
-     *
-     *  Note: we may rely on the following equalities:
-     *
-     *      CPU_68020 == MMU_68851
-     *      CPU_68030 == MMU_68030
-     *      CPU_68040 == FPU_68040 == MMU_68040
-     *      CPU_68060 == FPU_68060 == MMU_68060
-     */
-#define CPUB_68020     0
-#define CPUB_68030     1
-#define CPUB_68040     2
-#define CPUB_68060     3
-#define CPUB_COLDFIRE  4
-#define CPU_68020      (1<<CPUB_68020)
-#define CPU_68030      (1<<CPUB_68030)
-#define CPU_68040      (1<<CPUB_68040)
-#define CPU_68060      (1<<CPUB_68060)
-#define CPU_COLDFIRE   (1<<CPUB_COLDFIRE)
-#define FPUB_68881     0
-#define FPUB_68882     1
-#define FPUB_68040     2                       /* Internal FPU */
-#define FPUB_68060     3                       /* Internal FPU */
-#define FPUB_SUNFPA    4                       /* Sun-3 FPA */
-#define FPUB_COLDFIRE  5                       /* ColdFire FPU */
-#define FPU_68881      (1<<FPUB_68881)
-#define FPU_68882      (1<<FPUB_68882)
-#define FPU_68040      (1<<FPUB_68040)
-#define FPU_68060      (1<<FPUB_68060)
-#define FPU_SUNFPA     (1<<FPUB_SUNFPA)
-#define FPU_COLDFIRE   (1<<FPUB_COLDFIRE)
-#define MMUB_68851     0
-#define MMUB_68030     1                       /* Internal MMU */
-#define MMUB_68040     2                       /* Internal MMU */
-#define MMUB_68060     3                       /* Internal MMU */
-#define MMUB_APOLLO    4                       /* Custom Apollo */
-#define MMUB_SUN3      5                       /* Custom Sun-3 */
-#define MMUB_COLDFIRE  6                       /* Internal MMU */
-#define MMU_68851      (1<<MMUB_68851)
-#define MMU_68030      (1<<MMUB_68030)
-#define MMU_68040      (1<<MMUB_68040)
-#define MMU_68060      (1<<MMUB_68060)
-#define MMU_SUN3       (1<<MMUB_SUN3)
-#define MMU_APOLLO     (1<<MMUB_APOLLO)
-#define MMU_COLDFIRE   (1<<MMUB_COLDFIRE)
 #endif /* _UAPI_M68K_SETUP_H */
diff --git a/arch/m68k/kernel/Makefile b/arch/m68k/kernel/Makefile
index 655347d80780..2d5d9be16273 100644
--- a/arch/m68k/kernel/Makefile
+++ b/arch/m68k/kernel/Makefile
@@ -22,3 +22,6 @@ obj-$(CONFIG_PCI) += pcibios.o
 obj-$(CONFIG_HAS_DMA)   += dma.o
+obj-$(CONFIG_KEXEC)             += machine_kexec.o relocate_kernel.o
+obj-$(CONFIG_BOOTINFO_PROC)     += bootinfo_proc.o
diff --git a/arch/m68k/kernel/asm-offsets.c b/arch/m68k/kernel/asm-offsets.c
index 8b7b22846366..3a386341aa6e 100644
--- a/arch/m68k/kernel/asm-offsets.c
+++ b/arch/m68k/kernel/asm-offsets.c
@@ -98,6 +98,9 @@ int main(void)
        DEFINE(CIABBASE, &ciab);
        DEFINE(C_PRA, offsetof(struct CIA, pra));
        DEFINE(ZTWOBASE, zTwoBase);
+        /* enum m68k_fixup_type */
+        DEFINE(M68K_FIXUP_MEMOFFSET, m68k_fixup_memoffset);
 #endif
        return 0;
diff --git a/arch/m68k/kernel/bootinfo_proc.c b/arch/m68k/kernel/bootinfo_proc.c
new file mode 100644
index 000000000000..7ee853e1432b
--- /dev/null
+++ b/arch/m68k/kernel/bootinfo_proc.c
@@ -0,0 +1,80 @@
+/*
+ * Based on arch/arm/kernel/atags_proc.c
+ */
+#include <linux/fs.h>
+#include <linux/init.h>
+#include <linux/printk.h>
+#include <linux/proc_fs.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <asm/bootinfo.h>
+#include <asm/byteorder.h>
+static char bootinfo_tmp[1536] __initdata;
+static void *bootinfo_copy;
+static size_t bootinfo_size;
+static ssize_t bootinfo_read(struct file *file, char __user *buf,
+                          size_t count, loff_t *ppos)
+{
+        return simple_read_from_buffer(buf, count, ppos, bootinfo_copy,
+                                       bootinfo_size);
+}
+static const struct file_operations bootinfo_fops = {
+        .read = bootinfo_read,
+        .llseek = default_llseek,
+};
+void __init save_bootinfo(const struct bi_record *bi)
+{
+        const void *start = bi;
+        size_t size = sizeof(bi->tag);
+        while (be16_to_cpu(bi->tag) != BI_LAST) {
+                uint16_t n = be16_to_cpu(bi->size);
+                size += n;
+                bi = (struct bi_record *)((unsigned long)bi + n);
+        }
+        if (size > sizeof(bootinfo_tmp)) {
+                pr_err("Cannot save %zu bytes of bootinfo\n", size);
+                return;
+        }
+        pr_info("Saving %zu bytes of bootinfo\n", size);
+        memcpy(bootinfo_tmp, start, size);
+        bootinfo_size = size;
+}
+static int __init init_bootinfo_procfs(void)
+{
+        /*
+         * This cannot go into save_bootinfo() because kmalloc and proc don't
+         * work yet when it is called.
+         */
+        struct proc_dir_entry *pde;
+        if (!bootinfo_size)
+                return -EINVAL;
+        bootinfo_copy = kmalloc(bootinfo_size, GFP_KERNEL);
+        if (!bootinfo_copy)
+                return -ENOMEM;
+        memcpy(bootinfo_copy, bootinfo_tmp, bootinfo_size);
+        pde = proc_create_data("bootinfo", 0400, NULL, &bootinfo_fops, NULL);
+        if (!pde) {
+                kfree(bootinfo_copy);
+                return -ENOMEM;
+        }
+        return 0;
+}
+arch_initcall(init_bootinfo_procfs);
diff --git a/arch/m68k/kernel/head.S b/arch/m68k/kernel/head.S
index ac85f16534af..4c99bab7e664 100644
--- a/arch/m68k/kernel/head.S
+++ b/arch/m68k/kernel/head.S
@@ -23,7 +23,7 @@
 ** 98/04/25 Phil Blundell: added HP300 support
 ** 1998/08/30 David Kilzer: Added support for font_desc structures
 **            for linux-2.1.115
-** 9/02/11  Richard Zidlicky: added Q40 support (initial vesion 99/01/01)
+** 1999/02/11  Richard Zidlicky: added Q40 support (initial version 99/01/01)
 ** 2004/05/13 Kars de Jong: Finalised HP300 support
 **
 ** This file is subject to the terms and conditions of the GNU General Public
@@ -257,6 +257,12 @@
 #include <linux/linkage.h>
 #include <linux/init.h>
 #include <asm/bootinfo.h>
+#include <asm/bootinfo-amiga.h>
+#include <asm/bootinfo-atari.h>
+#include <asm/bootinfo-hp300.h>
+#include <asm/bootinfo-mac.h>
+#include <asm/bootinfo-q40.h>
+#include <asm/bootinfo-vme.h>
 #include <asm/setup.h>
 #include <asm/entry.h>
 #include <asm/pgtable.h>
@@ -1532,7 +1538,7 @@ L(cache_done):
 /*
 * Find a tag record in the bootinfo structure
- * The bootinfo structure is located right after the kernel bss
+ * The bootinfo structure is located right after the kernel
 * Returns: d0: size (-1 if not found)
 *          a0: data pointer (end-of-records if not found)
 */
@@ -2909,7 +2915,9 @@ func_start	serial_init,%d0/%d1/%a0/%a1
 #if defined(MAC_USE_SCC_A) || defined(MAC_USE_SCC_B)
        movel   %pc@(L(mac_sccbase)),%a0
-        /* Reset SCC device */
+        /* Reset SCC register pointer */
+        moveb   %a0@(mac_scc_cha_a_ctrl_offset),%d0
+        /* Reset SCC device: write register pointer then register value */
        moveb   #9,%a0@(mac_scc_cha_a_ctrl_offset)
        moveb   #0xc0,%a0@(mac_scc_cha_a_ctrl_offset)
        /* Wait for 5 PCLK cycles, which is about 68 CPU cycles */
@@ -3896,8 +3904,6 @@ BVME_SCC_DATA_A	= 0xffb0000f
 #endif
 #if defined(CONFIG_MAC)
-L(mac_booter_data):
-        .long   0
 L(mac_videobase):
        .long   0
 L(mac_videodepth):
diff --git a/arch/m68k/kernel/machine_kexec.c b/arch/m68k/kernel/machine_kexec.c
new file mode 100644
index 000000000000..d4affc917d9d
--- /dev/null
+++ b/arch/m68k/kernel/machine_kexec.c
@@ -0,0 +1,58 @@
+/*
+ * machine_kexec.c - handle transition of Linux booting another kernel
+ */
+#include <linux/compiler.h>
+#include <linux/kexec.h>
+#include <linux/mm.h>
+#include <linux/delay.h>
+#include <asm/cacheflush.h>
+#include <asm/page.h>
+#include <asm/setup.h>
+extern const unsigned char relocate_new_kernel[];
+extern const size_t relocate_new_kernel_size;
+int machine_kexec_prepare(struct kimage *kimage)
+{
+        return 0;
+}
+void machine_kexec_cleanup(struct kimage *kimage)
+{
+}
+void machine_shutdown(void)
+{
+}
+void machine_crash_shutdown(struct pt_regs *regs)
+{
+}
+typedef void (*relocate_kernel_t)(unsigned long ptr,
+                                  unsigned long start,
+                                  unsigned long cpu_mmu_flags) __noreturn;
+void machine_kexec(struct kimage *image)
+{
+        void *reboot_code_buffer;
+        unsigned long cpu_mmu_flags;
+        reboot_code_buffer = page_address(image->control_code_page);
+        memcpy(reboot_code_buffer, relocate_new_kernel,
+               relocate_new_kernel_size);
+        /*
+         * we do not want to be bothered.
+         */
+        local_irq_disable();
+        pr_info("Will call new kernel at 0x%08lx. Bye...\n", image->start);
+        __flush_cache_all();
+        cpu_mmu_flags = m68k_cputype | m68k_mmutype << 8;
+        ((relocate_kernel_t) reboot_code_buffer)(image->head & PAGE_MASK,
+                                                 image->start,
+                                                 cpu_mmu_flags);
+}
diff --git a/arch/m68k/kernel/relocate_kernel.S b/arch/m68k/kernel/relocate_kernel.S
new file mode 100644
index 000000000000..3e09a89067ad
--- /dev/null
+++ b/arch/m68k/kernel/relocate_kernel.S
@@ -0,0 +1,159 @@
+#include <linux/linkage.h>
+#include <asm/asm-offsets.h>
+#include <asm/page.h>
+#include <asm/setup.h>
+#define MMU_BASE        8               /* MMU flags base in cpu_mmu_flags */
+.text
+ENTRY(relocate_new_kernel)
+        movel %sp@(4),%a0               /* a0 = ptr */
+        movel %sp@(8),%a1               /* a1 = start */
+        movel %sp@(12),%d1              /* d1 = cpu_mmu_flags */
+        movew #PAGE_MASK,%d2            /* d2 = PAGE_MASK */
+        /* Disable MMU */
+        btst #MMU_BASE + MMUB_68851,%d1
+        jeq 3f
+1:      /* 68851 or 68030 */
+        lea %pc@(.Lcopy),%a4
+2:      addl #0x00000000,%a4            /* virt_to_phys() */
+        .section ".m68k_fixup","aw"
+        .long M68K_FIXUP_MEMOFFSET, 2b+2
+        .previous
+        .chip 68030
+        pmove %tc,%d0                   /* Disable MMU */
+        bclr #7,%d0
+        pmove %d0,%tc
+        jmp %a4@                        /* Jump to physical .Lcopy */
+        .chip 68k
+3:
+        btst #MMU_BASE + MMUB_68030,%d1
+        jne 1b
+        btst #MMU_BASE + MMUB_68040,%d1
+        jeq 6f
+4:      /* 68040 or 68060 */
+        lea %pc@(.Lcont040),%a4
+5:      addl #0x00000000,%a4            /* virt_to_phys() */
+        .section ".m68k_fixup","aw"
+        .long M68K_FIXUP_MEMOFFSET, 5b+2
+        .previous
+        movel %a4,%d0
+        andl #0xff000000,%d0
+        orw #0xe020,%d0                 /* Map 16 MiB, enable, cacheable */
+        .chip 68040
+        movec %d0,%itt0
+        movec %d0,%dtt0
+        .chip 68k
+        jmp %a4@                        /* Jump to physical .Lcont040 */
+.Lcont040:
+        moveq #0,%d0
+        .chip 68040
+        movec %d0,%tc                   /* Disable MMU */
+        movec %d0,%itt0
+        movec %d0,%itt1
+        movec %d0,%dtt0
+        movec %d0,%dtt1
+        .chip 68k
+        jra .Lcopy
+6:
+        btst #MMU_BASE + MMUB_68060,%d1
+        jne 4b
+.Lcopy:
+        movel %a0@+,%d0                 /* d0 = entry = *ptr */
+        jeq .Lflush
+        btst #2,%d0                     /* entry & IND_DONE? */
+        jne .Lflush
+        btst #1,%d0                     /* entry & IND_INDIRECTION? */
+        jeq 1f
+        andw %d2,%d0
+        movel %d0,%a0                   /* ptr = entry & PAGE_MASK */
+        jra .Lcopy
+1:
+        btst #0,%d0                     /* entry & IND_DESTINATION? */
+        jeq 2f
+        andw %d2,%d0
+        movel %d0,%a2                   /* a2 = dst = entry & PAGE_MASK */
+        jra .Lcopy
+2:
+        btst #3,%d0                     /* entry & IND_SOURCE? */
+        jeq .Lcopy
+        andw %d2,%d0
+        movel %d0,%a3                   /* a3 = src = entry & PAGE_MASK */
+        movew #PAGE_SIZE/32 - 1,%d0     /* d0 = PAGE_SIZE/32 - 1 */
+3:
+        movel %a3@+,%a2@+               /* *dst++ = *src++ */
+        movel %a3@+,%a2@+               /* *dst++ = *src++ */
+        movel %a3@+,%a2@+               /* *dst++ = *src++ */
+        movel %a3@+,%a2@+               /* *dst++ = *src++ */
+        movel %a3@+,%a2@+               /* *dst++ = *src++ */
+        movel %a3@+,%a2@+               /* *dst++ = *src++ */
+        movel %a3@+,%a2@+               /* *dst++ = *src++ */
+        movel %a3@+,%a2@+               /* *dst++ = *src++ */
+        dbf %d0, 3b
+        jra .Lcopy
+.Lflush:
+        /* Flush all caches */
+        btst #CPUB_68020,%d1
+        jeq 2f
+1:      /* 68020 or 68030 */
+        .chip 68030
+        movec %cacr,%d0
+        orw #0x808,%d0
+        movec %d0,%cacr
+        .chip 68k
+        jra .Lreincarnate
+2:
+        btst #CPUB_68030,%d1
+        jne 1b
+        btst #CPUB_68040,%d1
+        jeq 4f
+3:      /* 68040 or 68060 */
+        .chip 68040
+        nop
+        cpusha %bc
+        nop
+        cinva %bc
+        nop
+        .chip 68k
+        jra .Lreincarnate
+4:
+        btst #CPUB_68060,%d1
+        jne 3b
+.Lreincarnate:
+        jmp %a1@
+relocate_new_kernel_end:
+ENTRY(relocate_new_kernel_size)
+        .long relocate_new_kernel_end - relocate_new_kernel
diff --git a/arch/m68k/kernel/setup_mm.c b/arch/m68k/kernel/setup_mm.c
index e67e53159573..5b8ec4d5f8e8 100644
--- a/arch/m68k/kernel/setup_mm.c
+++ b/arch/m68k/kernel/setup_mm.c
@@ -26,6 +26,7 @@
 #include <linux/initrd.h>
 #include <asm/bootinfo.h>
+#include <asm/byteorder.h>
 #include <asm/sections.h>
 #include <asm/setup.h>
 #include <asm/fpu.h>
@@ -71,12 +72,12 @@ EXPORT_SYMBOL(m68k_num_memory);
 int m68k_realnum_memory;
 EXPORT_SYMBOL(m68k_realnum_memory);
 unsigned long m68k_memoffset;
-struct mem_info m68k_memory[NUM_MEMINFO];
+struct m68k_mem_info m68k_memory[NUM_MEMINFO];
 EXPORT_SYMBOL(m68k_memory);
-struct mem_info m68k_ramdisk;
+static struct m68k_mem_info m68k_ramdisk __initdata;
-static char m68k_command_line[CL_SIZE];
+static char m68k_command_line[CL_SIZE] __initdata;
 void (*mach_sched_init) (irq_handler_t handler) __initdata = NULL;
 /* machine dependent irq functions */
@@ -143,11 +144,16 @@ extern void paging_init(void);
 static void __init m68k_parse_bootinfo(const struct bi_record *record)
 {
-        while (record->tag != BI_LAST) {
+        uint16_t tag;
+        save_bootinfo(record);
+        while ((tag = be16_to_cpu(record->tag)) != BI_LAST) {
                int unknown = 0;
-                const unsigned long *data = record->data;
+                const void *data = record->data;
+                uint16_t size = be16_to_cpu(record->size);
-                switch (record->tag) {
+                switch (tag) {
                case BI_MACHTYPE:
                case BI_CPUTYPE:
                case BI_FPUTYPE:
@@ -157,20 +163,27 @@ static void __init m68k_parse_bootinfo(const struct bi_record *record)
                case BI_MEMCHUNK:
                        if (m68k_num_memory < NUM_MEMINFO) {
-                                m68k_memory[m68k_num_memory].addr = data[0];
+                                const struct mem_info *m = data;
-                                m68k_memory[m68k_num_memory].size = data[1];
+                                m68k_memory[m68k_num_memory].addr =
+                                        be32_to_cpu(m->addr);
+                                m68k_memory[m68k_num_memory].size =
+                                        be32_to_cpu(m->size);
                                m68k_num_memory++;
                        } else
-                                printk("m68k_parse_bootinfo: too many memory chunks\n");
+                                pr_warn("%s: too many memory chunks\n",
+                                        __func__);
                        break;
                case BI_RAMDISK:
-                        m68k_ramdisk.addr = data[0];
+                        {
-                        m68k_ramdisk.size = data[1];
+                                const struct mem_info *m = data;
+                                m68k_ramdisk.addr = be32_to_cpu(m->addr);
+                                m68k_ramdisk.size = be32_to_cpu(m->size);
+                        }
                        break;
                case BI_COMMAND_LINE:
-                        strlcpy(m68k_command_line, (const char *)data,
+                        strlcpy(m68k_command_line, data,
                                sizeof(m68k_command_line));
                        break;
@@ -197,17 +210,16 @@ static void __init m68k_parse_bootinfo(const struct bi_record *record)
                                unknown = 1;
                }
                if (unknown)
-                        printk("m68k_parse_bootinfo: unknown tag 0x%04x ignored\n",
+                        pr_warn("%s: unknown tag 0x%04x ignored\n", __func__,
-                               record->tag);
+                                tag);
-                record = (struct bi_record *)((unsigned long)record +
+                record = (struct bi_record *)((unsigned long)record + size);
-                                              record->size);
        }
        m68k_realnum_memory = m68k_num_memory;
 #ifdef CONFIG_SINGLE_MEMORY_CHUNK
        if (m68k_num_memory > 1) {
-                printk("Ignoring last %i chunks of physical memory\n",
+                pr_warn("%s: ignoring last %i chunks of physical memory\n",
-                       (m68k_num_memory - 1));
+                        __func__, (m68k_num_memory - 1));
                m68k_num_memory = 1;
        }
 #endif
@@ -219,7 +231,7 @@ void __init setup_arch(char **cmdline_p)
        int i;
 #endif
-        /* The bootinfo is located right after the kernel bss */
+        /* The bootinfo is located right after the kernel */
        if (!CPU_IS_COLDFIRE)
                m68k_parse_bootinfo((const struct bi_record *)_end);
@@ -247,7 +259,7 @@ void __init setup_arch(char **cmdline_p)
                asm (".chip 68060; movec %%pcr,%0; .chip 68k"
                     : "=d" (pcr));
                if (((pcr >> 8) & 0xff) <= 5) {
-                        printk("Enabling workaround for errata I14\n");
+                        pr_warn("Enabling workaround for errata I14\n");
                        asm (".chip 68060; movec %0,%%pcr; .chip 68k"
                             : : "d" (pcr | 0x20));
                }
@@ -336,12 +348,12 @@ void __init setup_arch(char **cmdline_p)
                panic("No configuration setup");
        }
+        paging_init();
 #ifdef CONFIG_NATFEAT
        nf_init();
 #endif
-        paging_init();
 #ifndef CONFIG_SUN3
        for (i = 1; i < m68k_num_memory; i++)
                free_bootmem_node(NODE_DATA(i), m68k_memory[i].addr,
@@ -353,7 +365,7 @@ void __init setup_arch(char **cmdline_p)
                                     BOOTMEM_DEFAULT);
                initrd_start = (unsigned long)phys_to_virt(m68k_ramdisk.addr);
                initrd_end = initrd_start + m68k_ramdisk.size;
-                printk("initrd: %08lx - %08lx\n", initrd_start, initrd_end);
+                pr_info("initrd: %08lx - %08lx\n", initrd_start, initrd_end);
        }
 #endif
@@ -538,9 +550,9 @@ void check_bugs(void)
 {
 #ifndef CONFIG_M68KFPU_EMU
        if (m68k_fputype == 0) {
-                printk(KERN_EMERG "*** YOU DO NOT HAVE A FLOATING POINT UNIT, "
+                pr_emerg("*** YOU DO NOT HAVE A FLOATING POINT UNIT, "
                        "WHICH IS REQUIRED BY LINUX/M68K ***\n");
-                printk(KERN_EMERG "Upgrade your hardware or join the FPU "
+                pr_emerg("Upgrade your hardware or join the FPU "
                        "emulation project\n");
                panic("no FPU");
        }
diff --git a/arch/m68k/kernel/time.c b/arch/m68k/kernel/time.c
index 7eb9792009f8..958f1adb9d0c 100644
--- a/arch/m68k/kernel/time.c
+++ b/arch/m68k/kernel/time.c
@@ -28,6 +28,10 @@
 #include <linux/timex.h>
 #include <linux/profile.h>
+unsigned long (*mach_random_get_entropy)(void);
 /*
 * timer_interrupt() needs to keep up the real-time clock,
 * as well as call the "xtime_update()" routine every clocktick
diff --git a/arch/m68k/kernel/traps.c b/arch/m68k/kernel/traps.c
index 88fcd8c70e7b..6c9ca24830e9 100644
--- a/arch/m68k/kernel/traps.c
+++ b/arch/m68k/kernel/traps.c
@@ -133,9 +133,7 @@ static inline void access_error060 (struct frame *fp)
 {
        unsigned long fslw = fp->un.fmt4.pc; /* is really FSLW for access error */
-#ifdef DEBUG
+        pr_debug("fslw=%#lx, fa=%#lx\n", fslw, fp->un.fmt4.effaddr);
-        printk("fslw=%#lx, fa=%#lx\n", fslw, fp->un.fmt4.effaddr);
-#endif
        if (fslw & MMU060_BPE) {
                /* branch prediction error -> clear branch cache */
@@ -162,9 +160,7 @@ static inline void access_error060 (struct frame *fp)
                }
                if (fslw & MMU060_W)
                        errorcode |= 2;
-#ifdef DEBUG
+                pr_debug("errorcode = %ld\n", errorcode);
-                printk("errorcode = %d\n", errorcode );
-#endif
                do_page_fault(&fp->ptregs, addr, errorcode);
        } else if (fslw & (MMU060_SEE)){
                /* Software Emulation Error.
@@ -173,8 +169,9 @@ static inline void access_error060 (struct frame *fp)
                send_fault_sig(&fp->ptregs);
        } else if (!(fslw & (MMU060_RE|MMU060_WE)) ||
                   send_fault_sig(&fp->ptregs) > 0) {
-                printk("pc=%#lx, fa=%#lx\n", fp->ptregs.pc, fp->un.fmt4.effaddr);
+                pr_err("pc=%#lx, fa=%#lx\n", fp->ptregs.pc,
-                printk( "68060 access error, fslw=%lx\n", fslw );
+                       fp->un.fmt4.effaddr);
+                pr_err("68060 access error, fslw=%lx\n", fslw);
                trap_c( fp );
        }
 }
@@ -225,9 +222,7 @@ static inline int do_040writeback1(unsigned short wbs, unsigned long wba,
        set_fs(old_fs);
-#ifdef DEBUG
+        pr_debug("do_040writeback1, res=%d\n", res);
-        printk("do_040writeback1, res=%d\n",res);
-#endif
        return res;
 }
@@ -249,7 +244,7 @@ static inline void do_040writebacks(struct frame *fp)
        int res = 0;
 #if 0
        if (fp->un.fmt7.wb1s & WBV_040)
-                printk("access_error040: cannot handle 1st writeback. oops.\n");
+                pr_err("access_error040: cannot handle 1st writeback. oops.\n");
 #endif
        if ((fp->un.fmt7.wb2s & WBV_040) &&
@@ -302,14 +297,12 @@ static inline void access_error040(struct frame *fp)
        unsigned short ssw = fp->un.fmt7.ssw;
        unsigned long mmusr;
-#ifdef DEBUG
+        pr_debug("ssw=%#x, fa=%#lx\n", ssw, fp->un.fmt7.faddr);
-        printk("ssw=%#x, fa=%#lx\n", ssw, fp->un.fmt7.faddr);
+        pr_debug("wb1s=%#x, wb2s=%#x, wb3s=%#x\n", fp->un.fmt7.wb1s,
-        printk("wb1s=%#x, wb2s=%#x, wb3s=%#x\n", fp->un.fmt7.wb1s,
                fp->un.fmt7.wb2s, fp->un.fmt7.wb3s);
-        printk ("wb2a=%lx, wb3a=%lx, wb2d=%lx, wb3d=%lx\n",
+        pr_debug("wb2a=%lx, wb3a=%lx, wb2d=%lx, wb3d=%lx\n",
                fp->un.fmt7.wb2a, fp->un.fmt7.wb3a,
                fp->un.fmt7.wb2d, fp->un.fmt7.wb3d);
-#endif
        if (ssw & ATC_040) {
                unsigned long addr = fp->un.fmt7.faddr;
@@ -324,9 +317,7 @@ static inline void access_error040(struct frame *fp)
                /* MMU error, get the MMUSR info for this access */
                mmusr = probe040(!(ssw & RW_040), addr, ssw);
-#ifdef DEBUG
+                pr_debug("mmusr = %lx\n", mmusr);
-                printk("mmusr = %lx\n", mmusr);
-#endif
                errorcode = 1;
                if (!(mmusr & MMU_R_040)) {
                        /* clear the invalid atc entry */
@@ -340,14 +331,10 @@ static inline void access_error040(struct frame *fp)
                        errorcode |= 2;
                if (do_page_fault(&fp->ptregs, addr, errorcode)) {
-#ifdef DEBUG
+                        pr_debug("do_page_fault() !=0\n");
-                        printk("do_page_fault() !=0\n");
-#endif
                        if (user_mode(&fp->ptregs)){
                                /* delay writebacks after signal delivery */
-#ifdef DEBUG
+                                pr_debug(".. was usermode - return\n");
-                                printk(".. was usermode - return\n");
-#endif
                                return;
                        }
                        /* disable writeback into user space from kernel
@@ -355,9 +342,7 @@ static inline void access_error040(struct frame *fp)
                         * the writeback won't do good)
                         */
 disable_wb:
-#ifdef DEBUG
+                        pr_debug(".. disabling wb2\n");
-                        printk(".. disabling wb2\n");
-#endif
                        if (fp->un.fmt7.wb2a == fp->un.fmt7.faddr)
                                fp->un.fmt7.wb2s &= ~WBV_040;
                        if (fp->un.fmt7.wb3a == fp->un.fmt7.faddr)
@@ -371,7 +356,7 @@ disable_wb:
                current->thread.signo = SIGBUS;
                current->thread.faddr = fp->un.fmt7.faddr;
                if (send_fault_sig(&fp->ptregs) >= 0)
-                        printk("68040 bus error (ssw=%x, faddr=%lx)\n", ssw,
+                        pr_err("68040 bus error (ssw=%x, faddr=%lx)\n", ssw,
                               fp->un.fmt7.faddr);
                goto disable_wb;
        }
@@ -394,19 +379,17 @@ static inline void bus_error030 (struct frame *fp)
        unsigned short ssw = fp->un.fmtb.ssw;
        extern unsigned long _sun3_map_test_start, _sun3_map_test_end;
-#ifdef DEBUG
        if (ssw & (FC | FB))
-                printk ("Instruction fault at %#010lx\n",
+                pr_debug("Instruction fault at %#010lx\n",
                        ssw & FC ?
                        fp->ptregs.format == 0xa ? fp->ptregs.pc + 2 : fp->un.fmtb.baddr - 2
                        :
                        fp->ptregs.format == 0xa ? fp->ptregs.pc + 4 : fp->un.fmtb.baddr);
        if (ssw & DF)
-                printk ("Data %s fault at %#010lx in %s (pc=%#lx)\n",
+                pr_debug("Data %s fault at %#010lx in %s (pc=%#lx)\n",
                        ssw & RW ? "read" : "write",
                        fp->un.fmtb.daddr,
                        space_names[ssw & DFC], fp->ptregs.pc);
-#endif
        /*
         * Check if this page should be demand-mapped. This needs to go before
@@ -429,7 +412,7 @@ static inline void bus_error030 (struct frame *fp)
                          return;
                        /* instruction fault or kernel data fault! */
                        if (ssw & (FC | FB))
-                                printk ("Instruction fault at %#010lx\n",
+                                pr_err("Instruction fault at %#010lx\n",
                                        fp->ptregs.pc);
                        if (ssw & DF) {
                                /* was this fault incurred testing bus mappings? */
@@ -439,12 +422,12 @@ static inline void bus_error030 (struct frame *fp)
                                        return;
                                }
-                                printk ("Data %s fault at %#010lx in %s (pc=%#lx)\n",
+                                pr_err("Data %s fault at %#010lx in %s (pc=%#lx)\n",
                                        ssw & RW ? "read" : "write",
                                        fp->un.fmtb.daddr,
                                        space_names[ssw & DFC], fp->ptregs.pc);
                        }
-                        printk ("BAD KERNEL BUSERR\n");
+                        pr_err("BAD KERNEL BUSERR\n");
                        die_if_kernel("Oops", &fp->ptregs,0);
                        force_sig(SIGKILL, current);
@@ -473,12 +456,11 @@ static inline void bus_error030 (struct frame *fp)
                else if (buserr_type & SUN3_BUSERR_INVALID)
                        errorcode = 0x00;
                else {
-#ifdef DEBUG
+                        pr_debug("*** unexpected busfault type=%#04x\n",
-                        printk ("*** unexpected busfault type=%#04x\n", buserr_type);
+                                 buserr_type);
-                        printk ("invalid %s access at %#lx from pc %#lx\n",
+                        pr_debug("invalid %s access at %#lx from pc %#lx\n",
-                                !(ssw & RW) ? "write" : "read", addr,
+                                 !(ssw & RW) ? "write" : "read", addr,
-                                fp->ptregs.pc);
+                                 fp->ptregs.pc);
-#endif
                        die_if_kernel ("Oops", &fp->ptregs, buserr_type);
                        force_sig (SIGBUS, current);
                        return;
@@ -509,9 +491,7 @@ static inline void bus_error030 (struct frame *fp)
                if (!mmu_emu_handle_fault(addr, 1, 0))
                        do_page_fault (&fp->ptregs, addr, 0);
       } else {
-#ifdef DEBUG
+                pr_debug("protection fault on insn access (segv).\n");
-                printk ("protection fault on insn access (segv).\n");
-#endif
                force_sig (SIGSEGV, current);
       }
 }
@@ -525,22 +505,22 @@ static inline void bus_error030 (struct frame *fp)
        unsigned short ssw = fp->un.fmtb.ssw;
 #ifdef DEBUG
        unsigned long desc;
+#endif
-        printk ("pid = %x  ", current->pid);
+        pr_debug("pid = %x  ", current->pid);
-        printk ("SSW=%#06x  ", ssw);
+        pr_debug("SSW=%#06x  ", ssw);
        if (ssw & (FC | FB))
-                printk ("Instruction fault at %#010lx\n",
+                pr_debug("Instruction fault at %#010lx\n",
                        ssw & FC ?
                        fp->ptregs.format == 0xa ? fp->ptregs.pc + 2 : fp->un.fmtb.baddr - 2
                        :
                        fp->ptregs.format == 0xa ? fp->ptregs.pc + 4 : fp->un.fmtb.baddr);
        if (ssw & DF)
-                printk ("Data %s fault at %#010lx in %s (pc=%#lx)\n",
+                pr_debug("Data %s fault at %#010lx in %s (pc=%#lx)\n",
                        ssw & RW ? "read" : "write",
                        fp->un.fmtb.daddr,
                        space_names[ssw & DFC], fp->ptregs.pc);
-#endif
        /* ++andreas: If a data fault and an instruction fault happen
           at the same time map in both pages.  */
@@ -554,27 +534,23 @@ static inline void bus_error030 (struct frame *fp)
                              "pmove %%psr,%1"
                              : "=a&" (desc), "=m" (temp)
                              : "a" (addr), "d" (ssw));
+                pr_debug("mmusr is %#x for addr %#lx in task %p\n",
+                         temp, addr, current);
+                pr_debug("descriptor address is 0x%p, contents %#lx\n",
+                         __va(desc), *(unsigned long *)__va(desc));
 #else
                asm volatile ("ptestr %2,%1@,#7\n\t"
                              "pmove %%psr,%0"
                              : "=m" (temp) : "a" (addr), "d" (ssw));
 #endif
                mmusr = temp;
-#ifdef DEBUG
-                printk("mmusr is %#x for addr %#lx in task %p\n",
-                       mmusr, addr, current);
-                printk("descriptor address is %#lx, contents %#lx\n",
-                       __va(desc), *(unsigned long *)__va(desc));
-#endif
                errorcode = (mmusr & MMU_I) ? 0 : 1;
                if (!(ssw & RW) || (ssw & RM))
                        errorcode |= 2;
                if (mmusr & (MMU_I | MMU_WP)) {
                        if (ssw & 4) {
-                                printk("Data %s fault at %#010lx in %s (pc=%#lx)\n",
+                                pr_err("Data %s fault at %#010lx in %s (pc=%#lx)\n",
                                       ssw & RW ? "read" : "write",
                                       fp->un.fmtb.daddr,
                                       space_names[ssw & DFC], fp->ptregs.pc);
@@ -587,9 +563,10 @@ static inline void bus_error030 (struct frame *fp)
                } else if (!(mmusr & MMU_I)) {
                        /* probably a 020 cas fault */
                        if (!(ssw & RM) && send_fault_sig(&fp->ptregs) > 0)
-                                printk("unexpected bus error (%#x,%#x)\n", ssw, mmusr);
+                                pr_err("unexpected bus error (%#x,%#x)\n", ssw,
+                                       mmusr);
                } else if (mmusr & (MMU_B|MMU_L|MMU_S)) {
-                        printk("invalid %s access at %#lx from pc %#lx\n",
+                        pr_err("invalid %s access at %#lx from pc %#lx\n",
                               !(ssw & RW) ? "write" : "read", addr,
                               fp->ptregs.pc);
                        die_if_kernel("Oops",&fp->ptregs,mmusr);
@@ -600,7 +577,7 @@ static inline void bus_error030 (struct frame *fp)
                        static volatile long tlong;
 #endif
-                        printk("weird %s access at %#lx from pc %#lx (ssw is %#x)\n",
+                        pr_err("weird %s access at %#lx from pc %#lx (ssw is %#x)\n",
                               !(ssw & RW) ? "write" : "read", addr,
                               fp->ptregs.pc, ssw);
                        asm volatile ("ptestr #1,%1@,#0\n\t"
@@ -609,18 +586,16 @@ static inline void bus_error030 (struct frame *fp)
                                      : "a" (addr));
                        mmusr = temp;
-                        printk ("level 0 mmusr is %#x\n", mmusr);
+                        pr_err("level 0 mmusr is %#x\n", mmusr);
 #if 0
                        asm volatile ("pmove %%tt0,%0"
                                      : "=m" (tlong));
-                        printk("tt0 is %#lx, ", tlong);
+                        pr_debug("tt0 is %#lx, ", tlong);
                        asm volatile ("pmove %%tt1,%0"
                                      : "=m" (tlong));
-                        printk("tt1 is %#lx\n", tlong);
+                        pr_debug("tt1 is %#lx\n", tlong);
-#endif
-#ifdef DEBUG
-                        printk("Unknown SIGSEGV - 1\n");
 #endif
+                        pr_debug("Unknown SIGSEGV - 1\n");
                        die_if_kernel("Oops",&fp->ptregs,mmusr);
                        force_sig(SIGSEGV, current);
                        return;
@@ -641,10 +616,9 @@ static inline void bus_error030 (struct frame *fp)
                return;
        if (fp->ptregs.sr & PS_S) {
-                printk("Instruction fault at %#010lx\n",
+                pr_err("Instruction fault at %#010lx\n", fp->ptregs.pc);
-                        fp->ptregs.pc);
        buserr:
-                printk ("BAD KERNEL BUSERR\n");
+                pr_err("BAD KERNEL BUSERR\n");
                die_if_kernel("Oops",&fp->ptregs,0);
                force_sig(SIGKILL, current);
                return;
@@ -668,28 +642,22 @@ static inline void bus_error030 (struct frame *fp)
                      "pmove %%psr,%1"
                      : "=a&" (desc), "=m" (temp)
                      : "a" (addr));
+        pr_debug("mmusr is %#x for addr %#lx in task %p\n",
+                temp, addr, current);
+        pr_debug("descriptor address is 0x%p, contents %#lx\n",
+                __va(desc), *(unsigned long *)__va(desc));
 #else
        asm volatile ("ptestr #1,%1@,#7\n\t"
                      "pmove %%psr,%0"
                      : "=m" (temp) : "a" (addr));
 #endif
        mmusr = temp;
-#ifdef DEBUG
-        printk ("mmusr is %#x for addr %#lx in task %p\n",
-                mmusr, addr, current);
-        printk ("descriptor address is %#lx, contents %#lx\n",
-                __va(desc), *(unsigned long *)__va(desc));
-#endif
        if (mmusr & MMU_I)
                do_page_fault (&fp->ptregs, addr, 0);
        else if (mmusr & (MMU_B|MMU_L|MMU_S)) {
-                printk ("invalid insn access at %#lx from pc %#lx\n",
+                pr_err("invalid insn access at %#lx from pc %#lx\n",
                        addr, fp->ptregs.pc);
-#ifdef DEBUG
+                pr_debug("Unknown SIGSEGV - 2\n");
-                printk("Unknown SIGSEGV - 2\n");
-#endif
                die_if_kernel("Oops",&fp->ptregs,mmusr);
                force_sig(SIGSEGV, current);
                return;
@@ -791,9 +759,7 @@ asmlinkage void buserr_c(struct frame *fp)
        if (user_mode(&fp->ptregs))
                current->thread.esp0 = (unsigned long) fp;
-#ifdef DEBUG
+        pr_debug("*** Bus Error *** Format is %x\n", fp->ptregs.format);
-        printk ("*** Bus Error *** Format is %x\n", fp->ptregs.format);
-#endif
 #if defined(CONFIG_COLDFIRE) && defined(CONFIG_MMU)
        if (CPU_IS_COLDFIRE) {
@@ -836,9 +802,7 @@ asmlinkage void buserr_c(struct frame *fp)
 #endif
        default:
          die_if_kernel("bad frame format",&fp->ptregs,0);
-#ifdef DEBUG
+          pr_debug("Unknown SIGSEGV - 4\n");
-          printk("Unknown SIGSEGV - 4\n");
-#endif
          force_sig(SIGSEGV, current);
        }
 }
@@ -852,7 +816,7 @@ void show_trace(unsigned long *stack)
        unsigned long addr;
        int i;
-        printk("Call Trace:");
+        pr_info("Call Trace:");
        addr = (unsigned long)stack + THREAD_SIZE - 1;
        endstack = (unsigned long *)(addr & -THREAD_SIZE);
        i = 0;
@@ -869,13 +833,13 @@ void show_trace(unsigned long *stack)
                if (__kernel_text_address(addr)) {
 #ifndef CONFIG_KALLSYMS
                        if (i % 5 == 0)
-                                printk("\n       ");
+                                pr_cont("\n       ");
 #endif
-                        printk(" [<%08lx>] %pS\n", addr, (void *)addr);
+                        pr_cont(" [<%08lx>] %pS\n", addr, (void *)addr);
                        i++;
                }
        }
-        printk("\n");
+        pr_cont("\n");
 }
 void show_registers(struct pt_regs *regs)
@@ -887,81 +851,87 @@ void show_registers(struct pt_regs *regs)
        int i;
        print_modules();
-        printk("PC: [<%08lx>] %pS\n", regs->pc, (void *)regs->pc);
+        pr_info("PC: [<%08lx>] %pS\n", regs->pc, (void *)regs->pc);
-        printk("SR: %04x  SP: %p  a2: %08lx\n", regs->sr, regs, regs->a2);
+        pr_info("SR: %04x  SP: %p  a2: %08lx\n", regs->sr, regs, regs->a2);
-        printk("d0: %08lx    d1: %08lx    d2: %08lx    d3: %08lx\n",
+        pr_info("d0: %08lx    d1: %08lx    d2: %08lx    d3: %08lx\n",
               regs->d0, regs->d1, regs->d2, regs->d3);
-        printk("d4: %08lx    d5: %08lx    a0: %08lx    a1: %08lx\n",
+        pr_info("d4: %08lx    d5: %08lx    a0: %08lx    a1: %08lx\n",
               regs->d4, regs->d5, regs->a0, regs->a1);
-        printk("Process %s (pid: %d, task=%p)\n",
+        pr_info("Process %s (pid: %d, task=%p)\n",
                current->comm, task_pid_nr(current), current);
        addr = (unsigned long)&fp->un;
-        printk("Frame format=%X ", regs->format);
+        pr_info("Frame format=%X ", regs->format);
        switch (regs->format) {
        case 0x2:
-                printk("instr addr=%08lx\n", fp->un.fmt2.iaddr);
+                pr_cont("instr addr=%08lx\n", fp->un.fmt2.iaddr);
                addr += sizeof(fp->un.fmt2);
                break;
        case 0x3:
-                printk("eff addr=%08lx\n", fp->un.fmt3.effaddr);
+                pr_cont("eff addr=%08lx\n", fp->un.fmt3.effaddr);
                addr += sizeof(fp->un.fmt3);
                break;
        case 0x4:
-                printk((CPU_IS_060 ? "fault addr=%08lx fslw=%08lx\n"
+                if (CPU_IS_060)
-                        : "eff addr=%08lx pc=%08lx\n"),
+                        pr_cont("fault addr=%08lx fslw=%08lx\n",
-                        fp->un.fmt4.effaddr, fp->un.fmt4.pc);
+                                fp->un.fmt4.effaddr, fp->un.fmt4.pc);
+                else
+                        pr_cont("eff addr=%08lx pc=%08lx\n",
+                                fp->un.fmt4.effaddr, fp->un.fmt4.pc);
                addr += sizeof(fp->un.fmt4);
                break;
        case 0x7:
-                printk("eff addr=%08lx ssw=%04x faddr=%08lx\n",
+                pr_cont("eff addr=%08lx ssw=%04x faddr=%08lx\n",
                        fp->un.fmt7.effaddr, fp->un.fmt7.ssw, fp->un.fmt7.faddr);
-                printk("wb 1 stat/addr/data: %04x %08lx %08lx\n",
+                pr_info("wb 1 stat/addr/data: %04x %08lx %08lx\n",
                        fp->un.fmt7.wb1s, fp->un.fmt7.wb1a, fp->un.fmt7.wb1dpd0);
-                printk("wb 2 stat/addr/data: %04x %08lx %08lx\n",
+                pr_info("wb 2 stat/addr/data: %04x %08lx %08lx\n",
                        fp->un.fmt7.wb2s, fp->un.fmt7.wb2a, fp->un.fmt7.wb2d);
-                printk("wb 3 stat/addr/data: %04x %08lx %08lx\n",
+                pr_info("wb 3 stat/addr/data: %04x %08lx %08lx\n",
                        fp->un.fmt7.wb3s, fp->un.fmt7.wb3a, fp->un.fmt7.wb3d);
-                printk("push data: %08lx %08lx %08lx %08lx\n",
+                pr_info("push data: %08lx %08lx %08lx %08lx\n",
                        fp->un.fmt7.wb1dpd0, fp->un.fmt7.pd1, fp->un.fmt7.pd2,
                        fp->un.fmt7.pd3);
                addr += sizeof(fp->un.fmt7);
                break;
        case 0x9:
-                printk("instr addr=%08lx\n", fp->un.fmt9.iaddr);
+                pr_cont("instr addr=%08lx\n", fp->un.fmt9.iaddr);
                addr += sizeof(fp->un.fmt9);
                break;
        case 0xa:
-                printk("ssw=%04x isc=%04x isb=%04x daddr=%08lx dobuf=%08lx\n",
+                pr_cont("ssw=%04x isc=%04x isb=%04x daddr=%08lx dobuf=%08lx\n",
                        fp->un.fmta.ssw, fp->un.fmta.isc, fp->un.fmta.isb,
                        fp->un.fmta.daddr, fp->un.fmta.dobuf);
                addr += sizeof(fp->un.fmta);
                break;
        case 0xb:
-                printk("ssw=%04x isc=%04x isb=%04x daddr=%08lx dobuf=%08lx\n",
+                pr_cont("ssw=%04x isc=%04x isb=%04x daddr=%08lx dobuf=%08lx\n",
                        fp->un.fmtb.ssw, fp->un.fmtb.isc, fp->un.fmtb.isb,
                        fp->un.fmtb.daddr, fp->un.fmtb.dobuf);
-                printk("baddr=%08lx dibuf=%08lx ver=%x\n",
+                pr_info("baddr=%08lx dibuf=%08lx ver=%x\n",
                        fp->un.fmtb.baddr, fp->un.fmtb.dibuf, fp->un.fmtb.ver);
                addr += sizeof(fp->un.fmtb);
                break;
        default:
-                printk("\n");
+                pr_cont("\n");
        }
        show_stack(NULL, (unsigned long *)addr);
-        printk("Code:");
+        pr_info("Code:");
        set_fs(KERNEL_DS);
        cp = (u16 *)regs->pc;
        for (i = -8; i < 16; i++) {
                if (get_user(c, cp + i) && i >= 0) {
-                        printk(" Bad PC value.");
+                        pr_cont(" Bad PC value.");
                        break;
                }
-                printk(i ? " %04x" : " <%04x>", c);
+                if (i)
+                        pr_cont(" %04x", c);
+                else
+                        pr_cont(" <%04x>", c);
        }
        set_fs(old_fs);
-        printk ("\n");
+        pr_cont("\n");
 }
 void show_stack(struct task_struct *task, unsigned long *stack)
@@ -978,16 +948,16 @@ void show_stack(struct task_struct *task, unsigned long *stack)
        }
        endstack = (unsigned long *)(((unsigned long)stack + THREAD_SIZE - 1) & -THREAD_SIZE);
-        printk("Stack from %08lx:", (unsigned long)stack);
+        pr_info("Stack from %08lx:", (unsigned long)stack);
        p = stack;
        for (i = 0; i < kstack_depth_to_print; i++) {
                if (p + 1 > endstack)
                        break;
                if (i % 8 == 0)
-                        printk("\n       ");
+                        pr_cont("\n       ");
-                printk(" %08lx", *p++);
+                pr_cont(" %08lx", *p++);
        }
-        printk("\n");
+        pr_cont("\n");
        show_trace(stack);
 }
@@ -1005,32 +975,32 @@ void bad_super_trap (struct frame *fp)
        console_verbose();
        if (vector < ARRAY_SIZE(vec_names))
-                printk ("*** %s ***   FORMAT=%X\n",
+                pr_err("*** %s ***   FORMAT=%X\n",
                        vec_names[vector],
                        fp->ptregs.format);
        else
-                printk ("*** Exception %d ***   FORMAT=%X\n",
+                pr_err("*** Exception %d ***   FORMAT=%X\n",
                        vector, fp->ptregs.format);
        if (vector == VEC_ADDRERR && CPU_IS_020_OR_030) {
                unsigned short ssw = fp->un.fmtb.ssw;
-                printk ("SSW=%#06x  ", ssw);
+                pr_err("SSW=%#06x  ", ssw);
                if (ssw & RC)
-                        printk ("Pipe stage C instruction fault at %#010lx\n",
+                        pr_err("Pipe stage C instruction fault at %#010lx\n",
                                (fp->ptregs.format) == 0xA ?
                                fp->ptregs.pc + 2 : fp->un.fmtb.baddr - 2);
                if (ssw & RB)
-                        printk ("Pipe stage B instruction fault at %#010lx\n",
+                        pr_err("Pipe stage B instruction fault at %#010lx\n",
                                (fp->ptregs.format) == 0xA ?
                                fp->ptregs.pc + 4 : fp->un.fmtb.baddr);
                if (ssw & DF)
-                        printk ("Data %s fault at %#010lx in %s (pc=%#lx)\n",
+                        pr_err("Data %s fault at %#010lx in %s (pc=%#lx)\n",
                                ssw & RW ? "read" : "write",
                                fp->un.fmtb.daddr, space_names[ssw & DFC],
                                fp->ptregs.pc);
        }
-        printk ("Current process id is %d\n", task_pid_nr(current));
+        pr_err("Current process id is %d\n", task_pid_nr(current));
        die_if_kernel("BAD KERNEL TRAP", &fp->ptregs, 0);
 }
@@ -1162,7 +1132,7 @@ void die_if_kernel (char *str, struct pt_regs *fp, int nr)
                return;
        console_verbose();
-        printk("%s: %08x\n",str,nr);
+        pr_crit("%s: %08x\n", str, nr);
        show_registers(fp);
        add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE);
        do_exit(SIGSEGV);
diff --git a/arch/m68k/mac/config.c b/arch/m68k/mac/config.c
index afb95d5fb26b..982c3fe73c4a 100644
--- a/arch/m68k/mac/config.c
+++ b/arch/m68k/mac/config.c
@@ -26,9 +26,10 @@
 #include <linux/adb.h>
 #include <linux/cuda.h>
-#define BOOTINFO_COMPAT_1_0
 #include <asm/setup.h>
 #include <asm/bootinfo.h>
+#include <asm/bootinfo-mac.h>
+#include <asm/byteorder.h>
 #include <asm/io.h>
 #include <asm/irq.h>
@@ -107,45 +108,46 @@ static void __init mac_sched_init(irq_handler_t vector)
 int __init mac_parse_bootinfo(const struct bi_record *record)
 {
        int unknown = 0;
-        const u_long *data = record->data;
+        const void *data = record->data;
-        switch (record->tag) {
+        switch (be16_to_cpu(record->tag)) {
        case BI_MAC_MODEL:
-                mac_bi_data.id = *data;
+                mac_bi_data.id = be32_to_cpup(data);
                break;
        case BI_MAC_VADDR:
-                mac_bi_data.videoaddr = *data;
+                mac_bi_data.videoaddr = be32_to_cpup(data);
                break;
        case BI_MAC_VDEPTH:
-                mac_bi_data.videodepth = *data;
+                mac_bi_data.videodepth = be32_to_cpup(data);
                break;
        case BI_MAC_VROW:
-                mac_bi_data.videorow = *data;
+                mac_bi_data.videorow = be32_to_cpup(data);
                break;
        case BI_MAC_VDIM:
-                mac_bi_data.dimensions = *data;
+                mac_bi_data.dimensions = be32_to_cpup(data);
                break;
        case BI_MAC_VLOGICAL:
-                mac_bi_data.videological = VIDEOMEMBASE + (*data & ~VIDEOMEMMASK);
+                mac_orig_videoaddr = be32_to_cpup(data);
-                mac_orig_videoaddr = *data;
+                mac_bi_data.videological =
+                        VIDEOMEMBASE + (mac_orig_videoaddr & ~VIDEOMEMMASK);
                break;
        case BI_MAC_SCCBASE:
-                mac_bi_data.sccbase = *data;
+                mac_bi_data.sccbase = be32_to_cpup(data);
                break;
        case BI_MAC_BTIME:
-                mac_bi_data.boottime = *data;
+                mac_bi_data.boottime = be32_to_cpup(data);
                break;
        case BI_MAC_GMTBIAS:
-                mac_bi_data.gmtbias = *data;
+                mac_bi_data.gmtbias = be32_to_cpup(data);
                break;
        case BI_MAC_MEMSIZE:
-                mac_bi_data.memsize = *data;
+                mac_bi_data.memsize = be32_to_cpup(data);
                break;
        case BI_MAC_CPUID:
-                mac_bi_data.cpuid = *data;
+                mac_bi_data.cpuid = be32_to_cpup(data);
                break;
        case BI_MAC_ROMBASE:
-                mac_bi_data.rombase = *data;
+                mac_bi_data.rombase = be32_to_cpup(data);
                break;
        default:
                unknown = 1;
diff --git a/arch/m68k/mac/iop.c b/arch/m68k/mac/iop.c
index 7d8d46127ad9..4d2adfb32a2a 100644
--- a/arch/m68k/mac/iop.c
+++ b/arch/m68k/mac/iop.c
@@ -111,16 +111,15 @@
 #include <linux/init.h>
 #include <linux/interrupt.h>
-#include <asm/bootinfo.h>
 #include <asm/macintosh.h>
 #include <asm/macints.h>
 #include <asm/mac_iop.h>
 /*#define DEBUG_IOP*/
-/* Set to non-zero if the IOPs are present. Set by iop_init() */
+/* Non-zero if the IOPs are present */
-int iop_scc_present,iop_ism_present;
+int iop_scc_present, iop_ism_present;
 /* structure for tracking channel listeners */
diff --git a/arch/m68k/mac/misc.c b/arch/m68k/mac/misc.c
index 5e085554ac7f..707b61aea203 100644
--- a/arch/m68k/mac/misc.c
+++ b/arch/m68k/mac/misc.c
@@ -25,8 +25,6 @@
 #include <asm/mac_via.h>
 #include <asm/mac_oss.h>
-#define BOOTINFO_COMPAT_1_0
-#include <asm/bootinfo.h>
 #include <asm/machdep.h>
 /* Offset between Unix time (1970-based) and Mac time (1904-based) */
diff --git a/arch/m68k/mac/oss.c b/arch/m68k/mac/oss.c
index 6c4c882c126e..54037125ebf8 100644
--- a/arch/m68k/mac/oss.c
+++ b/arch/m68k/mac/oss.c
@@ -21,7 +21,6 @@
 #include <linux/init.h>
 #include <linux/irq.h>
-#include <asm/bootinfo.h>
 #include <asm/macintosh.h>
 #include <asm/macints.h>
 #include <asm/mac_via.h>
diff --git a/arch/m68k/mac/psc.c b/arch/m68k/mac/psc.c
index 6f026fc302fa..835fa04511c8 100644
--- a/arch/m68k/mac/psc.c
+++ b/arch/m68k/mac/psc.c
@@ -21,7 +21,6 @@
 #include <linux/irq.h>
 #include <asm/traps.h>
-#include <asm/bootinfo.h>
 #include <asm/macintosh.h>
 #include <asm/macints.h>
 #include <asm/mac_psc.h>
@@ -54,7 +53,7 @@ static void psc_debug_dump(void)
 * expanded to cover what I think are the other 7 channels.
 */
-static void psc_dma_die_die_die(void)
+static __init void psc_dma_die_die_die(void)
 {
        int i;
diff --git a/arch/m68k/mac/via.c b/arch/m68k/mac/via.c
index 5d1458bb871b..e198dec868e4 100644
--- a/arch/m68k/mac/via.c
+++ b/arch/m68k/mac/via.c
@@ -30,7 +30,6 @@
 #include <linux/module.h>
 #include <linux/irq.h>
-#include <asm/bootinfo.h>
 #include <asm/macintosh.h>
 #include <asm/macints.h>
 #include <asm/mac_via.h>
diff --git a/arch/m68k/mm/fault.c b/arch/m68k/mm/fault.c
index eb1d61f68725..2bd7487440c4 100644
--- a/arch/m68k/mm/fault.c
+++ b/arch/m68k/mm/fault.c
@@ -25,9 +25,8 @@ int send_fault_sig(struct pt_regs *regs)
        siginfo.si_signo = current->thread.signo;
        siginfo.si_code = current->thread.code;
        siginfo.si_addr = (void *)current->thread.faddr;
-#ifdef DEBUG
+        pr_debug("send_fault_sig: %p,%d,%d\n", siginfo.si_addr,
-        printk("send_fault_sig: %p,%d,%d\n", siginfo.si_addr, siginfo.si_signo, siginfo.si_code);
+                 siginfo.si_signo, siginfo.si_code);
-#endif
        if (user_mode(regs)) {
                force_sig_info(siginfo.si_signo,
@@ -45,10 +44,10 @@ int send_fault_sig(struct pt_regs *regs)
                 * terminate things with extreme prejudice.
                 */
                if ((unsigned long)siginfo.si_addr < PAGE_SIZE)
-                        printk(KERN_ALERT "Unable to handle kernel NULL pointer dereference");
+                        pr_alert("Unable to handle kernel NULL pointer dereference");
                else
-                        printk(KERN_ALERT "Unable to handle kernel access");
+                        pr_alert("Unable to handle kernel access");
-                printk(" at virtual address %p\n", siginfo.si_addr);
+                pr_cont(" at virtual address %p\n", siginfo.si_addr);
                die_if_kernel("Oops", regs, 0 /*error_code*/);
                do_exit(SIGKILL);
        }
@@ -75,11 +74,8 @@ int do_page_fault(struct pt_regs *regs, unsigned long address,
        int fault;
        unsigned int flags = FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
-#ifdef DEBUG
+        pr_debug("do page fault:\nregs->sr=%#x, regs->pc=%#lx, address=%#lx, %ld, %p\n",
-        printk ("do page fault:\nregs->sr=%#x, regs->pc=%#lx, address=%#lx, %ld, %p\n",
+                regs->sr, regs->pc, address, error_code, mm ? mm->pgd : NULL);
-                regs->sr, regs->pc, address, error_code,
-                current->mm->pgd);
-#endif
        /*
         * If we're in an interrupt or have no user
@@ -118,9 +114,7 @@ retry:
 * we can handle it..
 */
 good_area:
-#ifdef DEBUG
+        pr_debug("do_page_fault: good_area\n");
-        printk("do_page_fault: good_area\n");
-#endif
        switch (error_code & 3) {
                default:        /* 3: write, present */
                        /* fall through */
@@ -143,9 +137,7 @@ good_area:
         */
        fault = handle_mm_fault(mm, vma, address, flags);
-#ifdef DEBUG
+        pr_debug("handle_mm_fault returns %d\n", fault);
-        printk("handle_mm_fault returns %d\n",fault);
-#endif
        if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current))
                return 0;
diff --git a/arch/m68k/mm/init.c b/arch/m68k/mm/init.c
index 6b4baa6e4d31..acaff6a49e35 100644
--- a/arch/m68k/mm/init.c
+++ b/arch/m68k/mm/init.c
@@ -59,7 +59,7 @@ EXPORT_SYMBOL(pg_data_table);
 void __init m68k_setup_node(int node)
 {
 #ifndef CONFIG_SINGLE_MEMORY_CHUNK
-        struct mem_info *info = m68k_memory + node;
+        struct m68k_mem_info *info = m68k_memory + node;
        int i, end;
        i = (unsigned long)phys_to_virt(info->addr) >> __virt_to_node_shift();
diff --git a/arch/m68k/mm/kmap.c b/arch/m68k/mm/kmap.c
index 568cfad3ceb8..6e4955bc542b 100644
--- a/arch/m68k/mm/kmap.c
+++ b/arch/m68k/mm/kmap.c
@@ -27,9 +27,9 @@
 /*
 * For 040/060 we can use the virtual memory area like other architectures,
- * but for 020/030 we want to use early termination page descriptor and we
+ * but for 020/030 we want to use early termination page descriptors and we
 * can't mix this with normal page descriptors, so we have to copy that code
- * (mm/vmalloc.c) and return appriorate aligned addresses.
+ * (mm/vmalloc.c) and return appropriately aligned addresses.
 */
 #ifdef CPU_M68040_OR_M68060_ONLY
@@ -224,7 +224,7 @@ void __iomem *__ioremap(unsigned long physaddr, unsigned long size, int cachefla
 EXPORT_SYMBOL(__ioremap);
 /*
- * Unmap a ioremap()ed region again
+ * Unmap an ioremap()ed region again
 */
 void iounmap(void __iomem *addr)
 {
@@ -241,8 +241,8 @@ EXPORT_SYMBOL(iounmap);
 /*
 * __iounmap unmaps nearly everything, so be careful
- * it doesn't free currently pointer/page tables anymore but it
+ * Currently it doesn't free pointer/page tables anymore but this
- * wans't used anyway and might be added later.
+ * wasn't used anyway and might be added later.
 */
 void __iounmap(void *addr, unsigned long size)
 {
diff --git a/arch/m68k/mm/motorola.c b/arch/m68k/mm/motorola.c
index 251c5437787b..7d4024432163 100644
--- a/arch/m68k/mm/motorola.c
+++ b/arch/m68k/mm/motorola.c
@@ -233,7 +233,7 @@ void __init paging_init(void)
                        printk("Fix your bootloader or use a memfile to make use of this area!\n");
                        m68k_num_memory--;
                        memmove(m68k_memory + i, m68k_memory + i + 1,
-                                (m68k_num_memory - i) * sizeof(struct mem_info));
+                                (m68k_num_memory - i) * sizeof(struct m68k_mem_info));
                        continue;
                }
                addr = m68k_memory[i].addr + m68k_memory[i].size;
diff --git a/arch/m68k/mvme147/config.c b/arch/m68k/mvme147/config.c
index 1c6262803b94..1bb3ce6634d3 100644
--- a/arch/m68k/mvme147/config.c
+++ b/arch/m68k/mvme147/config.c
@@ -26,6 +26,8 @@
 #include <linux/interrupt.h>
 #include <asm/bootinfo.h>
+#include <asm/bootinfo-vme.h>
+#include <asm/byteorder.h>
 #include <asm/pgtable.h>
 #include <asm/setup.h>
 #include <asm/irq.h>
@@ -51,9 +53,10 @@ static int bcd2int (unsigned char b);
 irq_handler_t tick_handler;
-int mvme147_parse_bootinfo(const struct bi_record *bi)
+int __init mvme147_parse_bootinfo(const struct bi_record *bi)
 {
-        if (bi->tag == BI_VME_TYPE || bi->tag == BI_VME_BRDINFO)
+        uint16_t tag = be16_to_cpu(bi->tag);
+        if (tag == BI_VME_TYPE || tag == BI_VME_BRDINFO)
                return 0;
        else
                return 1;
diff --git a/arch/m68k/mvme16x/config.c b/arch/m68k/mvme16x/config.c
index 080a342458a1..eab7d342757e 100644
--- a/arch/m68k/mvme16x/config.c
+++ b/arch/m68k/mvme16x/config.c
@@ -29,6 +29,8 @@
 #include <linux/module.h>
 #include <asm/bootinfo.h>
+#include <asm/bootinfo-vme.h>
+#include <asm/byteorder.h>
 #include <asm/pgtable.h>
 #include <asm/setup.h>
 #include <asm/irq.h>
@@ -60,9 +62,10 @@ unsigned short mvme16x_config;
 EXPORT_SYMBOL(mvme16x_config);
-int mvme16x_parse_bootinfo(const struct bi_record *bi)
+int __init mvme16x_parse_bootinfo(const struct bi_record *bi)
 {
-        if (bi->tag == BI_VME_TYPE || bi->tag == BI_VME_BRDINFO)
+        uint16_t tag = be16_to_cpu(bi->tag);
+        if (tag == BI_VME_TYPE || tag == BI_VME_BRDINFO)
                return 0;
        else
                return 1;
@@ -87,15 +90,15 @@ static void mvme16x_get_model(char *model)
    suf[3] = '\0';
    suf[0] = suf[1] ? '-' : '\0';
-    sprintf(model, "Motorola MVME%x%s", p->brdno, suf);
+    sprintf(model, "Motorola MVME%x%s", be16_to_cpu(p->brdno), suf);
 }
 static void mvme16x_get_hardware_list(struct seq_file *m)
 {
-    p_bdid p = &mvme_bdid;
+    uint16_t brdno = be16_to_cpu(mvme_bdid.brdno);
-    if (p->brdno == 0x0162 || p->brdno == 0x0172)
+    if (brdno == 0x0162 || brdno == 0x0172)
    {
        unsigned char rev = *(unsigned char *)MVME162_VERSION_REG;
@@ -285,6 +288,7 @@ void __init config_mvme16x(void)
 {
    p_bdid p = &mvme_bdid;
    char id[40];
+    uint16_t brdno = be16_to_cpu(p->brdno);
    mach_max_dma_address = 0xffffffff;
    mach_sched_init      = mvme16x_sched_init;
@@ -306,18 +310,18 @@ void __init config_mvme16x(void)
    }
    /* Board type is only set by newer versions of vmelilo/tftplilo */
    if (vme_brdtype == 0)
-        vme_brdtype = p->brdno;
+        vme_brdtype = brdno;
    mvme16x_get_model(id);
    printk ("\nBRD_ID: %s   BUG %x.%x %02x/%02x/%02x\n", id, p->rev>>4,
                                        p->rev&0xf, p->yr, p->mth, p->day);
-    if (p->brdno == 0x0162 || p->brdno == 0x172)
+    if (brdno == 0x0162 || brdno == 0x172)
    {
        unsigned char rev = *(unsigned char *)MVME162_VERSION_REG;
        mvme16x_config = rev | MVME16x_CONFIG_GOT_SCCA;
-        printk ("MVME%x Hardware status:\n", p->brdno);
+        printk ("MVME%x Hardware status:\n", brdno);
        printk ("    CPU Type           68%s040\n",
                        rev & MVME16x_CONFIG_GOT_FPU ? "" : "LC");
        printk ("    CPU clock          %dMHz\n",
@@ -347,12 +351,12 @@ void __init config_mvme16x(void)
 static irqreturn_t mvme16x_abort_int (int irq, void *dev_id)
 {
-        p_bdid p = &mvme_bdid;
        unsigned long *new = (unsigned long *)vectors;
        unsigned long *old = (unsigned long *)0xffe00000;
        volatile unsigned char uc, *ucp;
+        uint16_t brdno = be16_to_cpu(mvme_bdid.brdno);
-        if (p->brdno == 0x0162 || p->brdno == 0x172)
+        if (brdno == 0x0162 || brdno == 0x172)
        {
                ucp = (volatile unsigned char *)0xfff42043;
                uc = *ucp | 8;
@@ -366,7 +370,7 @@ static irqreturn_t mvme16x_abort_int (int irq, void *dev_id)
        *(new+9) = *(old+9);            /* Trace */
        *(new+47) = *(old+47);          /* Trap #15 */
-        if (p->brdno == 0x0162 || p->brdno == 0x172)
+        if (brdno == 0x0162 || brdno == 0x172)
                *(new+0x5e) = *(old+0x5e);      /* ABORT switch */
        else
                *(new+0x6e) = *(old+0x6e);      /* ABORT switch */
@@ -381,7 +385,7 @@ static irqreturn_t mvme16x_timer_int (int irq, void *dev_id)
 void mvme16x_sched_init (irq_handler_t timer_routine)
 {
-    p_bdid p = &mvme_bdid;
+    uint16_t brdno = be16_to_cpu(mvme_bdid.brdno);
    int irq;
    tick_handler = timer_routine;
@@ -394,7 +398,7 @@ void mvme16x_sched_init (irq_handler_t timer_routine)
                                "timer", mvme16x_timer_int))
        panic ("Couldn't register timer int");
-    if (p->brdno == 0x0162 || p->brdno == 0x172)
+    if (brdno == 0x0162 || brdno == 0x172)
        irq = MVME162_IRQ_ABORT;
    else
        irq = MVME167_IRQ_ABORT;
diff --git a/arch/m68k/q40/config.c b/arch/m68k/q40/config.c
index 078bb744b5fe..e90fe903613e 100644
--- a/arch/m68k/q40/config.c
+++ b/arch/m68k/q40/config.c
@@ -154,7 +154,7 @@ static unsigned int serports[] =
        0x3f8,0x2f8,0x3e8,0x2e8,0
 };
-static void q40_disable_irqs(void)
+static void __init q40_disable_irqs(void)
 {
        unsigned i, j;
@@ -198,7 +198,7 @@ void __init config_q40(void)
 }
-int q40_parse_bootinfo(const struct bi_record *rec)
+int __init q40_parse_bootinfo(const struct bi_record *rec)
 {
        return 1;
 }
diff --git a/arch/m68k/sun3/dvma.c b/arch/m68k/sun3/dvma.c
index d522eaab4551..d95506e06c2a 100644
--- a/arch/m68k/sun3/dvma.c
+++ b/arch/m68k/sun3/dvma.c
@@ -7,6 +7,7 @@
 *
 */
+#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/mm.h>
 #include <linux/bootmem.h>
@@ -62,10 +63,7 @@ int dvma_map_iommu(unsigned long kaddr, unsigned long baddr,
 }
-void sun3_dvma_init(void)
+void __init sun3_dvma_init(void)
 {
        memset(ptelist, 0, sizeof(ptelist));
 }
diff --git a/arch/m68k/sun3/mmu_emu.c b/arch/m68k/sun3/mmu_emu.c
index 8edc510a21be..3f258e230ba5 100644
--- a/arch/m68k/sun3/mmu_emu.c
+++ b/arch/m68k/sun3/mmu_emu.c
@@ -6,6 +6,7 @@
 ** Started 1/16/98 @ 2:22 am
 */
+#include <linux/init.h>
 #include <linux/mman.h>
 #include <linux/mm.h>
 #include <linux/kernel.h>
@@ -122,7 +123,7 @@ void print_pte_vaddr (unsigned long vaddr)
 /*
 * Initialise the MMU emulator.
 */
-void mmu_emu_init(unsigned long bootmem_end)
+void __init mmu_emu_init(unsigned long bootmem_end)
 {
        unsigned long seg, num;
        int i,j;
diff --git a/arch/m68k/sun3/sun3dvma.c b/arch/m68k/sun3/sun3dvma.c
index cab54482ca34..b37521a5259d 100644
--- a/arch/m68k/sun3/sun3dvma.c
+++ b/arch/m68k/sun3/sun3dvma.c
@@ -6,6 +6,8 @@
 * Contains common routines for sun3/sun3x DVMA management.
 */
+#include <linux/bootmem.h>
+#include <linux/init.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/gfp.h>
@@ -30,7 +32,7 @@ static inline void dvma_unmap_iommu(unsigned long a, int b)
 extern void sun3_dvma_init(void);
 #endif
-static unsigned long iommu_use[IOMMU_TOTAL_ENTRIES];
+static unsigned long *iommu_use;
 #define dvma_index(baddr) ((baddr - DVMA_START) >> DVMA_PAGE_SHIFT)
@@ -245,7 +247,7 @@ static inline int free_baddr(unsigned long baddr)
 }
-void dvma_init(void)
+void __init dvma_init(void)
 {
        struct hole *hole;
@@ -265,7 +267,7 @@ void dvma_init(void)
        list_add(&(hole->list), &hole_list);
-        memset(iommu_use, 0, sizeof(iommu_use));
+        iommu_use = alloc_bootmem(IOMMU_TOTAL_ENTRIES * sizeof(unsigned long));
        dvma_unmap_iommu(DVMA_START, DVMA_SIZE);
diff --git a/arch/m68k/sun3x/prom.c b/arch/m68k/sun3x/prom.c
index a7b7e818d627..0898c3f81508 100644
--- a/arch/m68k/sun3x/prom.c
+++ b/arch/m68k/sun3x/prom.c
@@ -10,7 +10,6 @@
 #include <asm/page.h>
 #include <asm/pgtable.h>
-#include <asm/bootinfo.h>
 #include <asm/setup.h>
 #include <asm/traps.h>
 #include <asm/sun3xprom.h>
diff --git a/arch/metag/include/asm/barrier.h b/arch/metag/include/asm/barrier.h
index c90bfc6bf648..5d6b4b407dda 100644
--- a/arch/metag/include/asm/barrier.h
+++ b/arch/metag/include/asm/barrier.h
@@ -82,4 +82,19 @@ static inline void fence(void)
 #define smp_read_barrier_depends()     do { } while (0)
 #define set_mb(var, value) do { var = value; smp_mb(); } while (0)
+#define smp_store_release(p, v)                                         \
+do {                                                                    \
+        compiletime_assert_atomic_type(*p);                             \
+        smp_mb();                                                       \
+        ACCESS_ONCE(*p) = (v);                                          \
+} while (0)
+#define smp_load_acquire(p)                                             \
+({                                                                      \
+        typeof(*p) ___p1 = ACCESS_ONCE(*p);                             \
+        compiletime_assert_atomic_type(*p);                             \
+        smp_mb();                                                       \
+        ___p1;                                                          \
+})
 #endif /* _ASM_METAG_BARRIER_H */
diff --git a/arch/metag/include/asm/smp.h b/arch/metag/include/asm/smp.h
index e0373f81a117..1d7e770f7a54 100644
--- a/arch/metag/include/asm/smp.h
+++ b/arch/metag/include/asm/smp.h
@@ -7,13 +7,11 @@
 enum ipi_msg_type {
        IPI_CALL_FUNC,
-        IPI_CALL_FUNC_SINGLE,
        IPI_RESCHEDULE,
 };
 extern void arch_send_call_function_single_ipi(int cpu);
 extern void arch_send_call_function_ipi_mask(const struct cpumask *mask);
-#define arch_send_call_function_ipi_mask arch_send_call_function_ipi_mask
 asmlinkage void secondary_start_kernel(void);
diff --git a/arch/metag/kernel/dma.c b/arch/metag/kernel/dma.c
index db589ad5dbc4..c700d625067a 100644
--- a/arch/metag/kernel/dma.c
+++ b/arch/metag/kernel/dma.c
@@ -399,11 +399,6 @@ static int __init dma_alloc_init(void)
                pgd = pgd_offset(&init_mm, CONSISTENT_START);
                pud = pud_alloc(&init_mm, pgd, CONSISTENT_START);
                pmd = pmd_alloc(&init_mm, pud, CONSISTENT_START);
-                if (!pmd) {
-                        pr_err("%s: no pmd tables\n", __func__);
-                        ret = -ENOMEM;
-                        break;
-                }
                WARN_ON(!pmd_none(*pmd));
                pte = pte_alloc_kernel(pmd, CONSISTENT_START);
diff --git a/arch/metag/kernel/smp.c b/arch/metag/kernel/smp.c
index 7c0113142981..f006d2276f40 100644
--- a/arch/metag/kernel/smp.c
+++ b/arch/metag/kernel/smp.c
@@ -68,7 +68,7 @@ static DECLARE_COMPLETION(cpu_running);
 /*
 * "thread" is assumed to be a valid Meta hardware thread ID.
 */
-int boot_secondary(unsigned int thread, struct task_struct *idle)
+static int boot_secondary(unsigned int thread, struct task_struct *idle)
 {
        u32 val;
@@ -491,7 +491,7 @@ void arch_send_call_function_ipi_mask(const struct cpumask *mask)
 void arch_send_call_function_single_ipi(int cpu)
 {
-        send_ipi_message(cpumask_of(cpu), IPI_CALL_FUNC_SINGLE);
+        send_ipi_message(cpumask_of(cpu), IPI_CALL_FUNC);
 }
 void show_ipi_list(struct seq_file *p)
@@ -517,11 +517,10 @@ static DEFINE_SPINLOCK(stop_lock);
 *
 *  Bit 0 - Inter-processor function call
 */
-static int do_IPI(struct pt_regs *regs)
+static int do_IPI(void)
 {
        unsigned int cpu = smp_processor_id();
        struct ipi_data *ipi = &per_cpu(ipi_data, cpu);
-        struct pt_regs *old_regs = set_irq_regs(regs);
        unsigned long msgs, nextmsg;
        int handled = 0;
@@ -546,10 +545,6 @@ static int do_IPI(struct pt_regs *regs)
                        generic_smp_call_function_interrupt();
                        break;
-                case IPI_CALL_FUNC_SINGLE:
-                        generic_smp_call_function_single_interrupt();
-                        break;
                default:
                        pr_crit("CPU%u: Unknown IPI message 0x%lx\n",
                                cpu, nextmsg);
@@ -557,8 +552,6 @@ static int do_IPI(struct pt_regs *regs)
                }
        }
-        set_irq_regs(old_regs);
        return handled;
 }
@@ -624,7 +617,7 @@ static void kick_raise_softirq(cpumask_t callmap, unsigned int irq)
 static TBIRES ipi_handler(TBIRES State, int SigNum, int Triggers,
                   int Inst, PTBI pTBI, int *handled)
 {
-        *handled = do_IPI((struct pt_regs *)State.Sig.pCtx);
+        *handled = do_IPI();
        return State;
 }
diff --git a/arch/metag/kernel/topology.c b/arch/metag/kernel/topology.c
index bec3dec4922e..4ba595701f7d 100644
--- a/arch/metag/kernel/topology.c
+++ b/arch/metag/kernel/topology.c
@@ -19,6 +19,7 @@
 DEFINE_PER_CPU(struct cpuinfo_metag, cpu_data);
 cpumask_t cpu_core_map[NR_CPUS];
+EXPORT_SYMBOL(cpu_core_map);
 static cpumask_t cpu_coregroup_map(unsigned int cpu)
 {
diff --git a/arch/microblaze/include/asm/Kbuild b/arch/microblaze/include/asm/Kbuild
index ce0bbf8f5640..a82426589fff 100644
--- a/arch/microblaze/include/asm/Kbuild
+++ b/arch/microblaze/include/asm/Kbuild
@@ -1,4 +1,5 @@
+generic-y += barrier.h
 generic-y += clkdev.h
 generic-y += exec.h
 generic-y += trace_clock.h
diff --git a/arch/microblaze/include/asm/barrier.h b/arch/microblaze/include/asm/barrier.h
deleted file mode 100644
index df5be3e87044..000000000000
--- a/arch/microblaze/include/asm/barrier.h
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Copyright (C) 2006 Atmark Techno, Inc.
- *
- * This file is subject to the terms and conditions of the GNU General Public
- * License. See the file "COPYING" in the main directory of this archive
- * for more details.
- */
-#ifndef _ASM_MICROBLAZE_BARRIER_H
-#define _ASM_MICROBLAZE_BARRIER_H
-#define nop()                  asm volatile ("nop")
-#define smp_read_barrier_depends()      do {} while (0)
-#define read_barrier_depends()          do {} while (0)
-#define mb()                    barrier()
-#define rmb()                   mb()
-#define wmb()                   mb()
-#define set_mb(var, value)      do { var = value; mb(); } while (0)
-#define set_wmb(var, value)     do { var = value; wmb(); } while (0)
-#define smp_mb()                mb()
-#define smp_rmb()               rmb()
-#define smp_wmb()               wmb()
-#endif /* _ASM_MICROBLAZE_BARRIER_H */
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 650de3976e7a..c93d92beb3d6 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -47,6 +47,7 @@ config MIPS
        select MODULES_USE_ELF_RELA if MODULES && 64BIT
        select CLONE_BACKWARDS
        select HAVE_DEBUG_STACKOVERFLOW
+        select HAVE_CC_STACKPROTECTOR
 menu "Machine selection"
@@ -2322,19 +2323,6 @@ config SECCOMP
          If unsure, say Y. Only embedded should say N here.
-config CC_STACKPROTECTOR
-        bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
-        help
-          This option turns on the -fstack-protector GCC feature. This
-          feature puts, at the beginning of functions, a canary value on
-          the stack just before the return address, and validates
-          the value just before actually returning.  Stack based buffer
-          overflows (that need to overwrite this return address) now also
-          overwrite the canary, which gets detected and the attack is then
-          neutralized via a kernel panic.
-          This feature requires gcc version 4.2 or above.
 config USE_OF
        bool
        select OF
diff --git a/arch/mips/Makefile b/arch/mips/Makefile
index de300b993607..efe50787cd89 100644
--- a/arch/mips/Makefile
+++ b/arch/mips/Makefile
@@ -232,10 +232,6 @@ bootvars-y	= VMLINUX_LOAD_ADDRESS=$(load-y) \
 LDFLAGS                 += -m $(ld-emul)
-ifdef CONFIG_CC_STACKPROTECTOR
-  KBUILD_CFLAGS += -fstack-protector
-endif
 ifdef CONFIG_MIPS
 CHECKFLAGS += $(shell $(CC) $(KBUILD_CFLAGS) -dM -E -x c /dev/null | \
        egrep -vw '__GNUC_(|MINOR_|PATCHLEVEL_)_' | \
diff --git a/arch/mips/ar7/setup.c b/arch/mips/ar7/setup.c
index 9a357fffcfbe..820b7a313d9b 100644
--- a/arch/mips/ar7/setup.c
+++ b/arch/mips/ar7/setup.c
@@ -92,7 +92,6 @@ void __init plat_mem_setup(void)
        _machine_restart = ar7_machine_restart;
        _machine_halt = ar7_machine_halt;
        pm_power_off = ar7_machine_power_off;
-        panic_timeout = 3;
        io_base = (unsigned long)ioremap(AR7_REGS_BASE, 0x10000);
        if (!io_base)
diff --git a/arch/mips/emma/markeins/setup.c b/arch/mips/emma/markeins/setup.c
index d71005835c00..9100122e5cef 100644
--- a/arch/mips/emma/markeins/setup.c
+++ b/arch/mips/emma/markeins/setup.c
@@ -111,9 +111,6 @@ void __init plat_mem_setup(void)
        iomem_resource.start = EMMA2RH_IO_BASE;
        iomem_resource.end = EMMA2RH_ROM_BASE - 1;
-        /* Reboot on panic */
-        panic_timeout = 180;
        markeins_sio_setup();
 }
diff --git a/arch/mips/include/asm/barrier.h b/arch/mips/include/asm/barrier.h
index f26d8e1bf3c3..e1aa4e4c2984 100644
--- a/arch/mips/include/asm/barrier.h
+++ b/arch/mips/include/asm/barrier.h
@@ -180,4 +180,19 @@
 #define nudge_writes() mb()
 #endif
+#define smp_store_release(p, v)                                         \
+do {                                                                    \
+        compiletime_assert_atomic_type(*p);                             \
+        smp_mb();                                                       \
+        ACCESS_ONCE(*p) = (v);                                          \
+} while (0)
+#define smp_load_acquire(p)                                             \
+({                                                                      \
+        typeof(*p) ___p1 = ACCESS_ONCE(*p);                             \
+        compiletime_assert_atomic_type(*p);                             \
+        smp_mb();                                                       \
+        ___p1;                                                          \
+})
 #endif /* __ASM_BARRIER_H */
diff --git a/arch/mips/include/asm/cacheops.h b/arch/mips/include/asm/cacheops.h
index c75025f27c20..06b9bc7ea14b 100644
--- a/arch/mips/include/asm/cacheops.h
+++ b/arch/mips/include/asm/cacheops.h
@@ -83,6 +83,6 @@
 /*
 * Loongson2-specific cacheops
 */
-#define Hit_Invalidate_I_Loongson23     0x00
+#define Hit_Invalidate_I_Loongson2      0x00
 #endif  /* __ASM_CACHEOPS_H */
diff --git a/arch/mips/include/asm/r4kcache.h b/arch/mips/include/asm/r4kcache.h
index 34d1a1917125..c84caddb8bde 100644
--- a/arch/mips/include/asm/r4kcache.h
+++ b/arch/mips/include/asm/r4kcache.h
@@ -165,7 +165,7 @@ static inline void flush_icache_line(unsigned long addr)
        __iflush_prologue
        switch (boot_cpu_type()) {
        case CPU_LOONGSON2:
-                cache_op(Hit_Invalidate_I_Loongson23, addr);
+                cache_op(Hit_Invalidate_I_Loongson2, addr);
                break;
        default:
@@ -219,7 +219,7 @@ static inline void protected_flush_icache_line(unsigned long addr)
 {
        switch (boot_cpu_type()) {
        case CPU_LOONGSON2:
-                protected_cache_op(Hit_Invalidate_I_Loongson23, addr);
+                protected_cache_op(Hit_Invalidate_I_Loongson2, addr);
                break;
        default:
@@ -357,8 +357,8 @@ static inline void invalidate_tcache_page(unsigned long addr)
                  "i" (op));
 /* build blast_xxx, blast_xxx_page, blast_xxx_page_indexed */
-#define __BUILD_BLAST_CACHE(pfx, desc, indexop, hitop, lsize) \
+#define __BUILD_BLAST_CACHE(pfx, desc, indexop, hitop, lsize, extra)    \
-static inline void blast_##pfx##cache##lsize(void)                      \
+static inline void extra##blast_##pfx##cache##lsize(void)               \
 {                                                                       \
        unsigned long start = INDEX_BASE;                               \
        unsigned long end = start + current_cpu_data.desc.waysize;      \
@@ -376,7 +376,7 @@ static inline void blast_##pfx##cache##lsize(void)			\
        __##pfx##flush_epilogue                                         \
 }                                                                       \
                                                                        \
-static inline void blast_##pfx##cache##lsize##_page(unsigned long page) \
+static inline void extra##blast_##pfx##cache##lsize##_page(unsigned long page) \
 {                                                                       \
        unsigned long start = page;                                     \
        unsigned long end = page + PAGE_SIZE;                           \
@@ -391,7 +391,7 @@ static inline void blast_##pfx##cache##lsize##_page(unsigned long page) \
        __##pfx##flush_epilogue                                         \
 }                                                                       \
                                                                        \
-static inline void blast_##pfx##cache##lsize##_page_indexed(unsigned long page) \
+static inline void extra##blast_##pfx##cache##lsize##_page_indexed(unsigned long page) \
 {                                                                       \
        unsigned long indexmask = current_cpu_data.desc.waysize - 1;    \
        unsigned long start = INDEX_BASE + (page & indexmask);          \
@@ -410,23 +410,24 @@ static inline void blast_##pfx##cache##lsize##_page_indexed(unsigned long page)
        __##pfx##flush_epilogue                                         \
 }
-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16)
+__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 16, )
-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 16)
+__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 16, )
-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16)
+__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 16, )
-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 32)
+__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 32, )
-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 32)
+__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 32, )
-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32)
+__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I_Loongson2, 32, loongson2_)
-__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 64)
+__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 32, )
-__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64)
+__BUILD_BLAST_CACHE(d, dcache, Index_Writeback_Inv_D, Hit_Writeback_Inv_D, 64, )
-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64)
+__BUILD_BLAST_CACHE(i, icache, Index_Invalidate_I, Hit_Invalidate_I, 64, )
-__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128)
+__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 64, )
+__BUILD_BLAST_CACHE(s, scache, Index_Writeback_Inv_SD, Hit_Writeback_Inv_SD, 128, )
-__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 16)
-__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 32)
+__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 16, )
-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 16)
+__BUILD_BLAST_CACHE(inv_d, dcache, Index_Writeback_Inv_D, Hit_Invalidate_D, 32, )
-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 32)
+__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 16, )
-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 64)
+__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 32, )
-__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 128)
+__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 64, )
+__BUILD_BLAST_CACHE(inv_s, scache, Index_Writeback_Inv_SD, Hit_Invalidate_SD, 128, )
 /* build blast_xxx_range, protected_blast_xxx_range */
 #define __BUILD_BLAST_CACHE_RANGE(pfx, desc, hitop, prot, extra)        \
@@ -452,8 +453,8 @@ static inline void prot##extra##blast_##pfx##cache##_range(unsigned long start,
 __BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, protected_, )
 __BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, protected_, )
 __BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I, protected_, )
-__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I_Loongson23, \
+__BUILD_BLAST_CACHE_RANGE(i, icache, Hit_Invalidate_I_Loongson2, \
-        protected_, loongson23_)
+        protected_, loongson2_)
 __BUILD_BLAST_CACHE_RANGE(d, dcache, Hit_Writeback_Inv_D, , )
 __BUILD_BLAST_CACHE_RANGE(s, scache, Hit_Writeback_Inv_SD, , )
 /* blast_inv_dcache_range */
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index 62ffd20ea869..49e572d879e1 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -237,6 +237,8 @@ static void r4k_blast_icache_page_setup(void)
                r4k_blast_icache_page = (void *)cache_noop;
        else if (ic_lsize == 16)
                r4k_blast_icache_page = blast_icache16_page;
+        else if (ic_lsize == 32 && current_cpu_type() == CPU_LOONGSON2)
+                r4k_blast_icache_page = loongson2_blast_icache32_page;
        else if (ic_lsize == 32)
                r4k_blast_icache_page = blast_icache32_page;
        else if (ic_lsize == 64)
@@ -261,6 +263,9 @@ static void r4k_blast_icache_page_indexed_setup(void)
                else if (TX49XX_ICACHE_INDEX_INV_WAR)
                        r4k_blast_icache_page_indexed =
                                tx49_blast_icache32_page_indexed;
+                else if (current_cpu_type() == CPU_LOONGSON2)
+                        r4k_blast_icache_page_indexed =
+                                loongson2_blast_icache32_page_indexed;
                else
                        r4k_blast_icache_page_indexed =
                                blast_icache32_page_indexed;
@@ -284,6 +289,8 @@ static void r4k_blast_icache_setup(void)
                        r4k_blast_icache = blast_r4600_v1_icache32;
                else if (TX49XX_ICACHE_INDEX_INV_WAR)
                        r4k_blast_icache = tx49_blast_icache32;
+                else if (current_cpu_type() == CPU_LOONGSON2)
+                        r4k_blast_icache = loongson2_blast_icache32;
                else
                        r4k_blast_icache = blast_icache32;
        } else if (ic_lsize == 64)
@@ -580,11 +587,11 @@ static inline void local_r4k_flush_icache_range(unsigned long start, unsigned lo
        else {
                switch (boot_cpu_type()) {
                case CPU_LOONGSON2:
-                        protected_blast_icache_range(start, end);
+                        protected_loongson2_blast_icache_range(start, end);
                        break;
                default:
-                        protected_loongson23_blast_icache_range(start, end);
+                        protected_blast_icache_range(start, end);
                        break;
                }
        }
diff --git a/arch/mips/netlogic/xlp/setup.c b/arch/mips/netlogic/xlp/setup.c
index 6d981bb337ec..54e75c77184b 100644
--- a/arch/mips/netlogic/xlp/setup.c
+++ b/arch/mips/netlogic/xlp/setup.c
@@ -92,7 +92,6 @@ static void __init xlp_init_mem_from_bars(void)
 void __init plat_mem_setup(void)
 {
-        panic_timeout   = 5;
        _machine_restart = (void (*)(char *))nlm_linux_exit;
        _machine_halt   = nlm_linux_exit;
        pm_power_off    = nlm_linux_exit;
diff --git a/arch/mips/netlogic/xlr/setup.c b/arch/mips/netlogic/xlr/setup.c
index 214d123b79fa..921be5f77797 100644
--- a/arch/mips/netlogic/xlr/setup.c
+++ b/arch/mips/netlogic/xlr/setup.c
@@ -92,7 +92,6 @@ static void nlm_linux_exit(void)
 void __init plat_mem_setup(void)
 {
-        panic_timeout   = 5;
        _machine_restart = (void (*)(char *))nlm_linux_exit;
        _machine_halt   = nlm_linux_exit;
        pm_power_off    = nlm_linux_exit;
diff --git a/arch/mips/sibyte/swarm/setup.c b/arch/mips/sibyte/swarm/setup.c
index 41707a245dea..3462c831d0ea 100644
--- a/arch/mips/sibyte/swarm/setup.c
+++ b/arch/mips/sibyte/swarm/setup.c
@@ -134,8 +134,6 @@ void __init plat_mem_setup(void)
 #error invalid SiByte board configuration
 #endif
-        panic_timeout = 5;  /* For debug.  */
        board_be_handler = swarm_be_handler;
        if (xicor_probe())
diff --git a/arch/mn10300/include/asm/Kbuild b/arch/mn10300/include/asm/Kbuild
index 74742dc6a3da..032143ec2324 100644
--- a/arch/mn10300/include/asm/Kbuild
+++ b/arch/mn10300/include/asm/Kbuild
@@ -1,4 +1,5 @@
+generic-y += barrier.h
 generic-y += clkdev.h
 generic-y += exec.h
 generic-y += trace_clock.h
diff --git a/arch/mn10300/include/asm/barrier.h b/arch/mn10300/include/asm/barrier.h
deleted file mode 100644
index 2bd97a5c8af7..000000000000
--- a/arch/mn10300/include/asm/barrier.h
+++ /dev/null
@@ -1,37 +0,0 @@
-/* MN10300 memory barrier definitions
- *
- * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public Licence
- * as published by the Free Software Foundation; either version
- * 2 of the Licence, or (at your option) any later version.
- */
-#ifndef _ASM_BARRIER_H
-#define _ASM_BARRIER_H
-#define nop()   asm volatile ("nop")
-#define mb()    asm volatile ("": : :"memory")
-#define rmb()   mb()
-#define wmb()   asm volatile ("": : :"memory")
-#ifdef CONFIG_SMP
-#define smp_mb()        mb()
-#define smp_rmb()       rmb()
-#define smp_wmb()       wmb()
-#define set_mb(var, value)  do { xchg(&var, value); } while (0)
-#else  /* CONFIG_SMP */
-#define smp_mb()        barrier()
-#define smp_rmb()       barrier()
-#define smp_wmb()       barrier()
-#define set_mb(var, value)  do { var = value;  mb(); } while (0)
-#endif /* CONFIG_SMP */
-#define set_wmb(var, value) do { var = value; wmb(); } while (0)
-#define read_barrier_depends()          do {} while (0)
-#define smp_read_barrier_depends()      do {} while (0)
-#endif /* _ASM_BARRIER_H */
diff --git a/arch/parisc/include/asm/Kbuild b/arch/parisc/include/asm/Kbuild
index a603b9ebe54c..34b0be4ca52d 100644
--- a/arch/parisc/include/asm/Kbuild
+++ b/arch/parisc/include/asm/Kbuild
@@ -1,4 +1,5 @@
+generic-y += barrier.h
 generic-y += word-at-a-time.h auxvec.h user.h cputime.h emergency-restart.h \
          segment.h topology.h vga.h device.h percpu.h hw_irq.h mutex.h \
          div64.h irq_regs.h kdebug.h kvm_para.h local64.h local.h param.h \
diff --git a/arch/parisc/include/asm/barrier.h b/arch/parisc/include/asm/barrier.h
deleted file mode 100644
index e77d834aa803..000000000000
--- a/arch/parisc/include/asm/barrier.h
+++ /dev/null
@@ -1,35 +0,0 @@
-#ifndef __PARISC_BARRIER_H
-#define __PARISC_BARRIER_H
-/*
-** This is simply the barrier() macro from linux/kernel.h but when serial.c
-** uses tqueue.h uses smp_mb() defined using barrier(), linux/kernel.h
-** hasn't yet been included yet so it fails, thus repeating the macro here.
-**
-** PA-RISC architecture allows for weakly ordered memory accesses although
-** none of the processors use it. There is a strong ordered bit that is
-** set in the O-bit of the page directory entry. Operating systems that
-** can not tolerate out of order accesses should set this bit when mapping
-** pages. The O-bit of the PSW should also be set to 1 (I don't believe any
-** of the processor implemented the PSW O-bit). The PCX-W ERS states that
-** the TLB O-bit is not implemented so the page directory does not need to
-** have the O-bit set when mapping pages (section 3.1). This section also
-** states that the PSW Y, Z, G, and O bits are not implemented.
-** So it looks like nothing needs to be done for parisc-linux (yet).
-** (thanks to chada for the above comment -ggg)
-**
-** The __asm__ op below simple prevents gcc/ld from reordering
-** instructions across the mb() "call".
-*/
-#define mb()            __asm__ __volatile__("":::"memory")     /* barrier() */
-#define rmb()           mb()
-#define wmb()           mb()
-#define smp_mb()        mb()
-#define smp_rmb()       mb()
-#define smp_wmb()       mb()
-#define smp_read_barrier_depends()      do { } while(0)
-#define read_barrier_depends()          do { } while(0)
-#define set_mb(var, value)              do { var = value; mb(); } while (0)
-#endif /* __PARISC_BARRIER_H */
diff --git a/arch/parisc/include/asm/cacheflush.h b/arch/parisc/include/asm/cacheflush.h
index f0e2784e7cca..2f9b751878ba 100644
--- a/arch/parisc/include/asm/cacheflush.h
+++ b/arch/parisc/include/asm/cacheflush.h
@@ -125,42 +125,38 @@ flush_anon_page(struct vm_area_struct *vma, struct page *page, unsigned long vma
 void mark_rodata_ro(void);
 #endif
-#ifdef CONFIG_PA8X00
-/* Only pa8800, pa8900 needs this */
 #include <asm/kmap_types.h>
 #define ARCH_HAS_KMAP
-void kunmap_parisc(void *addr);
 static inline void *kmap(struct page *page)
 {
        might_sleep();
+        flush_dcache_page(page);
        return page_address(page);
 }
 static inline void kunmap(struct page *page)
 {
-        kunmap_parisc(page_address(page));
+        flush_kernel_dcache_page_addr(page_address(page));
 }
 static inline void *kmap_atomic(struct page *page)
 {
        pagefault_disable();
+        flush_dcache_page(page);
        return page_address(page);
 }
 static inline void __kunmap_atomic(void *addr)
 {
-        kunmap_parisc(addr);
+        flush_kernel_dcache_page_addr(addr);
        pagefault_enable();
 }
 #define kmap_atomic_prot(page, prot)    kmap_atomic(page)
 #define kmap_atomic_pfn(pfn)    kmap_atomic(pfn_to_page(pfn))
 #define kmap_atomic_to_page(ptr)        virt_to_page(ptr)
-#endif
 #endif /* _PARISC_CACHEFLUSH_H */
diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h
index b7adb2ac049c..c53fc63149e8 100644
--- a/arch/parisc/include/asm/page.h
+++ b/arch/parisc/include/asm/page.h
@@ -28,9 +28,8 @@ struct page;
 void clear_page_asm(void *page);
 void copy_page_asm(void *to, void *from);
-void clear_user_page(void *vto, unsigned long vaddr, struct page *pg);
+#define clear_user_page(vto, vaddr, page) clear_page_asm(vto)
-void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
+#define copy_user_page(vto, vfrom, vaddr, page) copy_page_asm(vto, vfrom)
-                           struct page *pg);
 /* #define CONFIG_PARISC_TMPALIAS */
diff --git a/arch/parisc/include/uapi/asm/socket.h b/arch/parisc/include/uapi/asm/socket.h
index f33113a6141e..70b3674dac4e 100644
--- a/arch/parisc/include/uapi/asm/socket.h
+++ b/arch/parisc/include/uapi/asm/socket.h
@@ -75,6 +75,6 @@
 #define SO_BUSY_POLL            0x4027
-#define SO_MAX_PACING_RATE      0x4048
+#define SO_MAX_PACING_RATE      0x4028
 #endif /* _UAPI_ASM_SOCKET_H */
diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
index c035673209f7..a72545554a31 100644
--- a/arch/parisc/kernel/cache.c
+++ b/arch/parisc/kernel/cache.c
@@ -388,41 +388,6 @@ void flush_kernel_dcache_page_addr(void *addr)
 }
 EXPORT_SYMBOL(flush_kernel_dcache_page_addr);
-void clear_user_page(void *vto, unsigned long vaddr, struct page *page)
-{
-        clear_page_asm(vto);
-        if (!parisc_requires_coherency())
-                flush_kernel_dcache_page_asm(vto);
-}
-EXPORT_SYMBOL(clear_user_page);
-void copy_user_page(void *vto, void *vfrom, unsigned long vaddr,
-        struct page *pg)
-{
-        /* Copy using kernel mapping.  No coherency is needed
-           (all in kmap/kunmap) on machines that don't support
-           non-equivalent aliasing.  However, the `from' page
-           needs to be flushed before it can be accessed through
-           the kernel mapping. */
-        preempt_disable();
-        flush_dcache_page_asm(__pa(vfrom), vaddr);
-        preempt_enable();
-        copy_page_asm(vto, vfrom);
-        if (!parisc_requires_coherency())
-                flush_kernel_dcache_page_asm(vto);
-}
-EXPORT_SYMBOL(copy_user_page);
-#ifdef CONFIG_PA8X00
-void kunmap_parisc(void *addr)
-{
-        if (parisc_requires_coherency())
-                flush_kernel_dcache_page_addr(addr);
-}
-EXPORT_SYMBOL(kunmap_parisc);
-#endif
 void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
 {
        unsigned long flags;
diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig
index b44b52c0a8f0..b2be8e8cb5c7 100644
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -147,6 +147,10 @@ config EARLY_PRINTK
        bool
        default y
+config PANIC_TIMEOUT
+        int
+        default 180
 config COMPAT
        bool
        default y if PPC64
diff --git a/arch/powerpc/boot/dts/mpc5125twr.dts b/arch/powerpc/boot/dts/mpc5125twr.dts
index 4177b62240c2..a618dfc13e4c 100644
--- a/arch/powerpc/boot/dts/mpc5125twr.dts
+++ b/arch/powerpc/boot/dts/mpc5125twr.dts
@@ -58,7 +58,6 @@
                compatible = "fsl,mpc5121-immr";
                #address-cells = <1>;
                #size-cells = <1>;
-                #interrupt-cells = <2>;
                ranges = <0x0 0x80000000 0x400000>;
                reg = <0x80000000 0x400000>;
                bus-frequency = <66000000>;     // 66 MHz ips bus
@@ -189,6 +188,10 @@
                        reg = <0xA000 0x1000>;
                };
+                // disable USB1 port
+                // TODO:
+                // correct pinmux config and fix USB3320 ulpi dependency
+                // before re-enabling it
                usb@3000 {
                        compatible = "fsl,mpc5121-usb2-dr";
                        reg = <0x3000 0x400>;
@@ -197,6 +200,7 @@
                        interrupts = <43 0x8>;
                        dr_mode = "host";
                        phy_type = "ulpi";
+                        status = "disabled";
                };
                // 5125 PSCs are not 52xx or 5121 PSC compatible
diff --git a/arch/powerpc/include/asm/barrier.h b/arch/powerpc/include/asm/barrier.h
index ae782254e731..f89da808ce31 100644
--- a/arch/powerpc/include/asm/barrier.h
+++ b/arch/powerpc/include/asm/barrier.h
@@ -45,11 +45,15 @@
 #    define SMPWMB      eieio
 #endif
+#define __lwsync()      __asm__ __volatile__ (stringify_in_c(LWSYNC) : : :"memory")
 #define smp_mb()        mb()
-#define smp_rmb()       __asm__ __volatile__ (stringify_in_c(LWSYNC) : : :"memory")
+#define smp_rmb()       __lwsync()
 #define smp_wmb()       __asm__ __volatile__ (stringify_in_c(SMPWMB) : : :"memory")
 #define smp_read_barrier_depends()      read_barrier_depends()
 #else
+#define __lwsync()      barrier()
 #define smp_mb()        barrier()
 #define smp_rmb()       barrier()
 #define smp_wmb()       barrier()
@@ -65,4 +69,19 @@
 #define data_barrier(x) \
        asm volatile("twi 0,%0,0; isync" : : "r" (x) : "memory");
+#define smp_store_release(p, v)                                         \
+do {                                                                    \
+        compiletime_assert_atomic_type(*p);                             \
+        __lwsync();                                                     \
+        ACCESS_ONCE(*p) = (v);                                          \
+} while (0)
+#define smp_load_acquire(p)                                             \
+({                                                                      \
+        typeof(*p) ___p1 = ACCESS_ONCE(*p);                             \
+        compiletime_assert_atomic_type(*p);                             \
+        __lwsync();                                                     \
+        ___p1;                                                          \
+})
 #endif /* _ASM_POWERPC_BARRIER_H */
diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h
index 894662a5d4d5..243ce69ad685 100644
--- a/arch/powerpc/include/asm/exception-64s.h
+++ b/arch/powerpc/include/asm/exception-64s.h
@@ -284,7 +284,7 @@ do_kvm_##n:								\
        subi    r1,r1,INT_FRAME_SIZE;   /* alloc frame on kernel stack  */ \
        beq-    1f;                                                        \
        ld      r1,PACAKSAVE(r13);      /* kernel stack to use          */ \
-1:      cmpdi   cr1,r1,0;               /* check if r1 is in userspace  */ \
+1:      cmpdi   cr1,r1,-INT_FRAME_SIZE; /* check if r1 is in userspace  */ \
        blt+    cr1,3f;                 /* abort if it is               */ \
        li      r1,(n);                 /* will be reloaded later       */ \
        sth     r1,PACA_TRAP_SAVE(r13);                                    \
diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h
index 703a8412dac2..11ba86e17631 100644
--- a/arch/powerpc/include/asm/setup.h
+++ b/arch/powerpc/include/asm/setup.h
@@ -26,6 +26,7 @@ extern void reloc_got2(unsigned long);
 void check_for_initrd(void);
 void do_init_bootmem(void);
 void setup_panic(void);
+#define ARCH_PANIC_TIMEOUT 180
 #endif /* !__ASSEMBLY__ */
diff --git a/arch/powerpc/include/asm/spinlock.h b/arch/powerpc/include/asm/spinlock.h
index 5f54a744dcc5..f6e78d63fb6a 100644
--- a/arch/powerpc/include/asm/spinlock.h
+++ b/arch/powerpc/include/asm/spinlock.h
@@ -28,6 +28,8 @@
 #include <asm/synch.h>
 #include <asm/ppc-opcode.h>
+#define smp_mb__after_unlock_lock()     smp_mb()  /* Full ordering for lock. */
 #define arch_spin_is_locked(x)          ((x)->slock != 0)
 #ifdef CONFIG_PPC64
diff --git a/arch/powerpc/include/asm/unaligned.h b/arch/powerpc/include/asm/unaligned.h
index 5f1b1e3c2137..8296381ae432 100644
--- a/arch/powerpc/include/asm/unaligned.h
+++ b/arch/powerpc/include/asm/unaligned.h
@@ -4,13 +4,18 @@
 #ifdef __KERNEL__
 /*
- * The PowerPC can do unaligned accesses itself in big endian mode.
+ * The PowerPC can do unaligned accesses itself based on its endian mode.
 */
 #include <linux/unaligned/access_ok.h>
 #include <linux/unaligned/generic.h>
+#ifdef __LITTLE_ENDIAN__
+#define get_unaligned   __get_unaligned_le
+#define put_unaligned   __put_unaligned_le
+#else
 #define get_unaligned   __get_unaligned_be
 #define put_unaligned   __put_unaligned_be
+#endif
 #endif  /* __KERNEL__ */
 #endif  /* _ASM_POWERPC_UNALIGNED_H */
diff --git a/arch/powerpc/include/asm/uprobes.h b/arch/powerpc/include/asm/uprobes.h
index 75c6ecdb8f37..7422a999a39a 100644
--- a/arch/powerpc/include/asm/uprobes.h
+++ b/arch/powerpc/include/asm/uprobes.h
@@ -36,9 +36,8 @@ typedef ppc_opcode_t uprobe_opcode_t;
 struct arch_uprobe {
        union {
-                u8      insn[MAX_UINSN_BYTES];
+                u32     insn;
-                u8      ixol[MAX_UINSN_BYTES];
+                u32     ixol;
-                u32     ainsn;
        };
 };
diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index 2ae41aba4053..4f0946de2d5c 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -80,6 +80,7 @@ END_FTR_SECTION(0, 1)
         * of the function that the cpu should jump to to continue
         * initialization.
         */
+        .balign 8
        .globl  __secondary_hold_spinloop
 __secondary_hold_spinloop:
        .llong  0x0
@@ -470,6 +471,7 @@ _STATIC(__after_prom_start)
        mtctr   r8
        bctr
+.balign 8
 p_end:  .llong  _end - _stext
 4:      /* Now copy the rest of the kernel up to _end */
diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c
index cb64a6e1dc51..078145acf7fb 100644
--- a/arch/powerpc/kernel/prom_init.c
+++ b/arch/powerpc/kernel/prom_init.c
@@ -1986,19 +1986,23 @@ static void __init prom_init_stdout(void)
        /* Get the full OF pathname of the stdout device */
        memset(path, 0, 256);
        call_prom("instance-to-path", 3, 1, prom.stdout, path, 255);
-        stdout_node = call_prom("instance-to-package", 1, 1, prom.stdout);
-        val = cpu_to_be32(stdout_node);
-        prom_setprop(prom.chosen, "/chosen", "linux,stdout-package",
-                     &val, sizeof(val));
        prom_printf("OF stdout device is: %s\n", of_stdout_device);
        prom_setprop(prom.chosen, "/chosen", "linux,stdout-path",
                     path, strlen(path) + 1);
-        /* If it's a display, note it */
+        /* instance-to-package fails on PA-Semi */
-        memset(type, 0, sizeof(type));
+        stdout_node = call_prom("instance-to-package", 1, 1, prom.stdout);
-        prom_getprop(stdout_node, "device_type", type, sizeof(type));
+        if (stdout_node != PROM_ERROR) {
-        if (strcmp(type, "display") == 0)
+                val = cpu_to_be32(stdout_node);
-                prom_setprop(stdout_node, path, "linux,boot-display", NULL, 0);
+                prom_setprop(prom.chosen, "/chosen", "linux,stdout-package",
+                             &val, sizeof(val));
+                /* If it's a display, note it */
+                memset(type, 0, sizeof(type));
+                prom_getprop(stdout_node, "device_type", type, sizeof(type));
+                if (strcmp(type, "display") == 0)
+                        prom_setprop(stdout_node, path, "linux,boot-display", NULL, 0);
+        }
 }
 static int __init prom_find_machine_type(void)
diff --git a/arch/powerpc/kernel/setup_32.c b/arch/powerpc/kernel/setup_32.c
index b903dc5cf944..2b0da27eaee4 100644
--- a/arch/powerpc/kernel/setup_32.c
+++ b/arch/powerpc/kernel/setup_32.c
@@ -296,9 +296,6 @@ void __init setup_arch(char **cmdline_p)
        if (cpu_has_feature(CPU_FTR_UNIFIED_ID_CACHE))
                ucache_bsize = icache_bsize = dcache_bsize;
-        /* reboot on panic */
-        panic_timeout = 180;
        if (ppc_md.panic)
                setup_panic();
diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c
index 4085aaa9478f..856dd4e99bfe 100644
--- a/arch/powerpc/kernel/setup_64.c
+++ b/arch/powerpc/kernel/setup_64.c
@@ -588,9 +588,6 @@ void __init setup_arch(char **cmdline_p)
        dcache_bsize = ppc64_caches.dline_size;
        icache_bsize = ppc64_caches.iline_size;
-        /* reboot on panic */
-        panic_timeout = 180;
        if (ppc_md.panic)
                setup_panic();
diff --git a/arch/powerpc/kernel/uprobes.c b/arch/powerpc/kernel/uprobes.c
index 59f419b935f2..003b20964ea0 100644
--- a/arch/powerpc/kernel/uprobes.c
+++ b/arch/powerpc/kernel/uprobes.c
@@ -186,7 +186,7 @@ bool arch_uprobe_skip_sstep(struct arch_uprobe *auprobe, struct pt_regs *regs)
         * emulate_step() returns 1 if the insn was successfully emulated.
         * For all other cases, we need to single-step in hardware.
         */
-        ret = emulate_step(regs, auprobe->ainsn);
+        ret = emulate_step(regs, auprobe->insn);
        if (ret > 0)
                return true;
diff --git a/arch/powerpc/lib/copyuser_64.S b/arch/powerpc/lib/copyuser_64.S
index d73a59014900..596a285c0755 100644
--- a/arch/powerpc/lib/copyuser_64.S
+++ b/arch/powerpc/lib/copyuser_64.S
@@ -9,6 +9,14 @@
 #include <asm/processor.h>
 #include <asm/ppc_asm.h>
+#ifdef __BIG_ENDIAN__
+#define sLd sld         /* Shift towards low-numbered address. */
+#define sHd srd         /* Shift towards high-numbered address. */
+#else
+#define sLd srd         /* Shift towards low-numbered address. */
+#define sHd sld         /* Shift towards high-numbered address. */
+#endif
        .align  7
 _GLOBAL(__copy_tofrom_user)
 BEGIN_FTR_SECTION
@@ -118,10 +126,10 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 24:     ld      r9,0(r4)        /* 3+2n loads, 2+2n stores */
 25:     ld      r0,8(r4)
-        sld     r6,r9,r10
+        sLd     r6,r9,r10
 26:     ldu     r9,16(r4)
-        srd     r7,r0,r11
+        sHd     r7,r0,r11
-        sld     r8,r0,r10
+        sLd     r8,r0,r10
        or      r7,r7,r6
        blt     cr6,79f
 27:     ld      r0,8(r4)
@@ -129,35 +137,35 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
 28:     ld      r0,0(r4)        /* 4+2n loads, 3+2n stores */
 29:     ldu     r9,8(r4)
-        sld     r8,r0,r10
+        sLd     r8,r0,r10
        addi    r3,r3,-8
        blt     cr6,5f
 30:     ld      r0,8(r4)
-        srd     r12,r9,r11
+        sHd     r12,r9,r11
-        sld     r6,r9,r10
+        sLd     r6,r9,r10
 31:     ldu     r9,16(r4)
        or      r12,r8,r12
-        srd     r7,r0,r11
+        sHd     r7,r0,r11
-        sld     r8,r0,r10
+        sLd     r8,r0,r10
        addi    r3,r3,16
        beq     cr6,78f
 1:      or      r7,r7,r6
 32:     ld      r0,8(r4)
 76:     std     r12,8(r3)
-2:      srd     r12,r9,r11
+2:      sHd     r12,r9,r11
-        sld     r6,r9,r10
+        sLd     r6,r9,r10
 33:     ldu     r9,16(r4)
        or      r12,r8,r12
 77:     stdu    r7,16(r3)
-        srd     r7,r0,r11
+        sHd     r7,r0,r11
-        sld     r8,r0,r10
+        sLd     r8,r0,r10
        bdnz    1b
 78:     std     r12,8(r3)
        or      r7,r7,r6
 79:     std     r7,16(r3)
-5:      srd     r12,r9,r11
+5:      sHd     r12,r9,r11
        or      r12,r8,r12
 80:     std     r12,24(r3)
        bne     6f
@@ -165,23 +173,38 @@ END_FTR_SECTION_IFCLR(CPU_FTR_UNALIGNED_LD_STD)
        blr
 6:      cmpwi   cr1,r5,8
        addi    r3,r3,32
-        sld     r9,r9,r10
+        sLd     r9,r9,r10
        ble     cr1,7f
 34:     ld      r0,8(r4)
-        srd     r7,r0,r11
+        sHd     r7,r0,r11
        or      r9,r7,r9
 7:
        bf      cr7*4+1,1f
+#ifdef __BIG_ENDIAN__
        rotldi  r9,r9,32
+#endif
 94:     stw     r9,0(r3)
+#ifdef __LITTLE_ENDIAN__
+        rotrdi  r9,r9,32
+#endif
        addi    r3,r3,4
 1:      bf      cr7*4+2,2f
+#ifdef __BIG_ENDIAN__
        rotldi  r9,r9,16
+#endif
 95:     sth     r9,0(r3)
+#ifdef __LITTLE_ENDIAN__
+        rotrdi  r9,r9,16
+#endif
        addi    r3,r3,2
 2:      bf      cr7*4+3,3f
+#ifdef __BIG_ENDIAN__
        rotldi  r9,r9,8
+#endif
 96:     stb     r9,0(r3)
+#ifdef __LITTLE_ENDIAN__
+        rotrdi  r9,r9,8
+#endif
 3:      li      r3,0
        blr
diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c
index ac3c2a10dafd..555034f8505e 100644
--- a/arch/powerpc/net/bpf_jit_comp.c
+++ b/arch/powerpc/net/bpf_jit_comp.c
@@ -223,10 +223,11 @@ static int bpf_jit_build_body(struct sk_filter *fp, u32 *image,
                        }
                        PPC_DIVWU(r_A, r_A, r_X);
                        break;
-                case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K); */
+                case BPF_S_ALU_DIV_K: /* A /= K */
+                        if (K == 1)
+                                break;
                        PPC_LI32(r_scratch1, K);
-                        /* Top 32 bits of 64bit result -> A */
+                        PPC_DIVWU(r_A, r_A, r_scratch1);
-                        PPC_MULHWU(r_A, r_A, r_scratch1);
                        break;
                case BPF_S_ALU_AND_X:
                        ctx->seen |= SEEN_XREG;
diff --git a/arch/powerpc/platforms/powernv/eeh-ioda.c b/arch/powerpc/platforms/powernv/eeh-ioda.c
index 02245cee7818..d7ddcee7feb8 100644
--- a/arch/powerpc/platforms/powernv/eeh-ioda.c
+++ b/arch/powerpc/platforms/powernv/eeh-ioda.c
@@ -36,7 +36,6 @@
 #include "powernv.h"
 #include "pci.h"
-static char *hub_diag = NULL;
 static int ioda_eeh_nb_init = 0;
 static int ioda_eeh_event(struct notifier_block *nb,
@@ -140,15 +139,6 @@ static int ioda_eeh_post_init(struct pci_controller *hose)
                ioda_eeh_nb_init = 1;
        }
-        /* We needn't HUB diag-data on PHB3 */
-        if (phb->type == PNV_PHB_IODA1 && !hub_diag) {
-                hub_diag = (char *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
-                if (!hub_diag) {
-                        pr_err("%s: Out of memory !\n", __func__);
-                        return -ENOMEM;
-                }
-        }
 #ifdef CONFIG_DEBUG_FS
        if (phb->dbgfs) {
                debugfs_create_file("err_injct_outbound", 0600,
@@ -633,11 +623,10 @@ static void ioda_eeh_hub_diag_common(struct OpalIoP7IOCErrorData *data)
 static void ioda_eeh_hub_diag(struct pci_controller *hose)
 {
        struct pnv_phb *phb = hose->private_data;
-        struct OpalIoP7IOCErrorData *data;
+        struct OpalIoP7IOCErrorData *data = &phb->diag.hub_diag;
        long rc;
-        data = (struct OpalIoP7IOCErrorData *)ioda_eeh_hub_diag;
+        rc = opal_pci_get_hub_diag_data(phb->hub_id, data, sizeof(*data));
-        rc = opal_pci_get_hub_diag_data(phb->hub_id, data, PAGE_SIZE);
        if (rc != OPAL_SUCCESS) {
                pr_warning("%s: Failed to get HUB#%llx diag-data (%ld)\n",
                           __func__, phb->hub_id, rc);
@@ -820,14 +809,15 @@ static void ioda_eeh_phb_diag(struct pci_controller *hose)
        struct OpalIoPhbErrorCommon *common;
        long rc;
-        common = (struct OpalIoPhbErrorCommon *)phb->diag.blob;
+        rc = opal_pci_get_phb_diag_data2(phb->opal_id, phb->diag.blob,
-        rc = opal_pci_get_phb_diag_data2(phb->opal_id, common, PAGE_SIZE);
+                                         PNV_PCI_DIAG_BUF_SIZE);
        if (rc != OPAL_SUCCESS) {
                pr_warning("%s: Failed to get diag-data for PHB#%x (%ld)\n",
                            __func__, hose->global_number, rc);
                return;
        }
+        common = (struct OpalIoPhbErrorCommon *)phb->diag.blob;
        switch (common->ioType) {
        case OPAL_PHB_ERROR_DATA_TYPE_P7IOC:
                ioda_eeh_p7ioc_phb_diag(hose, common);
diff --git a/arch/powerpc/platforms/powernv/pci.h b/arch/powerpc/platforms/powernv/pci.h
index 911c24ef033e..1ed8d5f40f5a 100644
--- a/arch/powerpc/platforms/powernv/pci.h
+++ b/arch/powerpc/platforms/powernv/pci.h
@@ -172,11 +172,13 @@ struct pnv_phb {
                } ioda;
        };
-        /* PHB status structure */
+        /* PHB and hub status structure */
        union {
                unsigned char                   blob[PNV_PCI_DIAG_BUF_SIZE];
                struct OpalIoP7IOCPhbErrorData  p7ioc;
+                struct OpalIoP7IOCErrorData     hub_diag;
        } diag;
 };
 extern struct pci_ops pnv_pci_ops;
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index c1f190858701..6f76ae417f47 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -470,7 +470,7 @@ static long pseries_little_endian_exceptions(void)
 static void __init pSeries_setup_arch(void)
 {
-        panic_timeout = 10;
+        set_arch_panic_timeout(10, ARCH_PANIC_TIMEOUT);
        /* Discover PIC type and setup ppc_md accordingly */
        pseries_discover_pic();
diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig
index 1e1a03d2d19f..e9f312532526 100644
--- a/arch/s390/Kconfig
+++ b/arch/s390/Kconfig
@@ -135,7 +135,6 @@ config S390
        select HAVE_SYSCALL_TRACEPOINTS
        select HAVE_UID16 if 32BIT
        select HAVE_VIRT_CPU_ACCOUNTING
-        select INIT_ALL_POSSIBLE
        select KTIME_SCALAR if 32BIT
        select MODULES_USE_ELF_RELA
        select OLD_SIGACTION
diff --git a/arch/s390/include/asm/barrier.h b/arch/s390/include/asm/barrier.h
index 16760eeb79b0..578680f6207a 100644
--- a/arch/s390/include/asm/barrier.h
+++ b/arch/s390/include/asm/barrier.h
@@ -32,4 +32,19 @@
 #define set_mb(var, value)              do { var = value; mb(); } while (0)
+#define smp_store_release(p, v)                                         \
+do {                                                                    \
+        compiletime_assert_atomic_type(*p);                             \
+        barrier();                                                      \
+        ACCESS_ONCE(*p) = (v);                                          \
+} while (0)
+#define smp_load_acquire(p)                                             \
+({                                                                      \
+        typeof(*p) ___p1 = ACCESS_ONCE(*p);                             \
+        compiletime_assert_atomic_type(*p);                             \
+        barrier();                                                      \
+        ___p1;                                                          \
+})
 #endif /* __ASM_BARRIER_H */
diff --git a/arch/s390/include/asm/compat.h b/arch/s390/include/asm/compat.h
index 4bf9da03591e..5d7e8cf83bd6 100644
--- a/arch/s390/include/asm/compat.h
+++ b/arch/s390/include/asm/compat.h
@@ -38,7 +38,8 @@
 #define PSW32_USER_BITS (PSW32_MASK_DAT | PSW32_MASK_IO | PSW32_MASK_EXT | \
                         PSW32_DEFAULT_KEY | PSW32_MASK_BASE | \
-                         PSW32_MASK_MCHECK | PSW32_MASK_PSTATE | PSW32_ASC_HOME)
+                         PSW32_MASK_MCHECK | PSW32_MASK_PSTATE | \
+                         PSW32_ASC_PRIMARY)
 #define COMPAT_USER_HZ          100
 #define COMPAT_UTS_MACHINE      "s390\0\0\0\0"
diff --git a/arch/s390/include/asm/cpu_mf.h b/arch/s390/include/asm/cpu_mf.h
index c879fad404c8..cb700d54bd83 100644
--- a/arch/s390/include/asm/cpu_mf.h
+++ b/arch/s390/include/asm/cpu_mf.h
@@ -56,6 +56,96 @@ struct cpumf_ctr_info {
        u32   reserved2[12];
 } __packed;
+/* QUERY SAMPLING INFORMATION block */
+struct hws_qsi_info_block {         /* Bit(s) */
+        unsigned int b0_13:14;      /* 0-13: zeros                       */
+        unsigned int as:1;          /* 14: basic-sampling authorization  */
+        unsigned int ad:1;          /* 15: diag-sampling authorization   */
+        unsigned int b16_21:6;      /* 16-21: zeros                      */
+        unsigned int es:1;          /* 22: basic-sampling enable control */
+        unsigned int ed:1;          /* 23: diag-sampling enable control  */
+        unsigned int b24_29:6;      /* 24-29: zeros                      */
+        unsigned int cs:1;          /* 30: basic-sampling activation control */
+        unsigned int cd:1;          /* 31: diag-sampling activation control */
+        unsigned int bsdes:16;      /* 4-5: size of basic sampling entry */
+        unsigned int dsdes:16;      /* 6-7: size of diagnostic sampling entry */
+        unsigned long min_sampl_rate; /* 8-15: minimum sampling interval */
+        unsigned long max_sampl_rate; /* 16-23: maximum sampling interval*/
+        unsigned long tear;         /* 24-31: TEAR contents              */
+        unsigned long dear;         /* 32-39: DEAR contents              */
+        unsigned int rsvrd0;        /* 40-43: reserved                   */
+        unsigned int cpu_speed;     /* 44-47: CPU speed                  */
+        unsigned long long rsvrd1;  /* 48-55: reserved                   */
+        unsigned long long rsvrd2;  /* 56-63: reserved                   */
+} __packed;
+/* SET SAMPLING CONTROLS request block */
+struct hws_lsctl_request_block {
+        unsigned int s:1;           /* 0: maximum buffer indicator       */
+        unsigned int h:1;           /* 1: part. level reserved for VM use*/
+        unsigned long long b2_53:52;/* 2-53: zeros                       */
+        unsigned int es:1;          /* 54: basic-sampling enable control */
+        unsigned int ed:1;          /* 55: diag-sampling enable control  */
+        unsigned int b56_61:6;      /* 56-61: - zeros                    */
+        unsigned int cs:1;          /* 62: basic-sampling activation control */
+        unsigned int cd:1;          /* 63: diag-sampling activation control  */
+        unsigned long interval;     /* 8-15: sampling interval           */
+        unsigned long tear;         /* 16-23: TEAR contents              */
+        unsigned long dear;         /* 24-31: DEAR contents              */
+        /* 32-63:                                                        */
+        unsigned long rsvrd1;       /* reserved                          */
+        unsigned long rsvrd2;       /* reserved                          */
+        unsigned long rsvrd3;       /* reserved                          */
+        unsigned long rsvrd4;       /* reserved                          */
+} __packed;
+struct hws_basic_entry {
+        unsigned int def:16;        /* 0-15  Data Entry Format           */
+        unsigned int R:4;           /* 16-19 reserved                    */
+        unsigned int U:4;           /* 20-23 Number of unique instruct.  */
+        unsigned int z:2;           /* zeros                             */
+        unsigned int T:1;           /* 26 PSW DAT mode                   */
+        unsigned int W:1;           /* 27 PSW wait state                 */
+        unsigned int P:1;           /* 28 PSW Problem state              */
+        unsigned int AS:2;          /* 29-30 PSW address-space control   */
+        unsigned int I:1;           /* 31 entry valid or invalid         */
+        unsigned int:16;
+        unsigned int prim_asn:16;   /* primary ASN                       */
+        unsigned long long ia;      /* Instruction Address               */
+        unsigned long long gpp;     /* Guest Program Parameter           */
+        unsigned long long hpp;     /* Host Program Parameter            */
+} __packed;
+struct hws_diag_entry {
+        unsigned int def:16;        /* 0-15  Data Entry Format           */
+        unsigned int R:14;          /* 16-19 and 20-30 reserved          */
+        unsigned int I:1;           /* 31 entry valid or invalid         */
+        u8           data[];        /* Machine-dependent sample data     */
+} __packed;
+struct hws_combined_entry {
+        struct hws_basic_entry  basic;  /* Basic-sampling data entry */
+        struct hws_diag_entry   diag;   /* Diagnostic-sampling data entry */
+} __packed;
+struct hws_trailer_entry {
+        union {
+                struct {
+                        unsigned int f:1;       /* 0 - Block Full Indicator   */
+                        unsigned int a:1;       /* 1 - Alert request control  */
+                        unsigned int t:1;       /* 2 - Timestamp format       */
+                        unsigned long long:61;  /* 3 - 63: Reserved           */
+                };
+                unsigned long long flags;       /* 0 - 63: All indicators     */
+        };
+        unsigned long long overflow;     /* 64 - sample Overflow count        */
+        unsigned char timestamp[16];     /* 16 - 31 timestamp                 */
+        unsigned long long reserved1;    /* 32 -Reserved                      */
+        unsigned long long reserved2;    /*                                   */
+        unsigned long long progusage1;   /* 48 - reserved for programming use */
+        unsigned long long progusage2;   /*                                   */
+} __packed;
 /* Query counter information */
 static inline int qctri(struct cpumf_ctr_info *info)
 {
@@ -99,4 +189,95 @@ static inline int ecctr(u64 ctr, u64 *val)
        return cc;
 }
+/* Query sampling information */
+static inline int qsi(struct hws_qsi_info_block *info)
+{
+        int cc;
+        cc = 1;
+        asm volatile(
+                "0:     .insn   s,0xb2860000,0(%1)\n"
+                "1:     lhi     %0,0\n"
+                "2:\n"
+                EX_TABLE(0b, 2b) EX_TABLE(1b, 2b)
+                : "=d" (cc), "+a" (info)
+                : "m" (*info)
+                : "cc", "memory");
+        return cc ? -EINVAL : 0;
+}
+/* Load sampling controls */
+static inline int lsctl(struct hws_lsctl_request_block *req)
+{
+        int cc;
+        cc = 1;
+        asm volatile(
+                "0:     .insn   s,0xb2870000,0(%1)\n"
+                "1:     ipm     %0\n"
+                "       srl     %0,28\n"
+                "2:\n"
+                EX_TABLE(0b, 2b) EX_TABLE(1b, 2b)
+                : "+d" (cc), "+a" (req)
+                : "m" (*req)
+                : "cc", "memory");
+        return cc ? -EINVAL : 0;
+}
+/* Sampling control helper functions */
+#include <linux/time.h>
+static inline unsigned long freq_to_sample_rate(struct hws_qsi_info_block *qsi,
+                                                unsigned long freq)
+{
+        return (USEC_PER_SEC / freq) * qsi->cpu_speed;
+}
+static inline unsigned long sample_rate_to_freq(struct hws_qsi_info_block *qsi,
+                                                unsigned long rate)
+{
+        return USEC_PER_SEC * qsi->cpu_speed / rate;
+}
+#define SDB_TE_ALERT_REQ_MASK   0x4000000000000000UL
+#define SDB_TE_BUFFER_FULL_MASK 0x8000000000000000UL
+/* Return TOD timestamp contained in an trailer entry */
+static inline unsigned long long trailer_timestamp(struct hws_trailer_entry *te)
+{
+        /* TOD in STCKE format */
+        if (te->t)
+                return *((unsigned long long *) &te->timestamp[1]);
+        /* TOD in STCK format */
+        return *((unsigned long long *) &te->timestamp[0]);
+}
+/* Return pointer to trailer entry of an sample data block */
+static inline unsigned long *trailer_entry_ptr(unsigned long v)
+{
+        void *ret;
+        ret = (void *) v;
+        ret += PAGE_SIZE;
+        ret -= sizeof(struct hws_trailer_entry);
+        return (unsigned long *) ret;
+}
+/* Return if the entry in the sample data block table (sdbt)
+ * is a link to the next sdbt */
+static inline int is_link_entry(unsigned long *s)
+{
+        return *s & 0x1ul ? 1 : 0;
+}
+/* Return pointer to the linked sdbt */
+static inline unsigned long *get_next_sdbt(unsigned long *s)
+{
+        return (unsigned long *) (*s & ~0x1ul);
+}
 #endif /* _ASM_S390_CPU_MF_H */
diff --git a/arch/s390/include/asm/css_chars.h b/arch/s390/include/asm/css_chars.h
index 7e1c917bbba2..09d1dd46bd57 100644
--- a/arch/s390/include/asm/css_chars.h
+++ b/arch/s390/include/asm/css_chars.h
@@ -29,6 +29,8 @@ struct css_general_char {
        u32 fcx : 1;     /* bit 88 */
        u32 : 19;
        u32 alt_ssi : 1; /* bit 108 */
+        u32:1;
+        u32 narf:1;      /* bit 110 */
 } __packed;
 extern struct css_general_char css_general_characteristics;
diff --git a/arch/s390/include/asm/pci.h b/arch/s390/include/asm/pci.h
index c129ab2ac731..2583466f576b 100644
--- a/arch/s390/include/asm/pci.h
+++ b/arch/s390/include/asm/pci.h
@@ -144,6 +144,7 @@ int clp_disable_fh(struct zpci_dev *);
 void zpci_event_error(void *);
 void zpci_event_availability(void *);
 void zpci_rescan(void);
+bool zpci_is_enabled(void);
 #else /* CONFIG_PCI */
 static inline void zpci_event_error(void *e) {}
 static inline void zpci_event_availability(void *e) {}
diff --git a/arch/s390/include/asm/perf_event.h b/arch/s390/include/asm/perf_event.h
index 1141fb3e7b21..159a8ec6da9a 100644
--- a/arch/s390/include/asm/perf_event.h
+++ b/arch/s390/include/asm/perf_event.h
@@ -1,21 +1,40 @@
 /*
 * Performance event support - s390 specific definitions.
 *
- * Copyright IBM Corp. 2009, 2012
+ * Copyright IBM Corp. 2009, 2013
 * Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>
 *            Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
 */
-#include <asm/cpu_mf.h>
+#ifndef _ASM_S390_PERF_EVENT_H
+#define _ASM_S390_PERF_EVENT_H
-/* CPU-measurement counter facility */
+#ifdef CONFIG_64BIT
-#define PERF_CPUM_CF_MAX_CTR            256
+#include <linux/perf_event.h>
+#include <linux/device.h>
+#include <asm/cpu_mf.h>
 /* Per-CPU flags for PMU states */
 #define PMU_F_RESERVED                  0x1000
 #define PMU_F_ENABLED                   0x2000
+#define PMU_F_IN_USE                    0x4000
+#define PMU_F_ERR_IBE                   0x0100
+#define PMU_F_ERR_LSDA                  0x0200
+#define PMU_F_ERR_MASK                  (PMU_F_ERR_IBE|PMU_F_ERR_LSDA)
+/* Perf defintions for PMU event attributes in sysfs */
+extern __init const struct attribute_group **cpumf_cf_event_group(void);
+extern ssize_t cpumf_events_sysfs_show(struct device *dev,
+                                       struct device_attribute *attr,
+                                       char *page);
+#define EVENT_VAR(_cat, _name)          event_attr_##_cat##_##_name
+#define EVENT_PTR(_cat, _name)          (&EVENT_VAR(_cat, _name).attr.attr)
+#define CPUMF_EVENT_ATTR(cat, name, id)                 \
+        PMU_EVENT_ATTR(name, EVENT_VAR(cat, name), id, cpumf_events_sysfs_show)
+#define CPUMF_EVENT_PTR(cat, name)      EVENT_PTR(cat, name)
-#ifdef CONFIG_64BIT
 /* Perf callbacks */
 struct pt_regs;
@@ -23,4 +42,55 @@ extern unsigned long perf_instruction_pointer(struct pt_regs *regs);
 extern unsigned long perf_misc_flags(struct pt_regs *regs);
 #define perf_misc_flags(regs) perf_misc_flags(regs)
+/* Perf pt_regs extension for sample-data-entry indicators */
+struct perf_sf_sde_regs {
+        unsigned char in_guest:1;         /* guest sample */
+        unsigned long reserved:63;        /* reserved */
+};
+/* Perf PMU definitions for the counter facility */
+#define PERF_CPUM_CF_MAX_CTR            256
+/* Perf PMU definitions for the sampling facility */
+#define PERF_CPUM_SF_MAX_CTR            2
+#define PERF_EVENT_CPUM_SF              0xB0000UL /* Event: Basic-sampling */
+#define PERF_EVENT_CPUM_SF_DIAG         0xBD000UL /* Event: Combined-sampling */
+#define PERF_CPUM_SF_BASIC_MODE         0x0001    /* Basic-sampling flag */
+#define PERF_CPUM_SF_DIAG_MODE          0x0002    /* Diagnostic-sampling flag */
+#define PERF_CPUM_SF_MODE_MASK          (PERF_CPUM_SF_BASIC_MODE| \
+                                         PERF_CPUM_SF_DIAG_MODE)
+#define PERF_CPUM_SF_FULL_BLOCKS        0x0004    /* Process full SDBs only */
+#define REG_NONE                0
+#define REG_OVERFLOW            1
+#define OVERFLOW_REG(hwc)       ((hwc)->extra_reg.config)
+#define SFB_ALLOC_REG(hwc)      ((hwc)->extra_reg.alloc)
+#define RAWSAMPLE_REG(hwc)      ((hwc)->config)
+#define TEAR_REG(hwc)           ((hwc)->last_tag)
+#define SAMPL_RATE(hwc)         ((hwc)->event_base)
+#define SAMPL_FLAGS(hwc)        ((hwc)->config_base)
+#define SAMPL_DIAG_MODE(hwc)    (SAMPL_FLAGS(hwc) & PERF_CPUM_SF_DIAG_MODE)
+#define SDB_FULL_BLOCKS(hwc)    (SAMPL_FLAGS(hwc) & PERF_CPUM_SF_FULL_BLOCKS)
+/* Structure for sampling data entries to be passed as perf raw sample data
+ * to user space.  Note that raw sample data must be aligned and, thus, might
+ * be padded with zeros.
+ */
+struct sf_raw_sample {
+#define SF_RAW_SAMPLE_BASIC     PERF_CPUM_SF_BASIC_MODE
+#define SF_RAW_SAMPLE_DIAG      PERF_CPUM_SF_DIAG_MODE
+        u64                     format;
+        u32                      size;    /* Size of sf_raw_sample */
+        u16                     bsdes;    /* Basic-sampling data entry size */
+        u16                     dsdes;    /* Diagnostic-sampling data entry size */
+        struct hws_basic_entry  basic;    /* Basic-sampling data entry */
+        struct hws_diag_entry    diag;    /* Diagnostic-sampling data entry */
+        u8                  padding[];    /* Padding to next multiple of 8 */
+} __packed;
+/* Perf hardware reserve and release functions */
+int perf_reserve_sampling(void);
+void perf_release_sampling(void);
 #endif /* CONFIG_64BIT */
+#endif /* _ASM_S390_PERF_EVENT_H */
diff --git a/arch/s390/include/asm/qdio.h b/arch/s390/include/asm/qdio.h
index 57d0d7e794b1..d786c634e052 100644
--- a/arch/s390/include/asm/qdio.h
+++ b/arch/s390/include/asm/qdio.h
@@ -336,7 +336,7 @@ typedef void qdio_handler_t(struct ccw_device *, unsigned int, int,
 #define QDIO_FLAG_CLEANUP_USING_HALT            0x02
 /**
- * struct qdio_initialize - qdio initalization data
+ * struct qdio_initialize - qdio initialization data
 * @cdev: associated ccw device
 * @q_format: queue format
 * @adapter_name: name for the adapter
@@ -378,6 +378,34 @@ struct qdio_initialize {
        struct qdio_outbuf_state *output_sbal_state_array;
 };
+/**
+ * enum qdio_brinfo_entry_type - type of address entry for qdio_brinfo_desc()
+ * @l3_ipv6_addr: entry contains IPv6 address
+ * @l3_ipv4_addr: entry contains IPv4 address
+ * @l2_addr_lnid: entry contains MAC address and VLAN ID
+ */
+enum qdio_brinfo_entry_type {l3_ipv6_addr, l3_ipv4_addr, l2_addr_lnid};
+/**
+ * struct qdio_brinfo_entry_XXX - Address entry for qdio_brinfo_desc()
+ * @nit:  Network interface token
+ * @addr: Address of one of the three types
+ *
+ * The struct is passed to the callback function by qdio_brinfo_desc()
+ */
+struct qdio_brinfo_entry_l3_ipv6 {
+        u64 nit;
+        struct { unsigned char _s6_addr[16]; } addr;
+} __packed;
+struct qdio_brinfo_entry_l3_ipv4 {
+        u64 nit;
+        struct { uint32_t _s_addr; } addr;
+} __packed;
+struct qdio_brinfo_entry_l2 {
+        u64 nit;
+        struct { u8 mac[6]; u16 lnid; } addr_lnid;
+} __packed;
 #define QDIO_STATE_INACTIVE             0x00000002 /* after qdio_cleanup */
 #define QDIO_STATE_ESTABLISHED          0x00000004 /* after qdio_establish */
 #define QDIO_STATE_ACTIVE               0x00000008 /* after qdio_activate */
@@ -399,5 +427,10 @@ extern int qdio_get_next_buffers(struct ccw_device *, int, int *, int *);
 extern int qdio_shutdown(struct ccw_device *, int);
 extern int qdio_free(struct ccw_device *);
 extern int qdio_get_ssqd_desc(struct ccw_device *, struct qdio_ssqd_desc *);
+extern int qdio_pnso_brinfo(struct subchannel_id schid,
+                int cnc, u16 *response,
+                void (*cb)(void *priv, enum qdio_brinfo_entry_type type,
+                                void *entry),
+                void *priv);
 #endif /* __QDIO_H__ */
diff --git a/arch/s390/include/asm/sclp.h b/arch/s390/include/asm/sclp.h
index 2f390956c7c1..220e171413f8 100644
--- a/arch/s390/include/asm/sclp.h
+++ b/arch/s390/include/asm/sclp.h
@@ -52,8 +52,8 @@ int sclp_chp_configure(struct chp_id chpid);
 int sclp_chp_deconfigure(struct chp_id chpid);
 int sclp_chp_read_info(struct sclp_chp_info *info);
 void sclp_get_ipl_info(struct sclp_ipl_info *info);
-bool sclp_has_linemode(void);
+bool __init sclp_has_linemode(void);
-bool sclp_has_vt220(void);
+bool __init sclp_has_vt220(void);
 int sclp_pci_configure(u32 fid);
 int sclp_pci_deconfigure(u32 fid);
 int memcpy_hsa(void *dest, unsigned long src, size_t count, int mode);
diff --git a/arch/s390/include/asm/smp.h b/arch/s390/include/asm/smp.h
index ac9bed8e103f..160779394096 100644
--- a/arch/s390/include/asm/smp.h
+++ b/arch/s390/include/asm/smp.h
@@ -31,6 +31,7 @@ extern void smp_yield(void);
 extern void smp_stop_cpu(void);
 extern void smp_cpu_set_polarization(int cpu, int val);
 extern int smp_cpu_get_polarization(int cpu);
+extern void smp_fill_possible_mask(void);
 #else /* CONFIG_SMP */
@@ -50,6 +51,7 @@ static inline int smp_vcpu_scheduled(int cpu) { return 1; }
 static inline void smp_yield_cpu(int cpu) { }
 static inline void smp_yield(void) { }
 static inline void smp_stop_cpu(void) { }
+static inline void smp_fill_possible_mask(void) { }
 #endif /* CONFIG_SMP */
diff --git a/arch/s390/include/uapi/asm/zcrypt.h b/arch/s390/include/uapi/asm/zcrypt.h
index e83fc116f5bf..f2b18eacaca8 100644
--- a/arch/s390/include/uapi/asm/zcrypt.h
+++ b/arch/s390/include/uapi/asm/zcrypt.h
@@ -154,6 +154,67 @@ struct ica_xcRB {
        unsigned short  priority_window;
        unsigned int    status;
 } __attribute__((packed));
+/**
+ * struct ep11_cprb - EP11 connectivity programming request block
+ * @cprb_len:           CPRB header length [0x0020]
+ * @cprb_ver_id:        CPRB version id.   [0x04]
+ * @pad_000:            Alignment pad bytes
+ * @flags:              Admin cmd [0x80] or functional cmd [0x00]
+ * @func_id:            Function id / subtype [0x5434]
+ * @source_id:          Source id [originator id]
+ * @target_id:          Target id [usage/ctrl domain id]
+ * @ret_code:           Return code
+ * @reserved1:          Reserved
+ * @reserved2:          Reserved
+ * @payload_len:        Payload length
+ */
+struct ep11_cprb {
+        uint16_t        cprb_len;
+        unsigned char   cprb_ver_id;
+        unsigned char   pad_000[2];
+        unsigned char   flags;
+        unsigned char   func_id[2];
+        uint32_t        source_id;
+        uint32_t        target_id;
+        uint32_t        ret_code;
+        uint32_t        reserved1;
+        uint32_t        reserved2;
+        uint32_t        payload_len;
+} __attribute__((packed));
+/**
+ * struct ep11_target_dev - EP11 target device list
+ * @ap_id:      AP device id
+ * @dom_id:     Usage domain id
+ */
+struct ep11_target_dev {
+        uint16_t ap_id;
+        uint16_t dom_id;
+};
+/**
+ * struct ep11_urb - EP11 user request block
+ * @targets_num:        Number of target adapters
+ * @targets:            Addr to target adapter list
+ * @weight:             Level of request priority
+ * @req_no:             Request id/number
+ * @req_len:            Request length
+ * @req:                Addr to request block
+ * @resp_len:           Response length
+ * @resp:               Addr to response block
+ */
+struct ep11_urb {
+        uint16_t                targets_num;
+        uint64_t                targets;
+        uint64_t                weight;
+        uint64_t                req_no;
+        uint64_t                req_len;
+        uint64_t                req;
+        uint64_t                resp_len;
+        uint64_t                resp;
+} __attribute__((packed));
 #define AUTOSELECT ((unsigned int)0xFFFFFFFF)
 #define ZCRYPT_IOCTL_MAGIC 'z'
@@ -183,6 +244,9 @@ struct ica_xcRB {
 *   ZSECSENDCPRB
 *     Send an arbitrary CPRB to a crypto card.
 *
+ *   ZSENDEP11CPRB
+ *     Send an arbitrary EP11 CPRB to an EP11 coprocessor crypto card.
+ *
 *   Z90STAT_STATUS_MASK
 *     Return an 64 element array of unsigned chars for the status of
 *     all devices.
@@ -256,6 +320,7 @@ struct ica_xcRB {
 #define ICARSAMODEXPO   _IOC(_IOC_READ|_IOC_WRITE, ZCRYPT_IOCTL_MAGIC, 0x05, 0)
 #define ICARSACRT       _IOC(_IOC_READ|_IOC_WRITE, ZCRYPT_IOCTL_MAGIC, 0x06, 0)
 #define ZSECSENDCPRB    _IOC(_IOC_READ|_IOC_WRITE, ZCRYPT_IOCTL_MAGIC, 0x81, 0)
+#define ZSENDEP11CPRB   _IOC(_IOC_READ|_IOC_WRITE, ZCRYPT_IOCTL_MAGIC, 0x04, 0)
 /* New status calls */
 #define Z90STAT_TOTALCOUNT      _IOR(ZCRYPT_IOCTL_MAGIC, 0x40, int)
diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile
index 2403303cfed7..1b3ac09c11b6 100644
--- a/arch/s390/kernel/Makefile
+++ b/arch/s390/kernel/Makefile
@@ -60,7 +60,8 @@ obj-$(CONFIG_FTRACE_SYSCALLS)  += ftrace.o
 obj-$(CONFIG_CRASH_DUMP)        += crash_dump.o
 ifdef CONFIG_64BIT
-obj-$(CONFIG_PERF_EVENTS)       += perf_event.o perf_cpum_cf.o
+obj-$(CONFIG_PERF_EVENTS)       += perf_event.o perf_cpum_cf.o perf_cpum_sf.o \
+                                                perf_cpum_cf_events.o
 obj-y                           += runtime_instr.o cache.o
 endif
diff --git a/arch/s390/kernel/compat_signal.c b/arch/s390/kernel/compat_signal.c
index 95e7ba0fbb7e..8b84bc373e94 100644
--- a/arch/s390/kernel/compat_signal.c
+++ b/arch/s390/kernel/compat_signal.c
@@ -412,8 +412,9 @@ static int setup_rt_frame32(int sig, struct k_sigaction *ka, siginfo_t *info,
                regs->gprs[14] = (__u64 __force) ka->sa.sa_restorer | PSW32_ADDR_AMODE;
        } else {
                regs->gprs[14] = (__u64 __force) frame->retcode | PSW32_ADDR_AMODE;
-                err |= __put_user(S390_SYSCALL_OPCODE | __NR_rt_sigreturn,
+                if (__put_user(S390_SYSCALL_OPCODE | __NR_rt_sigreturn,
-                                  (u16 __force __user *)(frame->retcode));
+                               (u16 __force __user *)(frame->retcode)))
+                        goto give_sigsegv;
        }
        /* Set up backchain. */
diff --git a/arch/s390/kernel/entry64.S b/arch/s390/kernel/entry64.S
index e5b43c97a834..384e609b4711 100644
--- a/arch/s390/kernel/entry64.S
+++ b/arch/s390/kernel/entry64.S
@@ -74,7 +74,7 @@ _TIF_TRACE    = (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SECCOMP | \
        .endm
        .macro LPP newpp
-#if defined(CONFIG_KVM) || defined(CONFIG_KVM_MODULE)
+#if IS_ENABLED(CONFIG_KVM)
        tm      __LC_MACHINE_FLAGS+6,0x20       # MACHINE_FLAG_LPP
        jz      .+8
        .insn   s,0xb2800000,\newpp
@@ -82,7 +82,7 @@ _TIF_TRACE    = (_TIF_SYSCALL_TRACE | _TIF_SYSCALL_AUDIT | _TIF_SECCOMP | \
        .endm
        .macro  HANDLE_SIE_INTERCEPT scratch,reason
-#if defined(CONFIG_KVM) || defined(CONFIG_KVM_MODULE)
+#if IS_ENABLED(CONFIG_KVM)
        tmhh    %r8,0x0001              # interrupting from user ?
        jnz     .+62
        lgr     \scratch,%r9
@@ -946,7 +946,7 @@ cleanup_idle_insn:
        .quad   __critical_end - __critical_start
-#if defined(CONFIG_KVM) || defined(CONFIG_KVM_MODULE)
+#if IS_ENABLED(CONFIG_KVM)
 /*
 * sie64a calling convention:
 * %r2 pointer to sie control block
@@ -975,7 +975,7 @@ sie_done:
        lctlg   %c1,%c1,__LC_USER_ASCE          # load primary asce
 # some program checks are suppressing. C code (e.g. do_protection_exception)
 # will rewind the PSW by the ILC, which is 4 bytes in case of SIE. Other
-# instructions beween sie64a and sie_done should not cause program
+# instructions between sie64a and sie_done should not cause program
 # interrupts. So lets use a nop (47 00 00 00) as a landing pad.
 # See also HANDLE_SIE_INTERCEPT
 rewind_pad:
diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
index 1105502bf6e9..f51214c04858 100644
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -680,6 +680,7 @@ static int __init cpumf_pmu_init(void)
                goto out;
        }
+        cpumf_pmu.attr_groups = cpumf_cf_event_group();
        rc = perf_pmu_register(&cpumf_pmu, "cpum_cf", PERF_TYPE_RAW);
        if (rc) {
                pr_err("Registering the cpum_cf PMU failed with rc=%i\n", rc);
diff --git a/arch/s390/kernel/perf_cpum_cf_events.c b/arch/s390/kernel/perf_cpum_cf_events.c
new file mode 100644
index 000000000000..4554a4bae39e
--- /dev/null
+++ b/arch/s390/kernel/perf_cpum_cf_events.c
@@ -0,0 +1,322 @@
+/*
+ * Perf PMU sysfs events attributes for available CPU-measurement counters
+ *
+ */
+#include <linux/slab.h>
+#include <linux/perf_event.h>
+/* BEGIN: CPUM_CF COUNTER DEFINITIONS =================================== */
+CPUMF_EVENT_ATTR(cf, CPU_CYCLES, 0x0000);
+CPUMF_EVENT_ATTR(cf, INSTRUCTIONS, 0x0001);
+CPUMF_EVENT_ATTR(cf, L1I_DIR_WRITES, 0x0002);
+CPUMF_EVENT_ATTR(cf, L1I_PENALTY_CYCLES, 0x0003);
+CPUMF_EVENT_ATTR(cf, PROBLEM_STATE_CPU_CYCLES, 0x0020);
+CPUMF_EVENT_ATTR(cf, PROBLEM_STATE_INSTRUCTIONS, 0x0021);
+CPUMF_EVENT_ATTR(cf, PROBLEM_STATE_L1I_DIR_WRITES, 0x0022);
+CPUMF_EVENT_ATTR(cf, PROBLEM_STATE_L1I_PENALTY_CYCLES, 0x0023);
+CPUMF_EVENT_ATTR(cf, PROBLEM_STATE_L1D_DIR_WRITES, 0x0024);
+CPUMF_EVENT_ATTR(cf, PROBLEM_STATE_L1D_PENALTY_CYCLES, 0x0025);
+CPUMF_EVENT_ATTR(cf, L1D_DIR_WRITES, 0x0004);
+CPUMF_EVENT_ATTR(cf, L1D_PENALTY_CYCLES, 0x0005);
+CPUMF_EVENT_ATTR(cf, PRNG_FUNCTIONS, 0x0040);
+CPUMF_EVENT_ATTR(cf, PRNG_CYCLES, 0x0041);
+CPUMF_EVENT_ATTR(cf, PRNG_BLOCKED_FUNCTIONS, 0x0042);
+CPUMF_EVENT_ATTR(cf, PRNG_BLOCKED_CYCLES, 0x0043);
+CPUMF_EVENT_ATTR(cf, SHA_FUNCTIONS, 0x0044);
+CPUMF_EVENT_ATTR(cf, SHA_CYCLES, 0x0045);
+CPUMF_EVENT_ATTR(cf, SHA_BLOCKED_FUNCTIONS, 0x0046);
+CPUMF_EVENT_ATTR(cf, SHA_BLOCKED_CYCLES, 0x0047);
+CPUMF_EVENT_ATTR(cf, DEA_FUNCTIONS, 0x0048);
+CPUMF_EVENT_ATTR(cf, DEA_CYCLES, 0x0049);
+CPUMF_EVENT_ATTR(cf, DEA_BLOCKED_FUNCTIONS, 0x004a);
+CPUMF_EVENT_ATTR(cf, DEA_BLOCKED_CYCLES, 0x004b);
+CPUMF_EVENT_ATTR(cf, AES_FUNCTIONS, 0x004c);
+CPUMF_EVENT_ATTR(cf, AES_CYCLES, 0x004d);
+CPUMF_EVENT_ATTR(cf, AES_BLOCKED_FUNCTIONS, 0x004e);
+CPUMF_EVENT_ATTR(cf, AES_BLOCKED_CYCLES, 0x004f);
+CPUMF_EVENT_ATTR(cf_z10, L1I_L2_SOURCED_WRITES, 0x0080);
+CPUMF_EVENT_ATTR(cf_z10, L1D_L2_SOURCED_WRITES, 0x0081);
+CPUMF_EVENT_ATTR(cf_z10, L1I_L3_LOCAL_WRITES, 0x0082);
+CPUMF_EVENT_ATTR(cf_z10, L1D_L3_LOCAL_WRITES, 0x0083);
+CPUMF_EVENT_ATTR(cf_z10, L1I_L3_REMOTE_WRITES, 0x0084);
+CPUMF_EVENT_ATTR(cf_z10, L1D_L3_REMOTE_WRITES, 0x0085);
+CPUMF_EVENT_ATTR(cf_z10, L1D_LMEM_SOURCED_WRITES, 0x0086);
+CPUMF_EVENT_ATTR(cf_z10, L1I_LMEM_SOURCED_WRITES, 0x0087);
+CPUMF_EVENT_ATTR(cf_z10, L1D_RO_EXCL_WRITES, 0x0088);
+CPUMF_EVENT_ATTR(cf_z10, L1I_CACHELINE_INVALIDATES, 0x0089);
+CPUMF_EVENT_ATTR(cf_z10, ITLB1_WRITES, 0x008a);
+CPUMF_EVENT_ATTR(cf_z10, DTLB1_WRITES, 0x008b);
+CPUMF_EVENT_ATTR(cf_z10, TLB2_PTE_WRITES, 0x008c);
+CPUMF_EVENT_ATTR(cf_z10, TLB2_CRSTE_WRITES, 0x008d);
+CPUMF_EVENT_ATTR(cf_z10, TLB2_CRSTE_HPAGE_WRITES, 0x008e);
+CPUMF_EVENT_ATTR(cf_z10, ITLB1_MISSES, 0x0091);
+CPUMF_EVENT_ATTR(cf_z10, DTLB1_MISSES, 0x0092);
+CPUMF_EVENT_ATTR(cf_z10, L2C_STORES_SENT, 0x0093);
+CPUMF_EVENT_ATTR(cf_z196, L1D_L2_SOURCED_WRITES, 0x0080);
+CPUMF_EVENT_ATTR(cf_z196, L1I_L2_SOURCED_WRITES, 0x0081);
+CPUMF_EVENT_ATTR(cf_z196, DTLB1_MISSES, 0x0082);
+CPUMF_EVENT_ATTR(cf_z196, ITLB1_MISSES, 0x0083);
+CPUMF_EVENT_ATTR(cf_z196, L2C_STORES_SENT, 0x0085);
+CPUMF_EVENT_ATTR(cf_z196, L1D_OFFBOOK_L3_SOURCED_WRITES, 0x0086);
+CPUMF_EVENT_ATTR(cf_z196, L1D_ONBOOK_L4_SOURCED_WRITES, 0x0087);
+CPUMF_EVENT_ATTR(cf_z196, L1I_ONBOOK_L4_SOURCED_WRITES, 0x0088);
+CPUMF_EVENT_ATTR(cf_z196, L1D_RO_EXCL_WRITES, 0x0089);
+CPUMF_EVENT_ATTR(cf_z196, L1D_OFFBOOK_L4_SOURCED_WRITES, 0x008a);
+CPUMF_EVENT_ATTR(cf_z196, L1I_OFFBOOK_L4_SOURCED_WRITES, 0x008b);
+CPUMF_EVENT_ATTR(cf_z196, DTLB1_HPAGE_WRITES, 0x008c);
+CPUMF_EVENT_ATTR(cf_z196, L1D_LMEM_SOURCED_WRITES, 0x008d);
+CPUMF_EVENT_ATTR(cf_z196, L1I_LMEM_SOURCED_WRITES, 0x008e);
+CPUMF_EVENT_ATTR(cf_z196, L1I_OFFBOOK_L3_SOURCED_WRITES, 0x008f);
+CPUMF_EVENT_ATTR(cf_z196, DTLB1_WRITES, 0x0090);
+CPUMF_EVENT_ATTR(cf_z196, ITLB1_WRITES, 0x0091);
+CPUMF_EVENT_ATTR(cf_z196, TLB2_PTE_WRITES, 0x0092);
+CPUMF_EVENT_ATTR(cf_z196, TLB2_CRSTE_HPAGE_WRITES, 0x0093);
+CPUMF_EVENT_ATTR(cf_z196, TLB2_CRSTE_WRITES, 0x0094);
+CPUMF_EVENT_ATTR(cf_z196, L1D_ONCHIP_L3_SOURCED_WRITES, 0x0096);
+CPUMF_EVENT_ATTR(cf_z196, L1D_OFFCHIP_L3_SOURCED_WRITES, 0x0098);
+CPUMF_EVENT_ATTR(cf_z196, L1I_ONCHIP_L3_SOURCED_WRITES, 0x0099);
+CPUMF_EVENT_ATTR(cf_z196, L1I_OFFCHIP_L3_SOURCED_WRITES, 0x009b);
+CPUMF_EVENT_ATTR(cf_zec12, DTLB1_MISSES, 0x0080);
+CPUMF_EVENT_ATTR(cf_zec12, ITLB1_MISSES, 0x0081);
+CPUMF_EVENT_ATTR(cf_zec12, L1D_L2I_SOURCED_WRITES, 0x0082);
+CPUMF_EVENT_ATTR(cf_zec12, L1I_L2I_SOURCED_WRITES, 0x0083);
+CPUMF_EVENT_ATTR(cf_zec12, L1D_L2D_SOURCED_WRITES, 0x0084);
+CPUMF_EVENT_ATTR(cf_zec12, DTLB1_WRITES, 0x0085);
+CPUMF_EVENT_ATTR(cf_zec12, L1D_LMEM_SOURCED_WRITES, 0x0087);
+CPUMF_EVENT_ATTR(cf_zec12, L1I_LMEM_SOURCED_WRITES, 0x0089);
+CPUMF_EVENT_ATTR(cf_zec12, L1D_RO_EXCL_WRITES, 0x008a);
+CPUMF_EVENT_ATTR(cf_zec12, DTLB1_HPAGE_WRITES, 0x008b);
+CPUMF_EVENT_ATTR(cf_zec12, ITLB1_WRITES, 0x008c);
+CPUMF_EVENT_ATTR(cf_zec12, TLB2_PTE_WRITES, 0x008d);
+CPUMF_EVENT_ATTR(cf_zec12, TLB2_CRSTE_HPAGE_WRITES, 0x008e);
+CPUMF_EVENT_ATTR(cf_zec12, TLB2_CRSTE_WRITES, 0x008f);
+CPUMF_EVENT_ATTR(cf_zec12, L1D_ONCHIP_L3_SOURCED_WRITES, 0x0090);
+CPUMF_EVENT_ATTR(cf_zec12, L1D_OFFCHIP_L3_SOURCED_WRITES, 0x0091);
+CPUMF_EVENT_ATTR(cf_zec12, L1D_OFFBOOK_L3_SOURCED_WRITES, 0x0092);
+CPUMF_EVENT_ATTR(cf_zec12, L1D_ONBOOK_L4_SOURCED_WRITES, 0x0093);
+CPUMF_EVENT_ATTR(cf_zec12, L1D_OFFBOOK_L4_SOURCED_WRITES, 0x0094);
+CPUMF_EVENT_ATTR(cf_zec12, TX_NC_TEND, 0x0095);
+CPUMF_EVENT_ATTR(cf_zec12, L1D_ONCHIP_L3_SOURCED_WRITES_IV, 0x0096);
+CPUMF_EVENT_ATTR(cf_zec12, L1D_OFFCHIP_L3_SOURCED_WRITES_IV, 0x0097);
+CPUMF_EVENT_ATTR(cf_zec12, L1D_OFFBOOK_L3_SOURCED_WRITES_IV, 0x0098);
+CPUMF_EVENT_ATTR(cf_zec12, L1I_ONCHIP_L3_SOURCED_WRITES, 0x0099);
+CPUMF_EVENT_ATTR(cf_zec12, L1I_OFFCHIP_L3_SOURCED_WRITES, 0x009a);
+CPUMF_EVENT_ATTR(cf_zec12, L1I_OFFBOOK_L3_SOURCED_WRITES, 0x009b);
+CPUMF_EVENT_ATTR(cf_zec12, L1I_ONBOOK_L4_SOURCED_WRITES, 0x009c);
+CPUMF_EVENT_ATTR(cf_zec12, L1I_OFFBOOK_L4_SOURCED_WRITES, 0x009d);
+CPUMF_EVENT_ATTR(cf_zec12, TX_C_TEND, 0x009e);
+CPUMF_EVENT_ATTR(cf_zec12, L1I_ONCHIP_L3_SOURCED_WRITES_IV, 0x009f);
+CPUMF_EVENT_ATTR(cf_zec12, L1I_OFFCHIP_L3_SOURCED_WRITES_IV, 0x00a0);
+CPUMF_EVENT_ATTR(cf_zec12, L1I_OFFBOOK_L3_SOURCED_WRITES_IV, 0x00a1);
+CPUMF_EVENT_ATTR(cf_zec12, TX_NC_TABORT, 0x00b1);
+CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_NO_SPECIAL, 0x00b2);
+CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_SPECIAL, 0x00b3);
+static struct attribute *cpumcf_pmu_event_attr[] = {
+        CPUMF_EVENT_PTR(cf, CPU_CYCLES),
+        CPUMF_EVENT_PTR(cf, INSTRUCTIONS),
+        CPUMF_EVENT_PTR(cf, L1I_DIR_WRITES),
+        CPUMF_EVENT_PTR(cf, L1I_PENALTY_CYCLES),
+        CPUMF_EVENT_PTR(cf, PROBLEM_STATE_CPU_CYCLES),
+        CPUMF_EVENT_PTR(cf, PROBLEM_STATE_INSTRUCTIONS),
+        CPUMF_EVENT_PTR(cf, PROBLEM_STATE_L1I_DIR_WRITES),
+        CPUMF_EVENT_PTR(cf, PROBLEM_STATE_L1I_PENALTY_CYCLES),
+        CPUMF_EVENT_PTR(cf, PROBLEM_STATE_L1D_DIR_WRITES),
+        CPUMF_EVENT_PTR(cf, PROBLEM_STATE_L1D_PENALTY_CYCLES),
+        CPUMF_EVENT_PTR(cf, L1D_DIR_WRITES),
+        CPUMF_EVENT_PTR(cf, L1D_PENALTY_CYCLES),
+        CPUMF_EVENT_PTR(cf, PRNG_FUNCTIONS),
+        CPUMF_EVENT_PTR(cf, PRNG_CYCLES),
+        CPUMF_EVENT_PTR(cf, PRNG_BLOCKED_FUNCTIONS),
+        CPUMF_EVENT_PTR(cf, PRNG_BLOCKED_CYCLES),
+        CPUMF_EVENT_PTR(cf, SHA_FUNCTIONS),
+        CPUMF_EVENT_PTR(cf, SHA_CYCLES),
+        CPUMF_EVENT_PTR(cf, SHA_BLOCKED_FUNCTIONS),
+        CPUMF_EVENT_PTR(cf, SHA_BLOCKED_CYCLES),
+        CPUMF_EVENT_PTR(cf, DEA_FUNCTIONS),
+        CPUMF_EVENT_PTR(cf, DEA_CYCLES),
+        CPUMF_EVENT_PTR(cf, DEA_BLOCKED_FUNCTIONS),
+        CPUMF_EVENT_PTR(cf, DEA_BLOCKED_CYCLES),
+        CPUMF_EVENT_PTR(cf, AES_FUNCTIONS),
+        CPUMF_EVENT_PTR(cf, AES_CYCLES),
+        CPUMF_EVENT_PTR(cf, AES_BLOCKED_FUNCTIONS),
+        CPUMF_EVENT_PTR(cf, AES_BLOCKED_CYCLES),
+        NULL,
+};
+static struct attribute *cpumcf_z10_pmu_event_attr[] __initdata = {
+        CPUMF_EVENT_PTR(cf_z10, L1I_L2_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, L1D_L2_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, L1I_L3_LOCAL_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, L1D_L3_LOCAL_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, L1I_L3_REMOTE_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, L1D_L3_REMOTE_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, L1D_LMEM_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, L1I_LMEM_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, L1D_RO_EXCL_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, L1I_CACHELINE_INVALIDATES),
+        CPUMF_EVENT_PTR(cf_z10, ITLB1_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, DTLB1_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, TLB2_PTE_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, TLB2_CRSTE_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, TLB2_CRSTE_HPAGE_WRITES),
+        CPUMF_EVENT_PTR(cf_z10, ITLB1_MISSES),
+        CPUMF_EVENT_PTR(cf_z10, DTLB1_MISSES),
+        CPUMF_EVENT_PTR(cf_z10, L2C_STORES_SENT),
+        NULL,
+};
+static struct attribute *cpumcf_z196_pmu_event_attr[] __initdata = {
+        CPUMF_EVENT_PTR(cf_z196, L1D_L2_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, L1I_L2_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, DTLB1_MISSES),
+        CPUMF_EVENT_PTR(cf_z196, ITLB1_MISSES),
+        CPUMF_EVENT_PTR(cf_z196, L2C_STORES_SENT),
+        CPUMF_EVENT_PTR(cf_z196, L1D_OFFBOOK_L3_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, L1D_ONBOOK_L4_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, L1I_ONBOOK_L4_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, L1D_RO_EXCL_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, L1D_OFFBOOK_L4_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, L1I_OFFBOOK_L4_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, DTLB1_HPAGE_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, L1D_LMEM_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, L1I_LMEM_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, L1I_OFFBOOK_L3_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, DTLB1_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, ITLB1_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, TLB2_PTE_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, TLB2_CRSTE_HPAGE_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, TLB2_CRSTE_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, L1D_ONCHIP_L3_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, L1D_OFFCHIP_L3_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, L1I_ONCHIP_L3_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_z196, L1I_OFFCHIP_L3_SOURCED_WRITES),
+        NULL,
+};
+static struct attribute *cpumcf_zec12_pmu_event_attr[] __initdata = {
+        CPUMF_EVENT_PTR(cf_zec12, DTLB1_MISSES),
+        CPUMF_EVENT_PTR(cf_zec12, ITLB1_MISSES),
+        CPUMF_EVENT_PTR(cf_zec12, L1D_L2I_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1I_L2I_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1D_L2D_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, DTLB1_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1D_LMEM_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1I_LMEM_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1D_RO_EXCL_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, DTLB1_HPAGE_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, ITLB1_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, TLB2_PTE_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, TLB2_CRSTE_HPAGE_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, TLB2_CRSTE_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1D_ONCHIP_L3_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1D_OFFCHIP_L3_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1D_OFFBOOK_L3_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1D_ONBOOK_L4_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1D_OFFBOOK_L4_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, TX_NC_TEND),
+        CPUMF_EVENT_PTR(cf_zec12, L1D_ONCHIP_L3_SOURCED_WRITES_IV),
+        CPUMF_EVENT_PTR(cf_zec12, L1D_OFFCHIP_L3_SOURCED_WRITES_IV),
+        CPUMF_EVENT_PTR(cf_zec12, L1D_OFFBOOK_L3_SOURCED_WRITES_IV),
+        CPUMF_EVENT_PTR(cf_zec12, L1I_ONCHIP_L3_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1I_OFFCHIP_L3_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1I_OFFBOOK_L3_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1I_ONBOOK_L4_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, L1I_OFFBOOK_L4_SOURCED_WRITES),
+        CPUMF_EVENT_PTR(cf_zec12, TX_C_TEND),
+        CPUMF_EVENT_PTR(cf_zec12, L1I_ONCHIP_L3_SOURCED_WRITES_IV),
+        CPUMF_EVENT_PTR(cf_zec12, L1I_OFFCHIP_L3_SOURCED_WRITES_IV),
+        CPUMF_EVENT_PTR(cf_zec12, L1I_OFFBOOK_L3_SOURCED_WRITES_IV),
+        CPUMF_EVENT_PTR(cf_zec12, TX_NC_TABORT),
+        CPUMF_EVENT_PTR(cf_zec12, TX_C_TABORT_NO_SPECIAL),
+        CPUMF_EVENT_PTR(cf_zec12, TX_C_TABORT_SPECIAL),
+        NULL,
+};
+/* END: CPUM_CF COUNTER DEFINITIONS ===================================== */
+static struct attribute_group cpumsf_pmu_events_group = {
+        .name = "events",
+        .attrs = cpumcf_pmu_event_attr,
+};
+PMU_FORMAT_ATTR(event, "config:0-63");
+static struct attribute *cpumsf_pmu_format_attr[] = {
+        &format_attr_event.attr,
+        NULL,
+};
+static struct attribute_group cpumsf_pmu_format_group = {
+        .name = "format",
+        .attrs = cpumsf_pmu_format_attr,
+};
+static const struct attribute_group *cpumsf_pmu_attr_groups[] = {
+        &cpumsf_pmu_events_group,
+        &cpumsf_pmu_format_group,
+        NULL,
+};
+static __init struct attribute **merge_attr(struct attribute **a,
+                                            struct attribute **b)
+{
+        struct attribute **new;
+        int j, i;
+        for (j = 0; a[j]; j++)
+                ;
+        for (i = 0; b[i]; i++)
+                j++;
+        j++;
+        new = kmalloc(sizeof(struct attribute *) * j, GFP_KERNEL);
+        if (!new)
+                return NULL;
+        j = 0;
+        for (i = 0; a[i]; i++)
+                new[j++] = a[i];
+        for (i = 0; b[i]; i++)
+                new[j++] = b[i];
+        new[j] = NULL;
+        return new;
+}
+__init const struct attribute_group **cpumf_cf_event_group(void)
+{
+        struct attribute **combined, **model;
+        struct cpuid cpu_id;
+        get_cpu_id(&cpu_id);
+        switch (cpu_id.machine) {
+        case 0x2097:
+        case 0x2098:
+                model = cpumcf_z10_pmu_event_attr;
+                break;
+        case 0x2817:
+        case 0x2818:
+                model = cpumcf_z196_pmu_event_attr;
+                break;
+        case 0x2827:
+        case 0x2828:
+                model = cpumcf_zec12_pmu_event_attr;
+                break;
+        default:
+                model = NULL;
+                break;
+        };
+        if (!model)
+                goto out;
+        combined = merge_attr(cpumcf_pmu_event_attr, model);
+        if (combined)
+                cpumsf_pmu_events_group.attrs = combined;
+out:
+        return cpumsf_pmu_attr_groups;
+}
diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c
new file mode 100644
index 000000000000..6c0d29827cb6
--- /dev/null
+++ b/arch/s390/kernel/perf_cpum_sf.c
@@ -0,0 +1,1641 @@
+/*
+ * Performance event support for the System z CPU-measurement Sampling Facility
+ *
+ * Copyright IBM Corp. 2013
+ * Author(s): Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (version 2 only)
+ * as published by the Free Software Foundation.
+ */
+#define KMSG_COMPONENT  "cpum_sf"
+#define pr_fmt(fmt)     KMSG_COMPONENT ": " fmt
+#include <linux/kernel.h>
+#include <linux/kernel_stat.h>
+#include <linux/perf_event.h>
+#include <linux/percpu.h>
+#include <linux/notifier.h>
+#include <linux/export.h>
+#include <linux/slab.h>
+#include <linux/mm.h>
+#include <linux/moduleparam.h>
+#include <asm/cpu_mf.h>
+#include <asm/irq.h>
+#include <asm/debug.h>
+#include <asm/timex.h>
+/* Minimum number of sample-data-block-tables:
+ * At least one table is required for the sampling buffer structure.
+ * A single table contains up to 511 pointers to sample-data-blocks.
+ */
+#define CPUM_SF_MIN_SDBT        1
+/* Number of sample-data-blocks per sample-data-block-table (SDBT):
+ * A table contains SDB pointers (8 bytes) and one table-link entry
+ * that points to the origin of the next SDBT.
+ */
+#define CPUM_SF_SDB_PER_TABLE   ((PAGE_SIZE - 8) / 8)
+/* Maximum page offset for an SDBT table-link entry:
+ * If this page offset is reached, a table-link entry to the next SDBT
+ * must be added.
+ */
+#define CPUM_SF_SDBT_TL_OFFSET  (CPUM_SF_SDB_PER_TABLE * 8)
+static inline int require_table_link(const void *sdbt)
+{
+        return ((unsigned long) sdbt & ~PAGE_MASK) == CPUM_SF_SDBT_TL_OFFSET;
+}
+/* Minimum and maximum sampling buffer sizes:
+ *
+ * This number represents the maximum size of the sampling buffer taking
+ * the number of sample-data-block-tables into account.  Note that these
+ * numbers apply to the basic-sampling function only.
+ * The maximum number of SDBs is increased by CPUM_SF_SDB_DIAG_FACTOR if
+ * the diagnostic-sampling function is active.
+ *
+ * Sampling buffer size         Buffer characteristics
+ * ---------------------------------------------------
+ *       64KB               ==    16 pages (4KB per page)
+ *                                 1 page  for SDB-tables
+ *                                15 pages for SDBs
+ *
+ *  32MB                    ==  8192 pages (4KB per page)
+ *                                16 pages for SDB-tables
+ *                              8176 pages for SDBs
+ */
+static unsigned long __read_mostly CPUM_SF_MIN_SDB = 15;
+static unsigned long __read_mostly CPUM_SF_MAX_SDB = 8176;
+static unsigned long __read_mostly CPUM_SF_SDB_DIAG_FACTOR = 1;
+struct sf_buffer {
+        unsigned long    *sdbt;     /* Sample-data-block-table origin */
+        /* buffer characteristics (required for buffer increments) */
+        unsigned long  num_sdb;     /* Number of sample-data-blocks */
+        unsigned long num_sdbt;     /* Number of sample-data-block-tables */
+        unsigned long    *tail;     /* last sample-data-block-table */
+};
+struct cpu_hw_sf {
+        /* CPU-measurement sampling information block */
+        struct hws_qsi_info_block qsi;
+        /* CPU-measurement sampling control block */
+        struct hws_lsctl_request_block lsctl;
+        struct sf_buffer sfb;       /* Sampling buffer */
+        unsigned int flags;         /* Status flags */
+        struct perf_event *event;   /* Scheduled perf event */
+};
+static DEFINE_PER_CPU(struct cpu_hw_sf, cpu_hw_sf);
+/* Debug feature */
+static debug_info_t *sfdbg;
+/*
+ * sf_disable() - Switch off sampling facility
+ */
+static int sf_disable(void)
+{
+        struct hws_lsctl_request_block sreq;
+        memset(&sreq, 0, sizeof(sreq));
+        return lsctl(&sreq);
+}
+/*
+ * sf_buffer_available() - Check for an allocated sampling buffer
+ */
+static int sf_buffer_available(struct cpu_hw_sf *cpuhw)
+{
+        return !!cpuhw->sfb.sdbt;
+}
+/*
+ * deallocate sampling facility buffer
+ */
+static void free_sampling_buffer(struct sf_buffer *sfb)
+{
+        unsigned long *sdbt, *curr;
+        if (!sfb->sdbt)
+                return;
+        sdbt = sfb->sdbt;
+        curr = sdbt;
+        /* Free the SDBT after all SDBs are processed... */
+        while (1) {
+                if (!*curr || !sdbt)
+                        break;
+                /* Process table-link entries */
+                if (is_link_entry(curr)) {
+                        curr = get_next_sdbt(curr);
+                        if (sdbt)
+                                free_page((unsigned long) sdbt);
+                        /* If the origin is reached, sampling buffer is freed */
+                        if (curr == sfb->sdbt)
+                                break;
+                        else
+                                sdbt = curr;
+                } else {
+                        /* Process SDB pointer */
+                        if (*curr) {
+                                free_page(*curr);
+                                curr++;
+                        }
+                }
+        }
+        debug_sprintf_event(sfdbg, 5,
+                            "free_sampling_buffer: freed sdbt=%p\n", sfb->sdbt);
+        memset(sfb, 0, sizeof(*sfb));
+}
+static int alloc_sample_data_block(unsigned long *sdbt, gfp_t gfp_flags)
+{
+        unsigned long sdb, *trailer;
+        /* Allocate and initialize sample-data-block */
+        sdb = get_zeroed_page(gfp_flags);
+        if (!sdb)
+                return -ENOMEM;
+        trailer = trailer_entry_ptr(sdb);
+        *trailer = SDB_TE_ALERT_REQ_MASK;
+        /* Link SDB into the sample-data-block-table */
+        *sdbt = sdb;
+        return 0;
+}
+/*
+ * realloc_sampling_buffer() - extend sampler memory
+ *
+ * Allocates new sample-data-blocks and adds them to the specified sampling
+ * buffer memory.
+ *
+ * Important: This modifies the sampling buffer and must be called when the
+ *            sampling facility is disabled.
+ *
+ * Returns zero on success, non-zero otherwise.
+ */
+static int realloc_sampling_buffer(struct sf_buffer *sfb,
+                                   unsigned long num_sdb, gfp_t gfp_flags)
+{
+        int i, rc;
+        unsigned long *new, *tail;
+        if (!sfb->sdbt || !sfb->tail)
+                return -EINVAL;
+        if (!is_link_entry(sfb->tail))
+                return -EINVAL;
+        /* Append to the existing sampling buffer, overwriting the table-link
+         * register.
+         * The tail variables always points to the "tail" (last and table-link)
+         * entry in an SDB-table.
+         */
+        tail = sfb->tail;
+        /* Do a sanity check whether the table-link entry points to
+         * the sampling buffer origin.
+         */
+        if (sfb->sdbt != get_next_sdbt(tail)) {
+                debug_sprintf_event(sfdbg, 3, "realloc_sampling_buffer: "
+                                    "sampling buffer is not linked: origin=%p"
+                                    "tail=%p\n",
+                                    (void *) sfb->sdbt, (void *) tail);
+                return -EINVAL;
+        }
+        /* Allocate remaining SDBs */
+        rc = 0;
+        for (i = 0; i < num_sdb; i++) {
+                /* Allocate a new SDB-table if it is full. */
+                if (require_table_link(tail)) {
+                        new = (unsigned long *) get_zeroed_page(gfp_flags);
+                        if (!new) {
+                                rc = -ENOMEM;
+                                break;
+                        }
+                        sfb->num_sdbt++;
+                        /* Link current page to tail of chain */
+                        *tail = (unsigned long)(void *) new + 1;
+                        tail = new;
+                }
+                /* Allocate a new sample-data-block.
+                 * If there is not enough memory, stop the realloc process
+                 * and simply use what was allocated.  If this is a temporary
+                 * issue, a new realloc call (if required) might succeed.
+                 */
+                rc = alloc_sample_data_block(tail, gfp_flags);
+                if (rc)
+                        break;
+                sfb->num_sdb++;
+                tail++;
+        }
+        /* Link sampling buffer to its origin */
+        *tail = (unsigned long) sfb->sdbt + 1;
+        sfb->tail = tail;
+        debug_sprintf_event(sfdbg, 4, "realloc_sampling_buffer: new buffer"
+                            " settings: sdbt=%lu sdb=%lu\n",
+                            sfb->num_sdbt, sfb->num_sdb);
+        return rc;
+}
+/*
+ * allocate_sampling_buffer() - allocate sampler memory
+ *
+ * Allocates and initializes a sampling buffer structure using the
+ * specified number of sample-data-blocks (SDB).  For each allocation,
+ * a 4K page is used.  The number of sample-data-block-tables (SDBT)
+ * are calculated from SDBs.
+ * Also set the ALERT_REQ mask in each SDBs trailer.
+ *
+ * Returns zero on success, non-zero otherwise.
+ */
+static int alloc_sampling_buffer(struct sf_buffer *sfb, unsigned long num_sdb)
+{
+        int rc;
+        if (sfb->sdbt)
+                return -EINVAL;
+        /* Allocate the sample-data-block-table origin */
+        sfb->sdbt = (unsigned long *) get_zeroed_page(GFP_KERNEL);
+        if (!sfb->sdbt)
+                return -ENOMEM;
+        sfb->num_sdb = 0;
+        sfb->num_sdbt = 1;
+        /* Link the table origin to point to itself to prepare for
+         * realloc_sampling_buffer() invocation.
+         */
+        sfb->tail = sfb->sdbt;
+        *sfb->tail = (unsigned long)(void *) sfb->sdbt + 1;
+        /* Allocate requested number of sample-data-blocks */
+        rc = realloc_sampling_buffer(sfb, num_sdb, GFP_KERNEL);
+        if (rc) {
+                free_sampling_buffer(sfb);
+                debug_sprintf_event(sfdbg, 4, "alloc_sampling_buffer: "
+                        "realloc_sampling_buffer failed with rc=%i\n", rc);
+        } else
+                debug_sprintf_event(sfdbg, 4,
+                        "alloc_sampling_buffer: tear=%p dear=%p\n",
+                        sfb->sdbt, (void *) *sfb->sdbt);
+        return rc;
+}
+static void sfb_set_limits(unsigned long min, unsigned long max)
+{
+        struct hws_qsi_info_block si;
+        CPUM_SF_MIN_SDB = min;
+        CPUM_SF_MAX_SDB = max;
+        memset(&si, 0, sizeof(si));
+        if (!qsi(&si))
+                CPUM_SF_SDB_DIAG_FACTOR = DIV_ROUND_UP(si.dsdes, si.bsdes);
+}
+static unsigned long sfb_max_limit(struct hw_perf_event *hwc)
+{
+        return SAMPL_DIAG_MODE(hwc) ? CPUM_SF_MAX_SDB * CPUM_SF_SDB_DIAG_FACTOR
+                                    : CPUM_SF_MAX_SDB;
+}
+static unsigned long sfb_pending_allocs(struct sf_buffer *sfb,
+                                        struct hw_perf_event *hwc)
+{
+        if (!sfb->sdbt)
+                return SFB_ALLOC_REG(hwc);
+        if (SFB_ALLOC_REG(hwc) > sfb->num_sdb)
+                return SFB_ALLOC_REG(hwc) - sfb->num_sdb;
+        return 0;
+}
+static int sfb_has_pending_allocs(struct sf_buffer *sfb,
+                                   struct hw_perf_event *hwc)
+{
+        return sfb_pending_allocs(sfb, hwc) > 0;
+}
+static void sfb_account_allocs(unsigned long num, struct hw_perf_event *hwc)
+{
+        /* Limit the number of SDBs to not exceed the maximum */
+        num = min_t(unsigned long, num, sfb_max_limit(hwc) - SFB_ALLOC_REG(hwc));
+        if (num)
+                SFB_ALLOC_REG(hwc) += num;
+}
+static void sfb_init_allocs(unsigned long num, struct hw_perf_event *hwc)
+{
+        SFB_ALLOC_REG(hwc) = 0;
+        sfb_account_allocs(num, hwc);
+}
+static size_t event_sample_size(struct hw_perf_event *hwc)
+{
+        struct sf_raw_sample *sfr = (struct sf_raw_sample *) RAWSAMPLE_REG(hwc);
+        size_t sample_size;
+        /* The sample size depends on the sampling function: The basic-sampling
+         * function must be always enabled, diagnostic-sampling function is
+         * optional.
+         */
+        sample_size = sfr->bsdes;
+        if (SAMPL_DIAG_MODE(hwc))
+                sample_size += sfr->dsdes;
+        return sample_size;
+}
+static void deallocate_buffers(struct cpu_hw_sf *cpuhw)
+{
+        if (cpuhw->sfb.sdbt)
+                free_sampling_buffer(&cpuhw->sfb);
+}
+static int allocate_buffers(struct cpu_hw_sf *cpuhw, struct hw_perf_event *hwc)
+{
+        unsigned long n_sdb, freq, factor;
+        size_t sfr_size, sample_size;
+        struct sf_raw_sample *sfr;
+        /* Allocate raw sample buffer
+         *
+         *    The raw sample buffer is used to temporarily store sampling data
+         *    entries for perf raw sample processing.  The buffer size mainly
+         *    depends on the size of diagnostic-sampling data entries which is
+         *    machine-specific.  The exact size calculation includes:
+         *      1. The first 4 bytes of diagnostic-sampling data entries are
+         *         already reflected in the sf_raw_sample structure.  Subtract
+         *         these bytes.
+         *      2. The perf raw sample data must be 8-byte aligned (u64) and
+         *         perf's internal data size must be considered too.  So add
+         *         an additional u32 for correct alignment and subtract before
+         *         allocating the buffer.
+         *      3. Store the raw sample buffer pointer in the perf event
+         *         hardware structure.
+         */
+        sfr_size = ALIGN((sizeof(*sfr) - sizeof(sfr->diag) + cpuhw->qsi.dsdes) +
+                         sizeof(u32), sizeof(u64));
+        sfr_size -= sizeof(u32);
+        sfr = kzalloc(sfr_size, GFP_KERNEL);
+        if (!sfr)
+                return -ENOMEM;
+        sfr->size = sfr_size;
+        sfr->bsdes = cpuhw->qsi.bsdes;
+        sfr->dsdes = cpuhw->qsi.dsdes;
+        RAWSAMPLE_REG(hwc) = (unsigned long) sfr;
+        /* Calculate sampling buffers using 4K pages
+         *
+         *    1. Determine the sample data size which depends on the used
+         *       sampling functions, for example, basic-sampling or
+         *       basic-sampling with diagnostic-sampling.
+         *
+         *    2. Use the sampling frequency as input.  The sampling buffer is
+         *       designed for almost one second.  This can be adjusted through
+         *       the "factor" variable.
+         *       In any case, alloc_sampling_buffer() sets the Alert Request
+         *       Control indicator to trigger a measurement-alert to harvest
+         *       sample-data-blocks (sdb).
+         *
+         *    3. Compute the number of sample-data-blocks and ensure a minimum
+         *       of CPUM_SF_MIN_SDB.  Also ensure the upper limit does not
+         *       exceed a "calculated" maximum.  The symbolic maximum is
+         *       designed for basic-sampling only and needs to be increased if
+         *       diagnostic-sampling is active.
+         *       See also the remarks for these symbolic constants.
+         *
+         *    4. Compute the number of sample-data-block-tables (SDBT) and
+         *       ensure a minimum of CPUM_SF_MIN_SDBT (one table can manage up
+         *       to 511 SDBs).
+         */
+        sample_size = event_sample_size(hwc);
+        freq = sample_rate_to_freq(&cpuhw->qsi, SAMPL_RATE(hwc));
+        factor = 1;
+        n_sdb = DIV_ROUND_UP(freq, factor * ((PAGE_SIZE-64) / sample_size));
+        if (n_sdb < CPUM_SF_MIN_SDB)
+                n_sdb = CPUM_SF_MIN_SDB;
+        /* If there is already a sampling buffer allocated, it is very likely
+         * that the sampling facility is enabled too.  If the event to be
+         * initialized requires a greater sampling buffer, the allocation must
+         * be postponed.  Changing the sampling buffer requires the sampling
+         * facility to be in the disabled state.  So, account the number of
+         * required SDBs and let cpumsf_pmu_enable() resize the buffer just
+         * before the event is started.
+         */
+        sfb_init_allocs(n_sdb, hwc);
+        if (sf_buffer_available(cpuhw))
+                return 0;
+        debug_sprintf_event(sfdbg, 3,
+                            "allocate_buffers: rate=%lu f=%lu sdb=%lu/%lu"
+                            " sample_size=%lu cpuhw=%p\n",
+                            SAMPL_RATE(hwc), freq, n_sdb, sfb_max_limit(hwc),
+                            sample_size, cpuhw);
+        return alloc_sampling_buffer(&cpuhw->sfb,
+                                     sfb_pending_allocs(&cpuhw->sfb, hwc));
+}
+static unsigned long min_percent(unsigned int percent, unsigned long base,
+                                 unsigned long min)
+{
+        return min_t(unsigned long, min, DIV_ROUND_UP(percent * base, 100));
+}
+static unsigned long compute_sfb_extent(unsigned long ratio, unsigned long base)
+{
+        /* Use a percentage-based approach to extend the sampling facility
+         * buffer.  Accept up to 5% sample data loss.
+         * Vary the extents between 1% to 5% of the current number of
+         * sample-data-blocks.
+         */
+        if (ratio <= 5)
+                return 0;
+        if (ratio <= 25)
+                return min_percent(1, base, 1);
+        if (ratio <= 50)
+                return min_percent(1, base, 1);
+        if (ratio <= 75)
+                return min_percent(2, base, 2);
+        if (ratio <= 100)
+                return min_percent(3, base, 3);
+        if (ratio <= 250)
+                return min_percent(4, base, 4);
+        return min_percent(5, base, 8);
+}
+static void sfb_account_overflows(struct cpu_hw_sf *cpuhw,
+                                  struct hw_perf_event *hwc)
+{
+        unsigned long ratio, num;
+        if (!OVERFLOW_REG(hwc))
+                return;
+        /* The sample_overflow contains the average number of sample data
+         * that has been lost because sample-data-blocks were full.
+         *
+         * Calculate the total number of sample data entries that has been
+         * discarded.  Then calculate the ratio of lost samples to total samples
+         * per second in percent.
+         */
+        ratio = DIV_ROUND_UP(100 * OVERFLOW_REG(hwc) * cpuhw->sfb.num_sdb,
+                             sample_rate_to_freq(&cpuhw->qsi, SAMPL_RATE(hwc)));
+        /* Compute number of sample-data-blocks */
+        num = compute_sfb_extent(ratio, cpuhw->sfb.num_sdb);
+        if (num)
+                sfb_account_allocs(num, hwc);
+        debug_sprintf_event(sfdbg, 5, "sfb: overflow: overflow=%llu ratio=%lu"
+                            " num=%lu\n", OVERFLOW_REG(hwc), ratio, num);
+        OVERFLOW_REG(hwc) = 0;
+}
+/* extend_sampling_buffer() - Extend sampling buffer
+ * @sfb:        Sampling buffer structure (for local CPU)
+ * @hwc:        Perf event hardware structure
+ *
+ * Use this function to extend the sampling buffer based on the overflow counter
+ * and postponed allocation extents stored in the specified Perf event hardware.
+ *
+ * Important: This function disables the sampling facility in order to safely
+ *            change the sampling buffer structure.  Do not call this function
+ *            when the PMU is active.
+ */
+static void extend_sampling_buffer(struct sf_buffer *sfb,
+                                   struct hw_perf_event *hwc)
+{
+        unsigned long num, num_old;
+        int rc;
+        num = sfb_pending_allocs(sfb, hwc);
+        if (!num)
+                return;
+        num_old = sfb->num_sdb;
+        /* Disable the sampling facility to reset any states and also
+         * clear pending measurement alerts.
+         */
+        sf_disable();
+        /* Extend the sampling buffer.
+         * This memory allocation typically happens in an atomic context when
+         * called by perf.  Because this is a reallocation, it is fine if the
+         * new SDB-request cannot be satisfied immediately.
+         */
+        rc = realloc_sampling_buffer(sfb, num, GFP_ATOMIC);
+        if (rc)
+                debug_sprintf_event(sfdbg, 5, "sfb: extend: realloc "
+                                    "failed with rc=%i\n", rc);
+        if (sfb_has_pending_allocs(sfb, hwc))
+                debug_sprintf_event(sfdbg, 5, "sfb: extend: "
+                                    "req=%lu alloc=%lu remaining=%lu\n",
+                                    num, sfb->num_sdb - num_old,
+                                    sfb_pending_allocs(sfb, hwc));
+}
+/* Number of perf events counting hardware events */
+static atomic_t num_events;
+/* Used to avoid races in calling reserve/release_cpumf_hardware */
+static DEFINE_MUTEX(pmc_reserve_mutex);
+#define PMC_INIT      0
+#define PMC_RELEASE   1
+#define PMC_FAILURE   2
+static void setup_pmc_cpu(void *flags)
+{
+        int err;
+        struct cpu_hw_sf *cpusf = &__get_cpu_var(cpu_hw_sf);
+        err = 0;
+        switch (*((int *) flags)) {
+        case PMC_INIT:
+                memset(cpusf, 0, sizeof(*cpusf));
+                err = qsi(&cpusf->qsi);
+                if (err)
+                        break;
+                cpusf->flags |= PMU_F_RESERVED;
+                err = sf_disable();
+                if (err)
+                        pr_err("Switching off the sampling facility failed "
+                               "with rc=%i\n", err);
+                debug_sprintf_event(sfdbg, 5,
+                                    "setup_pmc_cpu: initialized: cpuhw=%p\n", cpusf);
+                break;
+        case PMC_RELEASE:
+                cpusf->flags &= ~PMU_F_RESERVED;
+                err = sf_disable();
+                if (err) {
+                        pr_err("Switching off the sampling facility failed "
+                               "with rc=%i\n", err);
+                } else
+                        deallocate_buffers(cpusf);
+                debug_sprintf_event(sfdbg, 5,
+                                    "setup_pmc_cpu: released: cpuhw=%p\n", cpusf);
+                break;
+        }
+        if (err)
+                *((int *) flags) |= PMC_FAILURE;
+}
+static void release_pmc_hardware(void)
+{
+        int flags = PMC_RELEASE;
+        irq_subclass_unregister(IRQ_SUBCLASS_MEASUREMENT_ALERT);
+        on_each_cpu(setup_pmc_cpu, &flags, 1);
+        perf_release_sampling();
+}
+static int reserve_pmc_hardware(void)
+{
+        int flags = PMC_INIT;
+        int err;
+        err = perf_reserve_sampling();
+        if (err)
+                return err;
+        on_each_cpu(setup_pmc_cpu, &flags, 1);
+        if (flags & PMC_FAILURE) {
+                release_pmc_hardware();
+                return -ENODEV;
+        }
+        irq_subclass_register(IRQ_SUBCLASS_MEASUREMENT_ALERT);
+        return 0;
+}
+static void hw_perf_event_destroy(struct perf_event *event)
+{
+        /* Free raw sample buffer */
+        if (RAWSAMPLE_REG(&event->hw))
+                kfree((void *) RAWSAMPLE_REG(&event->hw));
+        /* Release PMC if this is the last perf event */
+        if (!atomic_add_unless(&num_events, -1, 1)) {
+                mutex_lock(&pmc_reserve_mutex);
+                if (atomic_dec_return(&num_events) == 0)
+                        release_pmc_hardware();
+                mutex_unlock(&pmc_reserve_mutex);
+        }
+}
+static void hw_init_period(struct hw_perf_event *hwc, u64 period)
+{
+        hwc->sample_period = period;
+        hwc->last_period = hwc->sample_period;
+        local64_set(&hwc->period_left, hwc->sample_period);
+}
+static void hw_reset_registers(struct hw_perf_event *hwc,
+                               unsigned long *sdbt_origin)
+{
+        struct sf_raw_sample *sfr;
+        /* (Re)set to first sample-data-block-table */
+        TEAR_REG(hwc) = (unsigned long) sdbt_origin;
+        /* (Re)set raw sampling buffer register */
+        sfr = (struct sf_raw_sample *) RAWSAMPLE_REG(hwc);
+        memset(&sfr->basic, 0, sizeof(sfr->basic));
+        memset(&sfr->diag, 0, sfr->dsdes);
+}
+static unsigned long hw_limit_rate(const struct hws_qsi_info_block *si,
+                                   unsigned long rate)
+{
+        return clamp_t(unsigned long, rate,
+                       si->min_sampl_rate, si->max_sampl_rate);
+}
+static int __hw_perf_event_init(struct perf_event *event)
+{
+        struct cpu_hw_sf *cpuhw;
+        struct hws_qsi_info_block si;
+        struct perf_event_attr *attr = &event->attr;
+        struct hw_perf_event *hwc = &event->hw;
+        unsigned long rate;
+        int cpu, err;
+        /* Reserve CPU-measurement sampling facility */
+        err = 0;
+        if (!atomic_inc_not_zero(&num_events)) {
+                mutex_lock(&pmc_reserve_mutex);
+                if (atomic_read(&num_events) == 0 && reserve_pmc_hardware())
+                        err = -EBUSY;
+                else
+                        atomic_inc(&num_events);
+                mutex_unlock(&pmc_reserve_mutex);
+        }
+        event->destroy = hw_perf_event_destroy;
+        if (err)
+                goto out;
+        /* Access per-CPU sampling information (query sampling info) */
+        /*
+         * The event->cpu value can be -1 to count on every CPU, for example,
+         * when attaching to a task.  If this is specified, use the query
+         * sampling info from the current CPU, otherwise use event->cpu to
+         * retrieve the per-CPU information.
+         * Later, cpuhw indicates whether to allocate sampling buffers for a
+         * particular CPU (cpuhw!=NULL) or each online CPU (cpuw==NULL).
+         */
+        memset(&si, 0, sizeof(si));
+        cpuhw = NULL;
+        if (event->cpu == -1)
+                qsi(&si);
+        else {
+                /* Event is pinned to a particular CPU, retrieve the per-CPU
+                 * sampling structure for accessing the CPU-specific QSI.
+                 */
+                cpuhw = &per_cpu(cpu_hw_sf, event->cpu);
+                si = cpuhw->qsi;
+        }
+        /* Check sampling facility authorization and, if not authorized,
+         * fall back to other PMUs.  It is safe to check any CPU because
+         * the authorization is identical for all configured CPUs.
+         */
+        if (!si.as) {
+                err = -ENOENT;
+                goto out;
+        }
+        /* Always enable basic sampling */
+        SAMPL_FLAGS(hwc) = PERF_CPUM_SF_BASIC_MODE;
+        /* Check if diagnostic sampling is requested.  Deny if the required
+         * sampling authorization is missing.
+         */
+        if (attr->config == PERF_EVENT_CPUM_SF_DIAG) {
+                if (!si.ad) {
+                        err = -EPERM;
+                        goto out;
+                }
+                SAMPL_FLAGS(hwc) |= PERF_CPUM_SF_DIAG_MODE;
+        }
+        /* Check and set other sampling flags */
+        if (attr->config1 & PERF_CPUM_SF_FULL_BLOCKS)
+                SAMPL_FLAGS(hwc) |= PERF_CPUM_SF_FULL_BLOCKS;
+        /* The sampling information (si) contains information about the
+         * min/max sampling intervals and the CPU speed.  So calculate the
+         * correct sampling interval and avoid the whole period adjust
+         * feedback loop.
+         */
+        rate = 0;
+        if (attr->freq) {
+                rate = freq_to_sample_rate(&si, attr->sample_freq);
+                rate = hw_limit_rate(&si, rate);
+                attr->freq = 0;
+                attr->sample_period = rate;
+        } else {
+                /* The min/max sampling rates specifies the valid range
+                 * of sample periods.  If the specified sample period is
+                 * out of range, limit the period to the range boundary.
+                 */
+                rate = hw_limit_rate(&si, hwc->sample_period);
+                /* The perf core maintains a maximum sample rate that is
+                 * configurable through the sysctl interface.  Ensure the
+                 * sampling rate does not exceed this value.  This also helps
+                 * to avoid throttling when pushing samples with
+                 * perf_event_overflow().
+                 */
+                if (sample_rate_to_freq(&si, rate) >
+                      sysctl_perf_event_sample_rate) {
+                        err = -EINVAL;
+                        debug_sprintf_event(sfdbg, 1, "Sampling rate exceeds maximum perf sample rate\n");
+                        goto out;
+                }
+        }
+        SAMPL_RATE(hwc) = rate;
+        hw_init_period(hwc, SAMPL_RATE(hwc));
+        /* Initialize sample data overflow accounting */
+        hwc->extra_reg.reg = REG_OVERFLOW;
+        OVERFLOW_REG(hwc) = 0;
+        /* Allocate the per-CPU sampling buffer using the CPU information
+         * from the event.  If the event is not pinned to a particular
+         * CPU (event->cpu == -1; or cpuhw == NULL), allocate sampling
+         * buffers for each online CPU.
+         */
+        if (cpuhw)
+                /* Event is pinned to a particular CPU */
+                err = allocate_buffers(cpuhw, hwc);
+        else {
+                /* Event is not pinned, allocate sampling buffer on
+                 * each online CPU
+                 */
+                for_each_online_cpu(cpu) {
+                        cpuhw = &per_cpu(cpu_hw_sf, cpu);
+                        err = allocate_buffers(cpuhw, hwc);
+                        if (err)
+                                break;
+                }
+        }
+out:
+        return err;
+}
+static int cpumsf_pmu_event_init(struct perf_event *event)
+{
+        int err;
+        /* No support for taken branch sampling */
+        if (has_branch_stack(event))
+                return -EOPNOTSUPP;
+        switch (event->attr.type) {
+        case PERF_TYPE_RAW:
+                if ((event->attr.config != PERF_EVENT_CPUM_SF) &&
+                    (event->attr.config != PERF_EVENT_CPUM_SF_DIAG))
+                        return -ENOENT;
+                break;
+        case PERF_TYPE_HARDWARE:
+                /* Support sampling of CPU cycles in addition to the
+                 * counter facility.  However, the counter facility
+                 * is more precise and, hence, restrict this PMU to
+                 * sampling events only.
+                 */
+                if (event->attr.config != PERF_COUNT_HW_CPU_CYCLES)
+                        return -ENOENT;
+                if (!is_sampling_event(event))
+                        return -ENOENT;
+                break;
+        default:
+                return -ENOENT;
+        }
+        /* Check online status of the CPU to which the event is pinned */
+        if (event->cpu >= nr_cpumask_bits ||
+            (event->cpu >= 0 && !cpu_online(event->cpu)))
+                return -ENODEV;
+        /* Force reset of idle/hv excludes regardless of what the
+         * user requested.
+         */
+        if (event->attr.exclude_hv)
+                event->attr.exclude_hv = 0;
+        if (event->attr.exclude_idle)
+                event->attr.exclude_idle = 0;
+        err = __hw_perf_event_init(event);
+        if (unlikely(err))
+                if (event->destroy)
+                        event->destroy(event);
+        return err;
+}
+static void cpumsf_pmu_enable(struct pmu *pmu)
+{
+        struct cpu_hw_sf *cpuhw = &__get_cpu_var(cpu_hw_sf);
+        struct hw_perf_event *hwc;
+        int err;
+        if (cpuhw->flags & PMU_F_ENABLED)
+                return;
+        if (cpuhw->flags & PMU_F_ERR_MASK)
+                return;
+        /* Check whether to extent the sampling buffer.
+         *
+         * Two conditions trigger an increase of the sampling buffer for a
+         * perf event:
+         *    1. Postponed buffer allocations from the event initialization.
+         *    2. Sampling overflows that contribute to pending allocations.
+         *
+         * Note that the extend_sampling_buffer() function disables the sampling
+         * facility, but it can be fully re-enabled using sampling controls that
+         * have been saved in cpumsf_pmu_disable().
+         */
+        if (cpuhw->event) {
+                hwc = &cpuhw->event->hw;
+                /* Account number of overflow-designated buffer extents */
+                sfb_account_overflows(cpuhw, hwc);
+                if (sfb_has_pending_allocs(&cpuhw->sfb, hwc))
+                        extend_sampling_buffer(&cpuhw->sfb, hwc);
+        }
+        /* (Re)enable the PMU and sampling facility */
+        cpuhw->flags |= PMU_F_ENABLED;
+        barrier();
+        err = lsctl(&cpuhw->lsctl);
+        if (err) {
+                cpuhw->flags &= ~PMU_F_ENABLED;
+                pr_err("Loading sampling controls failed: op=%i err=%i\n",
+                        1, err);
+                return;
+        }
+        debug_sprintf_event(sfdbg, 6, "pmu_enable: es=%i cs=%i ed=%i cd=%i "
+                            "tear=%p dear=%p\n", cpuhw->lsctl.es, cpuhw->lsctl.cs,
+                            cpuhw->lsctl.ed, cpuhw->lsctl.cd,
+                            (void *) cpuhw->lsctl.tear, (void *) cpuhw->lsctl.dear);
+}
+static void cpumsf_pmu_disable(struct pmu *pmu)
+{
+        struct cpu_hw_sf *cpuhw = &__get_cpu_var(cpu_hw_sf);
+        struct hws_lsctl_request_block inactive;
+        struct hws_qsi_info_block si;
+        int err;
+        if (!(cpuhw->flags & PMU_F_ENABLED))
+                return;
+        if (cpuhw->flags & PMU_F_ERR_MASK)
+                return;
+        /* Switch off sampling activation control */
+        inactive = cpuhw->lsctl;
+        inactive.cs = 0;
+        inactive.cd = 0;
+        err = lsctl(&inactive);
+        if (err) {
+                pr_err("Loading sampling controls failed: op=%i err=%i\n",
+                        2, err);
+                return;
+        }
+        /* Save state of TEAR and DEAR register contents */
+        if (!qsi(&si)) {
+                /* TEAR/DEAR values are valid only if the sampling facility is
+                 * enabled.  Note that cpumsf_pmu_disable() might be called even
+                 * for a disabled sampling facility because cpumsf_pmu_enable()
+                 * controls the enable/disable state.
+                 */
+                if (si.es) {
+                        cpuhw->lsctl.tear = si.tear;
+                        cpuhw->lsctl.dear = si.dear;
+                }
+        } else
+                debug_sprintf_event(sfdbg, 3, "cpumsf_pmu_disable: "
+                                    "qsi() failed with err=%i\n", err);
+        cpuhw->flags &= ~PMU_F_ENABLED;
+}
+/* perf_exclude_event() - Filter event
+ * @event:      The perf event
+ * @regs:       pt_regs structure
+ * @sde_regs:   Sample-data-entry (sde) regs structure
+ *
+ * Filter perf events according to their exclude specification.
+ *
+ * Return non-zero if the event shall be excluded.
+ */
+static int perf_exclude_event(struct perf_event *event, struct pt_regs *regs,
+                              struct perf_sf_sde_regs *sde_regs)
+{
+        if (event->attr.exclude_user && user_mode(regs))
+                return 1;
+        if (event->attr.exclude_kernel && !user_mode(regs))
+                return 1;
+        if (event->attr.exclude_guest && sde_regs->in_guest)
+                return 1;
+        if (event->attr.exclude_host && !sde_regs->in_guest)
+                return 1;
+        return 0;
+}
+/* perf_push_sample() - Push samples to perf
+ * @event:      The perf event
+ * @sample:     Hardware sample data
+ *
+ * Use the hardware sample data to create perf event sample.  The sample
+ * is the pushed to the event subsystem and the function checks for
+ * possible event overflows.  If an event overflow occurs, the PMU is
+ * stopped.
+ *
+ * Return non-zero if an event overflow occurred.
+ */
+static int perf_push_sample(struct perf_event *event, struct sf_raw_sample *sfr)
+{
+        int overflow;
+        struct pt_regs regs;
+        struct perf_sf_sde_regs *sde_regs;
+        struct perf_sample_data data;
+        struct perf_raw_record raw;
+        /* Setup perf sample */
+        perf_sample_data_init(&data, 0, event->hw.last_period);
+        raw.size = sfr->size;
+        raw.data = sfr;
+        data.raw = &raw;
+        /* Setup pt_regs to look like an CPU-measurement external interrupt
+         * using the Program Request Alert code.  The regs.int_parm_long
+         * field which is unused contains additional sample-data-entry related
+         * indicators.
+         */
+        memset(&regs, 0, sizeof(regs));
+        regs.int_code = 0x1407;
+        regs.int_parm = CPU_MF_INT_SF_PRA;
+        sde_regs = (struct perf_sf_sde_regs *) &regs.int_parm_long;
+        regs.psw.addr = sfr->basic.ia;
+        if (sfr->basic.T)
+                regs.psw.mask |= PSW_MASK_DAT;
+        if (sfr->basic.W)
+                regs.psw.mask |= PSW_MASK_WAIT;
+        if (sfr->basic.P)
+                regs.psw.mask |= PSW_MASK_PSTATE;
+        switch (sfr->basic.AS) {
+        case 0x0:
+                regs.psw.mask |= PSW_ASC_PRIMARY;
+                break;
+        case 0x1:
+                regs.psw.mask |= PSW_ASC_ACCREG;
+                break;
+        case 0x2:
+                regs.psw.mask |= PSW_ASC_SECONDARY;
+                break;
+        case 0x3:
+                regs.psw.mask |= PSW_ASC_HOME;
+                break;
+        }
+        /* The host-program-parameter (hpp) contains the sie control
+         * block that is set by sie64a() in entry64.S.  Check if hpp
+         * refers to a valid control block and set sde_regs flags
+         * accordingly.  This would allow to use hpp values for other
+         * purposes too.
+         * For now, simply use a non-zero value as guest indicator.
+         */
+        if (sfr->basic.hpp)
+                sde_regs->in_guest = 1;
+        overflow = 0;
+        if (perf_exclude_event(event, &regs, sde_regs))
+                goto out;
+        if (perf_event_overflow(event, &data, &regs)) {
+                overflow = 1;
+                event->pmu->stop(event, 0);
+        }
+        perf_event_update_userpage(event);
+out:
+        return overflow;
+}
+static void perf_event_count_update(struct perf_event *event, u64 count)
+{
+        local64_add(count, &event->count);
+}
+static int sample_format_is_valid(struct hws_combined_entry *sample,
+                                   unsigned int flags)
+{
+        if (likely(flags & PERF_CPUM_SF_BASIC_MODE))
+                /* Only basic-sampling data entries with data-entry-format
+                 * version of 0x0001 can be processed.
+                 */
+                if (sample->basic.def != 0x0001)
+                        return 0;
+        if (flags & PERF_CPUM_SF_DIAG_MODE)
+                /* The data-entry-format number of diagnostic-sampling data
+                 * entries can vary.  Because diagnostic data is just passed
+                 * through, do only a sanity check on the DEF.
+                 */
+                if (sample->diag.def < 0x8001)
+                        return 0;
+        return 1;
+}
+static int sample_is_consistent(struct hws_combined_entry *sample,
+                                unsigned long flags)
+{
+        /* This check applies only to basic-sampling data entries of potentially
+         * combined-sampling data entries.  Invalid entries cannot be processed
+         * by the PMU and, thus, do not deliver an associated
+         * diagnostic-sampling data entry.
+         */
+        if (unlikely(!(flags & PERF_CPUM_SF_BASIC_MODE)))
+                return 0;
+        /*
+         * Samples are skipped, if they are invalid or for which the
+         * instruction address is not predictable, i.e., the wait-state bit is
+         * set.
+         */
+        if (sample->basic.I || sample->basic.W)
+                return 0;
+        return 1;
+}
+static void reset_sample_slot(struct hws_combined_entry *sample,
+                              unsigned long flags)
+{
+        if (likely(flags & PERF_CPUM_SF_BASIC_MODE))
+                sample->basic.def = 0;
+        if (flags & PERF_CPUM_SF_DIAG_MODE)
+                sample->diag.def = 0;
+}
+static void sfr_store_sample(struct sf_raw_sample *sfr,
+                             struct hws_combined_entry *sample)
+{
+        if (likely(sfr->format & PERF_CPUM_SF_BASIC_MODE))
+                sfr->basic = sample->basic;
+        if (sfr->format & PERF_CPUM_SF_DIAG_MODE)
+                memcpy(&sfr->diag, &sample->diag, sfr->dsdes);
+}
+static void debug_sample_entry(struct hws_combined_entry *sample,
+                               struct hws_trailer_entry *te,
+                               unsigned long flags)
+{
+        debug_sprintf_event(sfdbg, 4, "hw_collect_samples: Found unknown "
+                            "sampling data entry: te->f=%i basic.def=%04x (%p)"
+                            " diag.def=%04x (%p)\n", te->f,
+                            sample->basic.def, &sample->basic,
+                            (flags & PERF_CPUM_SF_DIAG_MODE)
+                                        ? sample->diag.def : 0xFFFF,
+                            (flags & PERF_CPUM_SF_DIAG_MODE)
+                                        ?  &sample->diag : NULL);
+}
+/* hw_collect_samples() - Walk through a sample-data-block and collect samples
+ * @event:      The perf event
+ * @sdbt:       Sample-data-block table
+ * @overflow:   Event overflow counter
+ *
+ * Walks through a sample-data-block and collects sampling data entries that are
+ * then pushed to the perf event subsystem.  Depending on the sampling function,
+ * there can be either basic-sampling or combined-sampling data entries.  A
+ * combined-sampling data entry consists of a basic- and a diagnostic-sampling
+ * data entry.  The sampling function is determined by the flags in the perf
+ * event hardware structure.  The function always works with a combined-sampling
+ * data entry but ignores the the diagnostic portion if it is not available.
+ *
+ * Note that the implementation focuses on basic-sampling data entries and, if
+ * such an entry is not valid, the entire combined-sampling data entry is
+ * ignored.
+ *
+ * The overflow variables counts the number of samples that has been discarded
+ * due to a perf event overflow.
+ */
+static void hw_collect_samples(struct perf_event *event, unsigned long *sdbt,
+                               unsigned long long *overflow)
+{
+        unsigned long flags = SAMPL_FLAGS(&event->hw);
+        struct hws_combined_entry *sample;
+        struct hws_trailer_entry *te;
+        struct sf_raw_sample *sfr;
+        size_t sample_size;
+        /* Prepare and initialize raw sample data */
+        sfr = (struct sf_raw_sample *) RAWSAMPLE_REG(&event->hw);
+        sfr->format = flags & PERF_CPUM_SF_MODE_MASK;
+        sample_size = event_sample_size(&event->hw);
+        te = (struct hws_trailer_entry *) trailer_entry_ptr(*sdbt);
+        sample = (struct hws_combined_entry *) *sdbt;
+        while ((unsigned long *) sample < (unsigned long *) te) {
+                /* Check for an empty sample */
+                if (!sample->basic.def)
+                        break;
+                /* Update perf event period */
+                perf_event_count_update(event, SAMPL_RATE(&event->hw));
+                /* Check sampling data entry */
+                if (sample_format_is_valid(sample, flags)) {
+                        /* If an event overflow occurred, the PMU is stopped to
+                         * throttle event delivery.  Remaining sample data is
+                         * discarded.
+                         */
+                        if (!*overflow) {
+                                if (sample_is_consistent(sample, flags)) {
+                                        /* Deliver sample data to perf */
+                                        sfr_store_sample(sfr, sample);
+                                        *overflow = perf_push_sample(event, sfr);
+                                }
+                        } else
+                                /* Count discarded samples */
+                                *overflow += 1;
+                } else {
+                        debug_sample_entry(sample, te, flags);
+                        /* Sample slot is not yet written or other record.
+                         *
+                         * This condition can occur if the buffer was reused
+                         * from a combined basic- and diagnostic-sampling.
+                         * If only basic-sampling is then active, entries are
+                         * written into the larger diagnostic entries.
+                         * This is typically the case for sample-data-blocks
+                         * that are not full.  Stop processing if the first
+                         * invalid format was detected.
+                         */
+                        if (!te->f)
+                                break;
+                }
+                /* Reset sample slot and advance to next sample */
+                reset_sample_slot(sample, flags);
+                sample += sample_size;
+        }
+}
+/* hw_perf_event_update() - Process sampling buffer
+ * @event:      The perf event
+ * @flush_all:  Flag to also flush partially filled sample-data-blocks
+ *
+ * Processes the sampling buffer and create perf event samples.
+ * The sampling buffer position are retrieved and saved in the TEAR_REG
+ * register of the specified perf event.
+ *
+ * Only full sample-data-blocks are processed.  Specify the flash_all flag
+ * to also walk through partially filled sample-data-blocks.  It is ignored
+ * if PERF_CPUM_SF_FULL_BLOCKS is set.  The PERF_CPUM_SF_FULL_BLOCKS flag
+ * enforces the processing of full sample-data-blocks only (trailer entries
+ * with the block-full-indicator bit set).
+ */
+static void hw_perf_event_update(struct perf_event *event, int flush_all)
+{
+        struct hw_perf_event *hwc = &event->hw;
+        struct hws_trailer_entry *te;
+        unsigned long *sdbt;
+        unsigned long long event_overflow, sampl_overflow, num_sdb, te_flags;
+        int done;
+        if (flush_all && SDB_FULL_BLOCKS(hwc))
+                flush_all = 0;
+        sdbt = (unsigned long *) TEAR_REG(hwc);
+        done = event_overflow = sampl_overflow = num_sdb = 0;
+        while (!done) {
+                /* Get the trailer entry of the sample-data-block */
+                te = (struct hws_trailer_entry *) trailer_entry_ptr(*sdbt);
+                /* Leave loop if no more work to do (block full indicator) */
+                if (!te->f) {
+                        done = 1;
+                        if (!flush_all)
+                                break;
+                }
+                /* Check the sample overflow count */
+                if (te->overflow)
+                        /* Account sample overflows and, if a particular limit
+                         * is reached, extend the sampling buffer.
+                         * For details, see sfb_account_overflows().
+                         */
+                        sampl_overflow += te->overflow;
+                /* Timestamps are valid for full sample-data-blocks only */
+                debug_sprintf_event(sfdbg, 6, "hw_perf_event_update: sdbt=%p "
+                                    "overflow=%llu timestamp=0x%llx\n",
+                                    sdbt, te->overflow,
+                                    (te->f) ? trailer_timestamp(te) : 0ULL);
+                /* Collect all samples from a single sample-data-block and
+                 * flag if an (perf) event overflow happened.  If so, the PMU
+                 * is stopped and remaining samples will be discarded.
+                 */
+                hw_collect_samples(event, sdbt, &event_overflow);
+                num_sdb++;
+                /* Reset trailer (using compare-double-and-swap) */
+                do {
+                        te_flags = te->flags & ~SDB_TE_BUFFER_FULL_MASK;
+                        te_flags |= SDB_TE_ALERT_REQ_MASK;
+                } while (!cmpxchg_double(&te->flags, &te->overflow,
+                                         te->flags, te->overflow,
+                                         te_flags, 0ULL));
+                /* Advance to next sample-data-block */
+                sdbt++;
+                if (is_link_entry(sdbt))
+                        sdbt = get_next_sdbt(sdbt);
+                /* Update event hardware registers */
+                TEAR_REG(hwc) = (unsigned long) sdbt;
+                /* Stop processing sample-data if all samples of the current
+                 * sample-data-block were flushed even if it was not full.
+                 */
+                if (flush_all && done)
+                        break;
+                /* If an event overflow happened, discard samples by
+                 * processing any remaining sample-data-blocks.
+                 */
+                if (event_overflow)
+                        flush_all = 1;
+        }
+        /* Account sample overflows in the event hardware structure */
+        if (sampl_overflow)
+                OVERFLOW_REG(hwc) = DIV_ROUND_UP(OVERFLOW_REG(hwc) +
+                                                 sampl_overflow, 1 + num_sdb);
+        if (sampl_overflow || event_overflow)
+                debug_sprintf_event(sfdbg, 4, "hw_perf_event_update: "
+                                    "overflow stats: sample=%llu event=%llu\n",
+                                    sampl_overflow, event_overflow);
+}
+static void cpumsf_pmu_read(struct perf_event *event)
+{
+        /* Nothing to do ... updates are interrupt-driven */
+}
+/* Activate sampling control.
+ * Next call of pmu_enable() starts sampling.
+ */
+static void cpumsf_pmu_start(struct perf_event *event, int flags)
+{
+        struct cpu_hw_sf *cpuhw = &__get_cpu_var(cpu_hw_sf);
+        if (WARN_ON_ONCE(!(event->hw.state & PERF_HES_STOPPED)))
+                return;
+        if (flags & PERF_EF_RELOAD)
+                WARN_ON_ONCE(!(event->hw.state & PERF_HES_UPTODATE));
+        perf_pmu_disable(event->pmu);
+        event->hw.state = 0;
+        cpuhw->lsctl.cs = 1;
+        if (SAMPL_DIAG_MODE(&event->hw))
+                cpuhw->lsctl.cd = 1;
+        perf_pmu_enable(event->pmu);
+}
+/* Deactivate sampling control.
+ * Next call of pmu_enable() stops sampling.
+ */
+static void cpumsf_pmu_stop(struct perf_event *event, int flags)
+{
+        struct cpu_hw_sf *cpuhw = &__get_cpu_var(cpu_hw_sf);
+        if (event->hw.state & PERF_HES_STOPPED)
+                return;
+        perf_pmu_disable(event->pmu);
+        cpuhw->lsctl.cs = 0;
+        cpuhw->lsctl.cd = 0;
+        event->hw.state |= PERF_HES_STOPPED;
+        if ((flags & PERF_EF_UPDATE) && !(event->hw.state & PERF_HES_UPTODATE)) {
+                hw_perf_event_update(event, 1);
+                event->hw.state |= PERF_HES_UPTODATE;
+        }
+        perf_pmu_enable(event->pmu);
+}
+static int cpumsf_pmu_add(struct perf_event *event, int flags)
+{
+        struct cpu_hw_sf *cpuhw = &__get_cpu_var(cpu_hw_sf);
+        int err;
+        if (cpuhw->flags & PMU_F_IN_USE)
+                return -EAGAIN;
+        if (!cpuhw->sfb.sdbt)
+                return -EINVAL;
+        err = 0;
+        perf_pmu_disable(event->pmu);
+        event->hw.state = PERF_HES_UPTODATE | PERF_HES_STOPPED;
+        /* Set up sampling controls.  Always program the sampling register
+         * using the SDB-table start.  Reset TEAR_REG event hardware register
+         * that is used by hw_perf_event_update() to store the sampling buffer
+         * position after samples have been flushed.
+         */
+        cpuhw->lsctl.s = 0;
+        cpuhw->lsctl.h = 1;
+        cpuhw->lsctl.tear = (unsigned long) cpuhw->sfb.sdbt;
+        cpuhw->lsctl.dear = *(unsigned long *) cpuhw->sfb.sdbt;
+        cpuhw->lsctl.interval = SAMPL_RATE(&event->hw);
+        hw_reset_registers(&event->hw, cpuhw->sfb.sdbt);
+        /* Ensure sampling functions are in the disabled state.  If disabled,
+         * switch on sampling enable control. */
+        if (WARN_ON_ONCE(cpuhw->lsctl.es == 1 || cpuhw->lsctl.ed == 1)) {
+                err = -EAGAIN;
+                goto out;
+        }
+        cpuhw->lsctl.es = 1;
+        if (SAMPL_DIAG_MODE(&event->hw))
+                cpuhw->lsctl.ed = 1;
+        /* Set in_use flag and store event */
+        event->hw.idx = 0;        /* only one sampling event per CPU supported */
+        cpuhw->event = event;
+        cpuhw->flags |= PMU_F_IN_USE;
+        if (flags & PERF_EF_START)
+                cpumsf_pmu_start(event, PERF_EF_RELOAD);
+out:
+        perf_event_update_userpage(event);
+        perf_pmu_enable(event->pmu);
+        return err;
+}
+static void cpumsf_pmu_del(struct perf_event *event, int flags)
+{
+        struct cpu_hw_sf *cpuhw = &__get_cpu_var(cpu_hw_sf);
+        perf_pmu_disable(event->pmu);
+        cpumsf_pmu_stop(event, PERF_EF_UPDATE);
+        cpuhw->lsctl.es = 0;
+        cpuhw->lsctl.ed = 0;
+        cpuhw->flags &= ~PMU_F_IN_USE;
+        cpuhw->event = NULL;
+        perf_event_update_userpage(event);
+        perf_pmu_enable(event->pmu);
+}
+static int cpumsf_pmu_event_idx(struct perf_event *event)
+{
+        return event->hw.idx;
+}
+CPUMF_EVENT_ATTR(SF, SF_CYCLES_BASIC, PERF_EVENT_CPUM_SF);
+CPUMF_EVENT_ATTR(SF, SF_CYCLES_BASIC_DIAG, PERF_EVENT_CPUM_SF_DIAG);
+static struct attribute *cpumsf_pmu_events_attr[] = {
+        CPUMF_EVENT_PTR(SF, SF_CYCLES_BASIC),
+        CPUMF_EVENT_PTR(SF, SF_CYCLES_BASIC_DIAG),
+        NULL,
+};
+PMU_FORMAT_ATTR(event, "config:0-63");
+static struct attribute *cpumsf_pmu_format_attr[] = {
+        &format_attr_event.attr,
+        NULL,
+};
+static struct attribute_group cpumsf_pmu_events_group = {
+        .name = "events",
+        .attrs = cpumsf_pmu_events_attr,
+};
+static struct attribute_group cpumsf_pmu_format_group = {
+        .name = "format",
+        .attrs = cpumsf_pmu_format_attr,
+};
+static const struct attribute_group *cpumsf_pmu_attr_groups[] = {
+        &cpumsf_pmu_events_group,
+        &cpumsf_pmu_format_group,
+        NULL,
+};
+static struct pmu cpumf_sampling = {
+        .pmu_enable   = cpumsf_pmu_enable,
+        .pmu_disable  = cpumsf_pmu_disable,
+        .event_init   = cpumsf_pmu_event_init,
+        .add          = cpumsf_pmu_add,
+        .del          = cpumsf_pmu_del,
+        .start        = cpumsf_pmu_start,
+        .stop         = cpumsf_pmu_stop,
+        .read         = cpumsf_pmu_read,
+        .event_idx    = cpumsf_pmu_event_idx,
+        .attr_groups  = cpumsf_pmu_attr_groups,
+};
+static void cpumf_measurement_alert(struct ext_code ext_code,
+                                    unsigned int alert, unsigned long unused)
+{
+        struct cpu_hw_sf *cpuhw;
+        if (!(alert & CPU_MF_INT_SF_MASK))
+                return;
+        inc_irq_stat(IRQEXT_CMS);
+        cpuhw = &__get_cpu_var(cpu_hw_sf);
+        /* Measurement alerts are shared and might happen when the PMU
+         * is not reserved.  Ignore these alerts in this case. */
+        if (!(cpuhw->flags & PMU_F_RESERVED))
+                return;
+        /* The processing below must take care of multiple alert events that
+         * might be indicated concurrently. */
+        /* Program alert request */
+        if (alert & CPU_MF_INT_SF_PRA) {
+                if (cpuhw->flags & PMU_F_IN_USE)
+                        hw_perf_event_update(cpuhw->event, 0);
+                else
+                        WARN_ON_ONCE(!(cpuhw->flags & PMU_F_IN_USE));
+        }
+        /* Report measurement alerts only for non-PRA codes */
+        if (alert != CPU_MF_INT_SF_PRA)
+                debug_sprintf_event(sfdbg, 6, "measurement alert: 0x%x\n", alert);
+        /* Sampling authorization change request */
+        if (alert & CPU_MF_INT_SF_SACA)
+                qsi(&cpuhw->qsi);
+        /* Loss of sample data due to high-priority machine activities */
+        if (alert & CPU_MF_INT_SF_LSDA) {
+                pr_err("Sample data was lost\n");
+                cpuhw->flags |= PMU_F_ERR_LSDA;
+                sf_disable();
+        }
+        /* Invalid sampling buffer entry */
+        if (alert & (CPU_MF_INT_SF_IAE|CPU_MF_INT_SF_ISE)) {
+                pr_err("A sampling buffer entry is incorrect (alert=0x%x)\n",
+                       alert);
+                cpuhw->flags |= PMU_F_ERR_IBE;
+                sf_disable();
+        }
+}
+static int cpumf_pmu_notifier(struct notifier_block *self,
+                              unsigned long action, void *hcpu)
+{
+        unsigned int cpu = (long) hcpu;
+        int flags;
+        /* Ignore the notification if no events are scheduled on the PMU.
+         * This might be racy...
+         */
+        if (!atomic_read(&num_events))
+                return NOTIFY_OK;
+        switch (action & ~CPU_TASKS_FROZEN) {
+        case CPU_ONLINE:
+        case CPU_ONLINE_FROZEN:
+                flags = PMC_INIT;
+                smp_call_function_single(cpu, setup_pmc_cpu, &flags, 1);
+                break;
+        case CPU_DOWN_PREPARE:
+                flags = PMC_RELEASE;
+                smp_call_function_single(cpu, setup_pmc_cpu, &flags, 1);
+                break;
+        default:
+                break;
+        }
+        return NOTIFY_OK;
+}
+static int param_get_sfb_size(char *buffer, const struct kernel_param *kp)
+{
+        if (!cpum_sf_avail())
+                return -ENODEV;
+        return sprintf(buffer, "%lu,%lu", CPUM_SF_MIN_SDB, CPUM_SF_MAX_SDB);
+}
+static int param_set_sfb_size(const char *val, const struct kernel_param *kp)
+{
+        int rc;
+        unsigned long min, max;
+        if (!cpum_sf_avail())
+                return -ENODEV;
+        if (!val || !strlen(val))
+                return -EINVAL;
+        /* Valid parameter values: "min,max" or "max" */
+        min = CPUM_SF_MIN_SDB;
+        max = CPUM_SF_MAX_SDB;
+        if (strchr(val, ','))
+                rc = (sscanf(val, "%lu,%lu", &min, &max) == 2) ? 0 : -EINVAL;
+        else
+                rc = kstrtoul(val, 10, &max);
+        if (min < 2 || min >= max || max > get_num_physpages())
+                rc = -EINVAL;
+        if (rc)
+                return rc;
+        sfb_set_limits(min, max);
+        pr_info("The sampling buffer limits have changed to: "
+                "min=%lu max=%lu (diag=x%lu)\n",
+                CPUM_SF_MIN_SDB, CPUM_SF_MAX_SDB, CPUM_SF_SDB_DIAG_FACTOR);
+        return 0;
+}
+#define param_check_sfb_size(name, p) __param_check(name, p, void)
+static struct kernel_param_ops param_ops_sfb_size = {
+        .set = param_set_sfb_size,
+        .get = param_get_sfb_size,
+};
+#define RS_INIT_FAILURE_QSI       0x0001
+#define RS_INIT_FAILURE_BSDES     0x0002
+#define RS_INIT_FAILURE_ALRT      0x0003
+#define RS_INIT_FAILURE_PERF      0x0004
+static void __init pr_cpumsf_err(unsigned int reason)
+{
+        pr_err("Sampling facility support for perf is not available: "
+               "reason=%04x\n", reason);
+}
+static int __init init_cpum_sampling_pmu(void)
+{
+        struct hws_qsi_info_block si;
+        int err;
+        if (!cpum_sf_avail())
+                return -ENODEV;
+        memset(&si, 0, sizeof(si));
+        if (qsi(&si)) {
+                pr_cpumsf_err(RS_INIT_FAILURE_QSI);
+                return -ENODEV;
+        }
+        if (si.bsdes != sizeof(struct hws_basic_entry)) {
+                pr_cpumsf_err(RS_INIT_FAILURE_BSDES);
+                return -EINVAL;
+        }
+        if (si.ad)
+                sfb_set_limits(CPUM_SF_MIN_SDB, CPUM_SF_MAX_SDB);
+        sfdbg = debug_register(KMSG_COMPONENT, 2, 1, 80);
+        if (!sfdbg)
+                pr_err("Registering for s390dbf failed\n");
+        debug_register_view(sfdbg, &debug_sprintf_view);
+        err = register_external_interrupt(0x1407, cpumf_measurement_alert);
+        if (err) {
+                pr_cpumsf_err(RS_INIT_FAILURE_ALRT);
+                goto out;
+        }
+        err = perf_pmu_register(&cpumf_sampling, "cpum_sf", PERF_TYPE_RAW);
+        if (err) {
+                pr_cpumsf_err(RS_INIT_FAILURE_PERF);
+                unregister_external_interrupt(0x1407, cpumf_measurement_alert);
+                goto out;
+        }
+        perf_cpu_notifier(cpumf_pmu_notifier);
+out:
+        return err;
+}
+arch_initcall(init_cpum_sampling_pmu);
+core_param(cpum_sfb_size, CPUM_SF_MAX_SDB, sfb_size, 0640);
diff --git a/arch/s390/kernel/perf_event.c b/arch/s390/kernel/perf_event.c
index 2343c218b8f9..5d2dfa31c4ef 100644
--- a/arch/s390/kernel/perf_event.c
+++ b/arch/s390/kernel/perf_event.c
@@ -1,7 +1,7 @@
 /*
 * Performance event support for s390x
 *
- *  Copyright IBM Corp. 2012
+ *  Copyright IBM Corp. 2012, 2013
 *  Author(s): Hendrik Brueckner <brueckner@linux.vnet.ibm.com>
 *
 * This program is free software; you can redistribute it and/or modify
@@ -16,15 +16,19 @@
 #include <linux/kvm_host.h>
 #include <linux/percpu.h>
 #include <linux/export.h>
+#include <linux/seq_file.h>
+#include <linux/spinlock.h>
+#include <linux/sysfs.h>
 #include <asm/irq.h>
 #include <asm/cpu_mf.h>
 #include <asm/lowcore.h>
 #include <asm/processor.h>
+#include <asm/sysinfo.h>
 const char *perf_pmu_name(void)
 {
        if (cpum_cf_avail() || cpum_sf_avail())
-                return "CPU-measurement facilities (CPUMF)";
+                return "CPU-Measurement Facilities (CPU-MF)";
        return "pmu";
 }
 EXPORT_SYMBOL(perf_pmu_name);
@@ -35,6 +39,8 @@ int perf_num_counters(void)
        if (cpum_cf_avail())
                num += PERF_CPUM_CF_MAX_CTR;
+        if (cpum_sf_avail())
+                num += PERF_CPUM_SF_MAX_CTR;
        return num;
 }
@@ -54,7 +60,7 @@ static bool is_in_guest(struct pt_regs *regs)
 {
        if (user_mode(regs))
                return false;
-#if defined(CONFIG_KVM) || defined(CONFIG_KVM_MODULE)
+#if IS_ENABLED(CONFIG_KVM)
        return instruction_pointer(regs) == (unsigned long) &sie_exit;
 #else
        return false;
@@ -83,8 +89,31 @@ static unsigned long perf_misc_guest_flags(struct pt_regs *regs)
                                        : PERF_RECORD_MISC_GUEST_KERNEL;
 }
+static unsigned long perf_misc_flags_sf(struct pt_regs *regs)
+{
+        struct perf_sf_sde_regs *sde_regs;
+        unsigned long flags;
+        sde_regs = (struct perf_sf_sde_regs *) &regs->int_parm_long;
+        if (sde_regs->in_guest)
+                flags = user_mode(regs) ? PERF_RECORD_MISC_GUEST_USER
+                                        : PERF_RECORD_MISC_GUEST_KERNEL;
+        else
+                flags = user_mode(regs) ? PERF_RECORD_MISC_USER
+                                        : PERF_RECORD_MISC_KERNEL;
+        return flags;
+}
 unsigned long perf_misc_flags(struct pt_regs *regs)
 {
+        /* Check if the cpum_sf PMU has created the pt_regs structure.
+         * In this case, perf misc flags can be easily extracted.  Otherwise,
+         * do regular checks on the pt_regs content.
+         */
+        if (regs->int_code == 0x1407 && regs->int_parm == CPU_MF_INT_SF_PRA)
+                if (!regs->gprs[15])
+                        return perf_misc_flags_sf(regs);
        if (is_in_guest(regs))
                return perf_misc_guest_flags(regs);
@@ -92,27 +121,107 @@ unsigned long perf_misc_flags(struct pt_regs *regs)
                               : PERF_RECORD_MISC_KERNEL;
 }
-void perf_event_print_debug(void)
+void print_debug_cf(void)
 {
        struct cpumf_ctr_info cf_info;
-        unsigned long flags;
+        int cpu = smp_processor_id();
-        int cpu;
-        if (!cpum_cf_avail())
-                return;
-        local_irq_save(flags);
-        cpu = smp_processor_id();
        memset(&cf_info, 0, sizeof(cf_info));
        if (!qctri(&cf_info))
                pr_info("CPU[%i] CPUM_CF: ver=%u.%u A=%04x E=%04x C=%04x\n",
                        cpu, cf_info.cfvn, cf_info.csvn,
                        cf_info.auth_ctl, cf_info.enable_ctl, cf_info.act_ctl);
+}
+static void print_debug_sf(void)
+{
+        struct hws_qsi_info_block si;
+        int cpu = smp_processor_id();
+        memset(&si, 0, sizeof(si));
+        if (qsi(&si))
+                return;
+        pr_info("CPU[%i] CPUM_SF: basic=%i diag=%i min=%lu max=%lu cpu_speed=%u\n",
+                cpu, si.as, si.ad, si.min_sampl_rate, si.max_sampl_rate,
+                si.cpu_speed);
+        if (si.as)
+                pr_info("CPU[%i] CPUM_SF: Basic-sampling: a=%i e=%i c=%i"
+                        " bsdes=%i tear=%016lx dear=%016lx\n", cpu,
+                        si.as, si.es, si.cs, si.bsdes, si.tear, si.dear);
+        if (si.ad)
+                pr_info("CPU[%i] CPUM_SF: Diagnostic-sampling: a=%i e=%i c=%i"
+                        " dsdes=%i tear=%016lx dear=%016lx\n", cpu,
+                        si.ad, si.ed, si.cd, si.dsdes, si.tear, si.dear);
+}
+void perf_event_print_debug(void)
+{
+        unsigned long flags;
+        local_irq_save(flags);
+        if (cpum_cf_avail())
+                print_debug_cf();
+        if (cpum_sf_avail())
+                print_debug_sf();
        local_irq_restore(flags);
 }
+/* Service level infrastructure */
+static void sl_print_counter(struct seq_file *m)
+{
+        struct cpumf_ctr_info ci;
+        memset(&ci, 0, sizeof(ci));
+        if (qctri(&ci))
+                return;
+        seq_printf(m, "CPU-MF: Counter facility: version=%u.%u "
+                   "authorization=%04x\n", ci.cfvn, ci.csvn, ci.auth_ctl);
+}
+static void sl_print_sampling(struct seq_file *m)
+{
+        struct hws_qsi_info_block si;
+        memset(&si, 0, sizeof(si));
+        if (qsi(&si))
+                return;
+        if (!si.as && !si.ad)
+                return;
+        seq_printf(m, "CPU-MF: Sampling facility: min_rate=%lu max_rate=%lu"
+                   " cpu_speed=%u\n", si.min_sampl_rate, si.max_sampl_rate,
+                   si.cpu_speed);
+        if (si.as)
+                seq_printf(m, "CPU-MF: Sampling facility: mode=basic"
+                           " sample_size=%u\n", si.bsdes);
+        if (si.ad)
+                seq_printf(m, "CPU-MF: Sampling facility: mode=diagnostic"
+                           " sample_size=%u\n", si.dsdes);
+}
+static void service_level_perf_print(struct seq_file *m,
+                                     struct service_level *sl)
+{
+        if (cpum_cf_avail())
+                sl_print_counter(m);
+        if (cpum_sf_avail())
+                sl_print_sampling(m);
+}
+static struct service_level service_level_perf = {
+        .seq_print = service_level_perf_print,
+};
+static int __init service_level_perf_register(void)
+{
+        return register_service_level(&service_level_perf);
+}
+arch_initcall(service_level_perf_register);
 /* See also arch/s390/kernel/traps.c */
 static unsigned long __store_trace(struct perf_callchain_entry *entry,
                                   unsigned long sp,
@@ -172,3 +281,44 @@ void perf_callchain_kernel(struct perf_callchain_entry *entry,
        __store_trace(entry, head, S390_lowcore.thread_info,
                      S390_lowcore.thread_info + THREAD_SIZE);
 }
+/* Perf defintions for PMU event attributes in sysfs */
+ssize_t cpumf_events_sysfs_show(struct device *dev,
+                                struct device_attribute *attr, char *page)
+{
+        struct perf_pmu_events_attr *pmu_attr;
+        pmu_attr = container_of(attr, struct perf_pmu_events_attr, attr);
+        return sprintf(page, "event=0x%04llx,name=%s\n",
+                       pmu_attr->id, attr->attr.name);
+}
+/* Reserve/release functions for sharing perf hardware */
+static DEFINE_SPINLOCK(perf_hw_owner_lock);
+static void *perf_sampling_owner;
+int perf_reserve_sampling(void)
+{
+        int err;
+        err = 0;
+        spin_lock(&perf_hw_owner_lock);
+        if (perf_sampling_owner) {
+                pr_warn("The sampling facility is already reserved by %p\n",
+                        perf_sampling_owner);
+                err = -EBUSY;
+        } else
+                perf_sampling_owner = __builtin_return_address(0);
+        spin_unlock(&perf_hw_owner_lock);
+        return err;
+}
+EXPORT_SYMBOL(perf_reserve_sampling);
+void perf_release_sampling(void)
+{
+        spin_lock(&perf_hw_owner_lock);
+        WARN_ON(!perf_sampling_owner);
+        perf_sampling_owner = NULL;
+        spin_unlock(&perf_hw_owner_lock);
+}
+EXPORT_SYMBOL(perf_release_sampling);
diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c
index 7ed0d4e2a435..dd145321d215 100644
--- a/arch/s390/kernel/process.c
+++ b/arch/s390/kernel/process.c
@@ -261,20 +261,18 @@ static inline unsigned long brk_rnd(void)
 unsigned long arch_randomize_brk(struct mm_struct *mm)
 {
-        unsigned long ret = PAGE_ALIGN(mm->brk + brk_rnd());
+        unsigned long ret;
-        if (ret < mm->brk)
+        ret = PAGE_ALIGN(mm->brk + brk_rnd());
-                return mm->brk;
+        return (ret > mm->brk) ? ret : mm->brk;
-        return ret;
 }
 unsigned long randomize_et_dyn(unsigned long base)
 {
-        unsigned long ret = PAGE_ALIGN(base + brk_rnd());
+        unsigned long ret;
        if (!(current->flags & PF_RANDOMIZE))
                return base;
-        if (ret < base)
+        ret = PAGE_ALIGN(base + brk_rnd());
-                return base;
+        return (ret > base) ? ret : base;
-        return ret;
 }
diff --git a/arch/s390/kernel/ptrace.c b/arch/s390/kernel/ptrace.c
index e65c91c591e8..f6be6087a0e9 100644
--- a/arch/s390/kernel/ptrace.c
+++ b/arch/s390/kernel/ptrace.c
@@ -56,25 +56,26 @@ void update_cr_regs(struct task_struct *task)
 #ifdef CONFIG_64BIT
        /* Take care of the enable/disable of transactional execution. */
        if (MACHINE_HAS_TE) {
-                unsigned long cr[3], cr_new[3];
+                unsigned long cr, cr_new;
-                __ctl_store(cr, 0, 2);
+                __ctl_store(cr, 0, 0);
-                cr_new[1] = cr[1];
                /* Set or clear transaction execution TXC bit 8. */
+                cr_new = cr | (1UL << 55);
                if (task->thread.per_flags & PER_FLAG_NO_TE)
-                        cr_new[0] = cr[0] & ~(1UL << 55);
+                        cr_new &= ~(1UL << 55);
-                else
+                if (cr_new != cr)
-                        cr_new[0] = cr[0] | (1UL << 55);
+                        __ctl_load(cr, 0, 0);
                /* Set or clear transaction execution TDC bits 62 and 63. */
-                cr_new[2] = cr[2] & ~3UL;
+                __ctl_store(cr, 2, 2);
+                cr_new = cr & ~3UL;
                if (task->thread.per_flags & PER_FLAG_TE_ABORT_RAND) {
                        if (task->thread.per_flags & PER_FLAG_TE_ABORT_RAND_TEND)
-                                cr_new[2] |= 1UL;
+                                cr_new |= 1UL;
                        else
-                                cr_new[2] |= 2UL;
+                                cr_new |= 2UL;
                }
-                if (memcmp(&cr_new, &cr, sizeof(cr)))
+                if (cr_new != cr)
-                        __ctl_load(cr_new, 0, 2);
+                        __ctl_load(cr_new, 2, 2);
        }
 #endif
        /* Copy user specified PER registers */
@@ -107,15 +108,11 @@ void update_cr_regs(struct task_struct *task)
 void user_enable_single_step(struct task_struct *task)
 {
        set_tsk_thread_flag(task, TIF_SINGLE_STEP);
-        if (task == current)
-                update_cr_regs(task);
 }
 void user_disable_single_step(struct task_struct *task)
 {
        clear_tsk_thread_flag(task, TIF_SINGLE_STEP);
-        if (task == current)
-                update_cr_regs(task);
 }
 /*
diff --git a/arch/s390/kernel/s390_ksyms.c b/arch/s390/kernel/s390_ksyms.c
index 3bac589844a7..9f60467938d1 100644
--- a/arch/s390/kernel/s390_ksyms.c
+++ b/arch/s390/kernel/s390_ksyms.c
@@ -5,7 +5,7 @@
 #ifdef CONFIG_FUNCTION_TRACER
 EXPORT_SYMBOL(_mcount);
 #endif
-#if defined(CONFIG_KVM) || defined(CONFIG_KVM_MODULE)
+#if IS_ENABLED(CONFIG_KVM)
 EXPORT_SYMBOL(sie64a);
 EXPORT_SYMBOL(sie_exit);
 #endif
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 4444875266ee..09e2f468f48b 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -373,7 +373,7 @@ static void __init setup_lowcore(void)
        /*
         * Set up PSW restart to call ipl.c:do_restart(). Copy the relevant
-         * restart data to the absolute zero lowcore. This is necesary if
+         * restart data to the absolute zero lowcore. This is necessary if
         * PSW restart is done on an offline CPU that has lowcore zero.
         */
        lc->restart_stack = (unsigned long) restart_stack;
@@ -1023,6 +1023,7 @@ void __init setup_arch(char **cmdline_p)
        setup_vmcoreinfo();
        setup_lowcore();
+        smp_fill_possible_mask();
        cpu_init();
        s390_init_cpu_topology();
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index dc4a53465060..a7125b62a9a6 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -59,7 +59,7 @@ enum {
 };
 struct pcpu {
-        struct cpu cpu;
+        struct cpu *cpu;
        struct _lowcore *lowcore;       /* lowcore page(s) for the cpu */
        unsigned long async_stack;      /* async stack for the cpu */
        unsigned long panic_stack;      /* panic stack for the cpu */
@@ -159,9 +159,9 @@ static void pcpu_ec_call(struct pcpu *pcpu, int ec_bit)
 {
        int order;
-        set_bit(ec_bit, &pcpu->ec_mask);
+        if (test_and_set_bit(ec_bit, &pcpu->ec_mask))
-        order = pcpu_running(pcpu) ?
+                return;
-                SIGP_EXTERNAL_CALL : SIGP_EMERGENCY_SIGNAL;
+        order = pcpu_running(pcpu) ? SIGP_EXTERNAL_CALL : SIGP_EMERGENCY_SIGNAL;
        pcpu_sigp_retry(pcpu, order, 0);
 }
@@ -721,18 +721,14 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle)
        return 0;
 }
-static int __init setup_possible_cpus(char *s)
+static unsigned int setup_possible_cpus __initdata;
-{
-        int max, cpu;
-        if (kstrtoint(s, 0, &max) < 0)
+static int __init _setup_possible_cpus(char *s)
-                return 0;
+{
-        init_cpu_possible(cpumask_of(0));
+        get_option(&s, &setup_possible_cpus);
-        for (cpu = 1; cpu < max && cpu < nr_cpu_ids; cpu++)
-                set_cpu_possible(cpu, true);
        return 0;
 }
-early_param("possible_cpus", setup_possible_cpus);
+early_param("possible_cpus", _setup_possible_cpus);
 #ifdef CONFIG_HOTPLUG_CPU
@@ -775,6 +771,17 @@ void __noreturn cpu_die(void)
 #endif /* CONFIG_HOTPLUG_CPU */
+void __init smp_fill_possible_mask(void)
+{
+        unsigned int possible, cpu;
+        possible = setup_possible_cpus;
+        if (!possible)
+                possible = MACHINE_IS_VM ? 64 : nr_cpu_ids;
+        for (cpu = 0; cpu < possible && cpu < nr_cpu_ids; cpu++)
+                set_cpu_possible(cpu, true);
+}
 void __init smp_prepare_cpus(unsigned int max_cpus)
 {
        /* request the 0x1201 emergency signal external interrupt */
@@ -958,7 +965,7 @@ static int smp_cpu_notify(struct notifier_block *self, unsigned long action,
                          void *hcpu)
 {
        unsigned int cpu = (unsigned int)(long)hcpu;
-        struct cpu *c = &pcpu_devices[cpu].cpu;
+        struct cpu *c = pcpu_devices[cpu].cpu;
        struct device *s = &c->dev;
        int err = 0;
@@ -975,10 +982,15 @@ static int smp_cpu_notify(struct notifier_block *self, unsigned long action,
 static int smp_add_present_cpu(int cpu)
 {
-        struct cpu *c = &pcpu_devices[cpu].cpu;
+        struct device *s;
-        struct device *s = &c->dev;
+        struct cpu *c;
        int rc;
+        c = kzalloc(sizeof(*c), GFP_KERNEL);
+        if (!c)
+                return -ENOMEM;
+        pcpu_devices[cpu].cpu = c;
+        s = &c->dev;
        c->hotpluggable = 1;
        rc = register_cpu(c, cpu);
        if (rc)
diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c
index 2440602e6df1..d101dae62771 100644
--- a/arch/s390/kvm/priv.c
+++ b/arch/s390/kvm/priv.c
@@ -275,7 +275,7 @@ static int handle_io_inst(struct kvm_vcpu *vcpu)
                return -EOPNOTSUPP;
        } else {
                /*
-                 * Set condition code 3 to stop the guest from issueing channel
+                 * Set condition code 3 to stop the guest from issuing channel
                 * I/O instructions.
                 */
                kvm_s390_set_psw_cc(vcpu, 3);
diff --git a/arch/s390/lib/uaccess_pt.c b/arch/s390/lib/uaccess_pt.c
index dbdab3e7a1a6..0632dc50da78 100644
--- a/arch/s390/lib/uaccess_pt.c
+++ b/arch/s390/lib/uaccess_pt.c
@@ -74,8 +74,8 @@ static size_t copy_in_kernel(size_t count, void __user *to,
 /*
 * Returns kernel address for user virtual address. If the returned address is
- * >= -4095 (IS_ERR_VALUE(x) returns true), a fault has occured and the address
+ * >= -4095 (IS_ERR_VALUE(x) returns true), a fault has occurred and the
- * contains the (negative) exception code.
+ * address contains the (negative) exception code.
 */
 #ifdef CONFIG_64BIT
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index e794c88f699a..3584ed9b20a1 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -293,7 +293,7 @@ static int gmap_alloc_table(struct gmap *gmap,
 * @addr: address in the guest address space
 * @len: length of the memory area to unmap
 *
- * Returns 0 if the unmap succeded, -EINVAL if not.
+ * Returns 0 if the unmap succeeded, -EINVAL if not.
 */
 int gmap_unmap_segment(struct gmap *gmap, unsigned long to, unsigned long len)
 {
@@ -344,7 +344,7 @@ EXPORT_SYMBOL_GPL(gmap_unmap_segment);
 * @from: source address in the parent address space
 * @to: target address in the guest address space
 *
- * Returns 0 if the mmap succeded, -EINVAL or -ENOMEM if not.
+ * Returns 0 if the mmap succeeded, -EINVAL or -ENOMEM if not.
 */
 int gmap_map_segment(struct gmap *gmap, unsigned long from,
                     unsigned long to, unsigned long len)
diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index 16871da37371..708d60e40066 100644
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -368,14 +368,16 @@ static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
                EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
                /* lhi %r4,0 */
                EMIT4(0xa7480000);
-                /* dr %r4,%r12 */
+                /* dlr %r4,%r12 */
-                EMIT2(0x1d4c);
+                EMIT4(0xb997004c);
                break;
-        case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K) */
+        case BPF_S_ALU_DIV_K: /* A /= K */
-                /* m %r4,<d(K)>(%r13) */
+                if (K == 1)
-                EMIT4_DISP(0x5c40d000, EMIT_CONST(K));
+                        break;
-                /* lr %r5,%r4 */
+                /* lhi %r4,0 */
-                EMIT2(0x1854);
+                EMIT4(0xa7480000);
+                /* dl %r4,<d(K)>(%r13) */
+                EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
                break;
        case BPF_S_ALU_MOD_X: /* A %= X */
                jit->seen |= SEEN_XREG | SEEN_RET0;
@@ -385,16 +387,21 @@ static int bpf_jit_insn(struct bpf_jit *jit, struct sock_filter *filter,
                EMIT4_PCREL(0xa7840000, (jit->ret0_ip - jit->prg));
                /* lhi %r4,0 */
                EMIT4(0xa7480000);
-                /* dr %r4,%r12 */
+                /* dlr %r4,%r12 */
-                EMIT2(0x1d4c);
+                EMIT4(0xb997004c);
                /* lr %r5,%r4 */
                EMIT2(0x1854);
                break;
        case BPF_S_ALU_MOD_K: /* A %= K */
+                if (K == 1) {
+                        /* lhi %r5,0 */
+                        EMIT4(0xa7580000);
+                        break;
+                }
                /* lhi %r4,0 */
                EMIT4(0xa7480000);
-                /* d %r4,<d(K)>(%r13) */
+                /* dl %r4,<d(K)>(%r13) */
-                EMIT4_DISP(0x5d40d000, EMIT_CONST(K));
+                EMIT6_DISP(0xe340d000, 0x0097, EMIT_CONST(K));
                /* lr %r5,%r4 */
                EMIT2(0x1854);
                break;
diff --git a/arch/s390/oprofile/hwsampler.c b/arch/s390/oprofile/hwsampler.c
index 231cecafc2f1..a32c96761eab 100644
--- a/arch/s390/oprofile/hwsampler.c
+++ b/arch/s390/oprofile/hwsampler.c
@@ -26,9 +26,6 @@
 #define MAX_NUM_SDB 511
 #define MIN_NUM_SDB 1
-#define ALERT_REQ_MASK   0x4000000000000000ul
-#define BUFFER_FULL_MASK 0x8000000000000000ul
 DECLARE_PER_CPU(struct hws_cpu_buffer, sampler_cpu_buffer);
 struct hws_execute_parms {
@@ -44,6 +41,7 @@ static DEFINE_MUTEX(hws_sem_oom);
 static unsigned char hws_flush_all;
 static unsigned int hws_oom;
+static unsigned int hws_alert;
 static struct workqueue_struct *hws_wq;
 static unsigned int hws_state;
@@ -65,43 +63,6 @@ static unsigned long interval;
 static unsigned long min_sampler_rate;
 static unsigned long max_sampler_rate;
-static int ssctl(void *buffer)
-{
-        int cc;
-        /* set in order to detect a program check */
-        cc = 1;
-        asm volatile(
-                "0: .insn s,0xB2870000,0(%1)\n"
-                "1: ipm %0\n"
-                "   srl %0,28\n"
-                "2:\n"
-                EX_TABLE(0b, 2b) EX_TABLE(1b, 2b)
-                : "+d" (cc), "+a" (buffer)
-                : "m" (*((struct hws_ssctl_request_block *)buffer))
-                : "cc", "memory");
-        return cc ? -EINVAL : 0 ;
-}
-static int qsi(void *buffer)
-{
-        int cc;
-        cc = 1;
-        asm volatile(
-                "0: .insn s,0xB2860000,0(%1)\n"
-                "1: lhi %0,0\n"
-                "2:\n"
-                EX_TABLE(0b, 2b) EX_TABLE(1b, 2b)
-                : "=d" (cc), "+a" (buffer)
-                : "m" (*((struct hws_qsi_info_block *)buffer))
-                : "cc", "memory");
-        return cc ? -EINVAL : 0;
-}
 static void execute_qsi(void *parms)
 {
        struct hws_execute_parms *ep = parms;
@@ -113,7 +74,7 @@ static void execute_ssctl(void *parms)
 {
        struct hws_execute_parms *ep = parms;
-        ep->rc = ssctl(ep->buffer);
+        ep->rc = lsctl(ep->buffer);
 }
 static int smp_ctl_ssctl_stop(int cpu)
@@ -214,17 +175,6 @@ static int smp_ctl_qsi(int cpu)
        return ep.rc;
 }
-static inline unsigned long *trailer_entry_ptr(unsigned long v)
-{
-        void *ret;
-        ret = (void *)v;
-        ret += PAGE_SIZE;
-        ret -= sizeof(struct hws_trailer_entry);
-        return (unsigned long *) ret;
-}
 static void hws_ext_handler(struct ext_code ext_code,
                            unsigned int param32, unsigned long param64)
 {
@@ -233,6 +183,9 @@ static void hws_ext_handler(struct ext_code ext_code,
        if (!(param32 & CPU_MF_INT_SF_MASK))
                return;
+        if (!hws_alert)
+                return;
        inc_irq_stat(IRQEXT_CMS);
        atomic_xchg(&cb->ext_params, atomic_read(&cb->ext_params) | param32);
@@ -256,16 +209,6 @@ static void init_all_cpu_buffers(void)
        }
 }
-static int is_link_entry(unsigned long *s)
-{
-        return *s & 0x1ul ? 1 : 0;
-}
-static unsigned long *get_next_sdbt(unsigned long *s)
-{
-        return (unsigned long *) (*s & ~0x1ul);
-}
 static int prepare_cpu_buffers(void)
 {
        int cpu;
@@ -353,7 +296,7 @@ static int allocate_sdbt(int cpu)
                        }
                        *sdbt = sdb;
                        trailer = trailer_entry_ptr(*sdbt);
-                        *trailer = ALERT_REQ_MASK;
+                        *trailer = SDB_TE_ALERT_REQ_MASK;
                        sdbt++;
                        mutex_unlock(&hws_sem_oom);
                }
@@ -829,7 +772,7 @@ static void worker_on_interrupt(unsigned int cpu)
                trailer = trailer_entry_ptr(*sdbt);
                /* leave loop if no more work to do */
-                if (!(*trailer & BUFFER_FULL_MASK)) {
+                if (!(*trailer & SDB_TE_BUFFER_FULL_MASK)) {
                        done = 1;
                        if (!hws_flush_all)
                                continue;
@@ -856,7 +799,7 @@ static void worker_on_interrupt(unsigned int cpu)
 static void add_samples_to_oprofile(unsigned int cpu, unsigned long *sdbt,
                unsigned long *dear)
 {
-        struct hws_data_entry *sample_data_ptr;
+        struct hws_basic_entry *sample_data_ptr;
        unsigned long *trailer;
        trailer = trailer_entry_ptr(*sdbt);
@@ -866,7 +809,7 @@ static void add_samples_to_oprofile(unsigned int cpu, unsigned long *sdbt,
                trailer = dear;
        }
-        sample_data_ptr = (struct hws_data_entry *)(*sdbt);
+        sample_data_ptr = (struct hws_basic_entry *)(*sdbt);
        while ((unsigned long *)sample_data_ptr < trailer) {
                struct pt_regs *regs = NULL;
@@ -1002,6 +945,7 @@ int hwsampler_deallocate(void)
                goto deallocate_exit;
        irq_subclass_unregister(IRQ_SUBCLASS_MEASUREMENT_ALERT);
+        hws_alert = 0;
        deallocate_sdbt();
        hws_state = HWS_DEALLOCATED;
@@ -1116,6 +1060,7 @@ int hwsampler_shutdown(void)
                if (hws_state == HWS_STOPPED) {
                        irq_subclass_unregister(IRQ_SUBCLASS_MEASUREMENT_ALERT);
+                        hws_alert = 0;
                        deallocate_sdbt();
                }
                if (hws_wq) {
@@ -1190,6 +1135,7 @@ start_all_exit:
        hws_oom = 1;
        hws_flush_all = 0;
        /* now let them in, 1407 CPUMF external interrupts */
+        hws_alert = 1;
        irq_subclass_register(IRQ_SUBCLASS_MEASUREMENT_ALERT);
        return 0;
diff --git a/arch/s390/oprofile/hwsampler.h b/arch/s390/oprofile/hwsampler.h
index 0022e1ebfbde..a483d06f2fa7 100644
--- a/arch/s390/oprofile/hwsampler.h
+++ b/arch/s390/oprofile/hwsampler.h
@@ -9,27 +9,7 @@
 #define HWSAMPLER_H_
 #include <linux/workqueue.h>
+#include <asm/cpu_mf.h>
-struct hws_qsi_info_block          /* QUERY SAMPLING information block  */
-{ /* Bit(s) */
-        unsigned int b0_13:14;      /* 0-13: zeros                       */
-        unsigned int as:1;          /* 14: sampling authorisation control*/
-        unsigned int b15_21:7;      /* 15-21: zeros                      */
-        unsigned int es:1;          /* 22: sampling enable control       */
-        unsigned int b23_29:7;      /* 23-29: zeros                      */
-        unsigned int cs:1;          /* 30: sampling activation control   */
-        unsigned int:1;             /* 31: reserved                      */
-        unsigned int bsdes:16;      /* 4-5: size of sampling entry       */
-        unsigned int:16;            /* 6-7: reserved                     */
-        unsigned long min_sampl_rate; /* 8-15: minimum sampling interval */
-        unsigned long max_sampl_rate; /* 16-23: maximum sampling interval*/
-        unsigned long tear;         /* 24-31: TEAR contents              */
-        unsigned long dear;         /* 32-39: DEAR contents              */
-        unsigned int rsvrd0;        /* 40-43: reserved                   */
-        unsigned int cpu_speed;     /* 44-47: CPU speed                  */
-        unsigned long long rsvrd1;  /* 48-55: reserved                   */
-        unsigned long long rsvrd2;  /* 56-63: reserved                   */
-};
 struct hws_ssctl_request_block     /* SET SAMPLING CONTROLS req block   */
 { /* bytes 0 - 7  Bit(s) */
@@ -68,36 +48,6 @@ struct hws_cpu_buffer {
        unsigned int stop_mode:1;
 };
-struct hws_data_entry {
-        unsigned int def:16;        /* 0-15  Data Entry Format           */
-        unsigned int R:4;           /* 16-19 reserved                    */
-        unsigned int U:4;           /* 20-23 Number of unique instruct.  */
-        unsigned int z:2;           /* zeros                             */
-        unsigned int T:1;           /* 26 PSW DAT mode                   */
-        unsigned int W:1;           /* 27 PSW wait state                 */
-        unsigned int P:1;           /* 28 PSW Problem state              */
-        unsigned int AS:2;          /* 29-30 PSW address-space control   */
-        unsigned int I:1;           /* 31 entry valid or invalid         */
-        unsigned int:16;
-        unsigned int prim_asn:16;   /* primary ASN                       */
-        unsigned long long ia;      /* Instruction Address               */
-        unsigned long long gpp;     /* Guest Program Parameter           */
-        unsigned long long hpp;     /* Host Program Parameter            */
-};
-struct hws_trailer_entry {
-        unsigned int f:1;           /* 0 - Block Full Indicator          */
-        unsigned int a:1;           /* 1 - Alert request control         */
-        unsigned long:62;           /* 2 - 63: Reserved                  */
-        unsigned long overflow;     /* 64 - sample Overflow count        */
-        unsigned long timestamp;    /* 16 - time-stamp                   */
-        unsigned long timestamp1;   /*                                   */
-        unsigned long reserved1;    /* 32 -Reserved                      */
-        unsigned long reserved2;    /*                                   */
-        unsigned long progusage1;   /* 48 - reserved for programming use */
-        unsigned long progusage2;   /*                                   */
-};
 int hwsampler_setup(void);
 int hwsampler_shutdown(void);
 int hwsampler_allocate(unsigned long sdbt, unsigned long sdb);
diff --git a/arch/s390/oprofile/init.c b/arch/s390/oprofile/init.c
index 04e1b6a85362..9ffe645d5989 100644
--- a/arch/s390/oprofile/init.c
+++ b/arch/s390/oprofile/init.c
@@ -10,6 +10,7 @@
 */
 #include <linux/oprofile.h>
+#include <linux/perf_event.h>
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
@@ -67,6 +68,21 @@ module_param_call(cpu_type, set_cpu_type, NULL, NULL, 0);
 MODULE_PARM_DESC(cpu_type, "Force legacy basic mode sampling"
                           "(report cpu_type \"timer\"");
+static int __oprofile_hwsampler_start(void)
+{
+        int retval;
+        retval = hwsampler_allocate(oprofile_sdbt_blocks, oprofile_sdb_blocks);
+        if (retval)
+                return retval;
+        retval = hwsampler_start_all(oprofile_hw_interval);
+        if (retval)
+                hwsampler_deallocate();
+        return retval;
+}
 static int oprofile_hwsampler_start(void)
 {
        int retval;
@@ -76,13 +92,13 @@ static int oprofile_hwsampler_start(void)
        if (!hwsampler_running)
                return timer_ops.start();
-        retval = hwsampler_allocate(oprofile_sdbt_blocks, oprofile_sdb_blocks);
+        retval = perf_reserve_sampling();
        if (retval)
                return retval;
-        retval = hwsampler_start_all(oprofile_hw_interval);
+        retval = __oprofile_hwsampler_start();
        if (retval)
-                hwsampler_deallocate();
+                perf_release_sampling();
        return retval;
 }
@@ -96,6 +112,7 @@ static void oprofile_hwsampler_stop(void)
        hwsampler_stop_all();
        hwsampler_deallocate();
+        perf_release_sampling();
        return;
 }
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index bf7c73d71eef..0820362c7b0f 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -919,17 +919,23 @@ static void zpci_mem_exit(void)
        kmem_cache_destroy(zdev_fmb_cache);
 }
-static unsigned int s390_pci_probe;
+static unsigned int s390_pci_probe = 1;
+static unsigned int s390_pci_initialized;
 char * __init pcibios_setup(char *str)
 {
-        if (!strcmp(str, "on")) {
+        if (!strcmp(str, "off")) {
-                s390_pci_probe = 1;
+                s390_pci_probe = 0;
                return NULL;
        }
        return str;
 }
+bool zpci_is_enabled(void)
+{
+        return s390_pci_initialized;
+}
 static int __init pci_base_init(void)
 {
        int rc;
@@ -961,6 +967,7 @@ static int __init pci_base_init(void)
        if (rc)
                goto out_find;
+        s390_pci_initialized = 1;
        return 0;
 out_find:
@@ -978,5 +985,6 @@ subsys_initcall_sync(pci_base_init);
 void zpci_rescan(void)
 {
-        clp_rescan_pci_devices_simple();
+        if (zpci_is_enabled())
+                clp_rescan_pci_devices_simple();
 }
diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c
index 9b83d080902d..60c11a629d96 100644
--- a/arch/s390/pci/pci_dma.c
+++ b/arch/s390/pci/pci_dma.c
@@ -285,7 +285,7 @@ static dma_addr_t s390_dma_map_pages(struct device *dev, struct page *page,
                flags |= ZPCI_TABLE_PROTECTED;
        if (!dma_update_trans(zdev, pa, dma_addr, size, flags)) {
-                atomic64_add(nr_pages, (atomic64_t *) &zdev->fmb->mapped_pages);
+                atomic64_add(nr_pages, &zdev->fmb->mapped_pages);
                return dma_addr + (offset & ~PAGE_MASK);
        }
@@ -313,7 +313,7 @@ static void s390_dma_unmap_pages(struct device *dev, dma_addr_t dma_addr,
                zpci_err_hex(&dma_addr, sizeof(dma_addr));
        }
-        atomic64_add(npages, (atomic64_t *) &zdev->fmb->unmapped_pages);
+        atomic64_add(npages, &zdev->fmb->unmapped_pages);
        iommu_page_index = (dma_addr - zdev->start_dma) >> PAGE_SHIFT;
        dma_free_iommu(zdev, iommu_page_index, npages);
 }
@@ -332,7 +332,6 @@ static void *s390_dma_alloc(struct device *dev, size_t size,
        if (!page)
                return NULL;
-        atomic64_add(size / PAGE_SIZE, (atomic64_t *) &zdev->fmb->allocated_pages);
        pa = page_to_phys(page);
        memset((void *) pa, 0, size);
@@ -343,6 +342,7 @@ static void *s390_dma_alloc(struct device *dev, size_t size,
                return NULL;
        }
+        atomic64_add(size / PAGE_SIZE, &zdev->fmb->allocated_pages);
        if (dma_handle)
                *dma_handle = map;
        return (void *) pa;
@@ -352,8 +352,11 @@ static void s390_dma_free(struct device *dev, size_t size,
                          void *pa, dma_addr_t dma_handle,
                          struct dma_attrs *attrs)
 {
-        s390_dma_unmap_pages(dev, dma_handle, PAGE_ALIGN(size),
+        struct zpci_dev *zdev = get_zdev(to_pci_dev(dev));
-                             DMA_BIDIRECTIONAL, NULL);
+        size = PAGE_ALIGN(size);
+        atomic64_sub(size / PAGE_SIZE, &zdev->fmb->allocated_pages);
+        s390_dma_unmap_pages(dev, dma_handle, size, DMA_BIDIRECTIONAL, NULL);
        free_pages((unsigned long) pa, get_order(size));
 }
diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c
index 800f064b0da7..01e251b1da0c 100644
--- a/arch/s390/pci/pci_event.c
+++ b/arch/s390/pci/pci_event.c
@@ -43,9 +43,8 @@ struct zpci_ccdf_avail {
        u16 pec;                        /* PCI event code */
 } __packed;
-void zpci_event_error(void *data)
+static void __zpci_event_error(struct zpci_ccdf_err *ccdf)
 {
-        struct zpci_ccdf_err *ccdf = data;
        struct zpci_dev *zdev = get_zdev_by_fid(ccdf->fid);
        zpci_err("error CCDF:\n");
@@ -58,9 +57,14 @@ void zpci_event_error(void *data)
               pci_name(zdev->pdev), ccdf->pec, ccdf->fid);
 }
-void zpci_event_availability(void *data)
+void zpci_event_error(void *data)
+{
+        if (zpci_is_enabled())
+                __zpci_event_error(data);
+}
+static void __zpci_event_availability(struct zpci_ccdf_avail *ccdf)
 {
-        struct zpci_ccdf_avail *ccdf = data;
        struct zpci_dev *zdev = get_zdev_by_fid(ccdf->fid);
        struct pci_dev *pdev = zdev ? zdev->pdev : NULL;
        int ret;
@@ -75,6 +79,7 @@ void zpci_event_availability(void *data)
                if (!zdev || zdev->state == ZPCI_FN_STATE_CONFIGURED)
                        break;
                zdev->state = ZPCI_FN_STATE_CONFIGURED;
+                zdev->fh = ccdf->fh;
                ret = zpci_enable_device(zdev);
                if (ret)
                        break;
@@ -98,9 +103,14 @@ void zpci_event_availability(void *data)
                break;
        case 0x0304: /* Configured -> Standby */
-                if (pdev)
+                if (pdev) {
+                        /* Give the driver a hint that the function is
+                         * already unusable. */
+                        pdev->error_state = pci_channel_io_perm_failure;
                        pci_stop_and_remove_bus_device(pdev);
+                }
+                zdev->fh = ccdf->fh;
                zpci_disable_device(zdev);
                zdev->state = ZPCI_FN_STATE_STANDBY;
                break;
@@ -108,6 +118,8 @@ void zpci_event_availability(void *data)
                clp_rescan_pci_devices();
                break;
        case 0x0308: /* Standby -> Reserved */
+                if (!zdev)
+                        break;
                pci_stop_root_bus(zdev->bus);
                pci_remove_root_bus(zdev->bus);
                break;
@@ -115,3 +127,9 @@ void zpci_event_availability(void *data)
                break;
        }
 }
+void zpci_event_availability(void *data)
+{
+        if (zpci_is_enabled())
+                __zpci_event_availability(data);
+}
diff --git a/arch/score/include/asm/Kbuild b/arch/score/include/asm/Kbuild
index f3414ade77a3..fe7471eb0167 100644
--- a/arch/score/include/asm/Kbuild
+++ b/arch/score/include/asm/Kbuild
@@ -1,6 +1,7 @@
 header-y +=
+generic-y += barrier.h
 generic-y += clkdev.h
 generic-y += trace_clock.h
 generic-y += xor.h
diff --git a/arch/score/include/asm/barrier.h b/arch/score/include/asm/barrier.h
deleted file mode 100644
index 0eacb6471e6d..000000000000
--- a/arch/score/include/asm/barrier.h
+++ /dev/null
@@ -1,16 +0,0 @@
-#ifndef _ASM_SCORE_BARRIER_H
-#define _ASM_SCORE_BARRIER_H
-#define mb()            barrier()
-#define rmb()           barrier()
-#define wmb()           barrier()
-#define smp_mb()        barrier()
-#define smp_rmb()       barrier()
-#define smp_wmb()       barrier()
-#define read_barrier_depends()          do {} while (0)
-#define smp_read_barrier_depends()      do {} while (0)
-#define set_mb(var, value)              do {var = value; wmb(); } while (0)
-#endif /* _ASM_SCORE_BARRIER_H */
diff --git a/arch/sh/Kconfig b/arch/sh/Kconfig
index 9b0979f4df7a..ce298317a73e 100644
--- a/arch/sh/Kconfig
+++ b/arch/sh/Kconfig
@@ -66,6 +66,7 @@ config SUPERH32
        select PERF_EVENTS
        select ARCH_HIBERNATION_POSSIBLE if MMU
        select SPARSE_IRQ
+        select HAVE_CC_STACKPROTECTOR
 config SUPERH64
        def_bool ARCH = "sh64"
@@ -695,20 +696,6 @@ config SECCOMP
          If unsure, say N.
-config CC_STACKPROTECTOR
-        bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
-        depends on SUPERH32
-        help
-          This option turns on the -fstack-protector GCC feature. This
-          feature puts, at the beginning of functions, a canary value on
-          the stack just before the return address, and validates
-          the value just before actually returning.  Stack based buffer
-          overflows (that need to overwrite this return address) now also
-          overwrite the canary, which gets detected and the attack is then
-          neutralized via a kernel panic.
-          This feature requires gcc version 4.2 or above.
 config SMP
        bool "Symmetric multi-processing support"
        depends on SYS_SUPPORTS_SMP
diff --git a/arch/sh/Makefile b/arch/sh/Makefile
index aed701c7b11b..d4d16e4be07c 100644
--- a/arch/sh/Makefile
+++ b/arch/sh/Makefile
@@ -199,10 +199,6 @@ ifeq ($(CONFIG_DWARF_UNWINDER),y)
  KBUILD_CFLAGS += -fasynchronous-unwind-tables
 endif
-ifeq ($(CONFIG_CC_STACKPROTECTOR),y)
-  KBUILD_CFLAGS += -fstack-protector
-endif
 libs-$(CONFIG_SUPERH32)         := arch/sh/lib/ $(libs-y)
 libs-$(CONFIG_SUPERH64)         := arch/sh/lib64/ $(libs-y)
diff --git a/arch/sh/include/asm/barrier.h b/arch/sh/include/asm/barrier.h
index 72c103dae300..43715308b068 100644
--- a/arch/sh/include/asm/barrier.h
+++ b/arch/sh/include/asm/barrier.h
@@ -26,29 +26,14 @@
 #if defined(CONFIG_CPU_SH4A) || defined(CONFIG_CPU_SH5)
 #define mb()            __asm__ __volatile__ ("synco": : :"memory")
 #define rmb()           mb()
-#define wmb()           __asm__ __volatile__ ("synco": : :"memory")
+#define wmb()           mb()
 #define ctrl_barrier()  __icbi(PAGE_OFFSET)
-#define read_barrier_depends()  do { } while(0)
 #else
-#define mb()            __asm__ __volatile__ ("": : :"memory")
-#define rmb()           mb()
-#define wmb()           __asm__ __volatile__ ("": : :"memory")
 #define ctrl_barrier()  __asm__ __volatile__ ("nop;nop;nop;nop;nop;nop;nop;nop")
-#define read_barrier_depends()  do { } while(0)
-#endif
-#ifdef CONFIG_SMP
-#define smp_mb()        mb()
-#define smp_rmb()       rmb()
-#define smp_wmb()       wmb()
-#define smp_read_barrier_depends()      read_barrier_depends()
-#else
-#define smp_mb()        barrier()
-#define smp_rmb()       barrier()
-#define smp_wmb()       barrier()
-#define smp_read_barrier_depends()      do { } while(0)
 #endif
 #define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
+#include <asm-generic/barrier.h>
 #endif /* __ASM_SH_BARRIER_H */
diff --git a/arch/sh/kernel/sh_ksyms_32.c b/arch/sh/kernel/sh_ksyms_32.c
index 2a0a596ebf67..d77f2f6c7ff0 100644
--- a/arch/sh/kernel/sh_ksyms_32.c
+++ b/arch/sh/kernel/sh_ksyms_32.c
@@ -20,6 +20,11 @@ EXPORT_SYMBOL(csum_partial_copy_generic);
 EXPORT_SYMBOL(copy_page);
 EXPORT_SYMBOL(__clear_user);
 EXPORT_SYMBOL(empty_zero_page);
+#ifdef CONFIG_FLATMEM
+/* need in pfn_valid macro */
+EXPORT_SYMBOL(min_low_pfn);
+EXPORT_SYMBOL(max_low_pfn);
+#endif
 #define DECLARE_EXPORT(name)            \
        extern void name(void);EXPORT_SYMBOL(name)
diff --git a/arch/sparc/include/asm/barrier_32.h b/arch/sparc/include/asm/barrier_32.h
index c1b76654ee76..ae69eda288f4 100644
--- a/arch/sparc/include/asm/barrier_32.h
+++ b/arch/sparc/include/asm/barrier_32.h
@@ -1,15 +1,7 @@
 #ifndef __SPARC_BARRIER_H
 #define __SPARC_BARRIER_H
-/* XXX Change this if we ever use a PSO mode kernel. */
+#include <asm/processor.h> /* for nop() */
-#define mb()    __asm__ __volatile__ ("" : : : "memory")
+#include <asm-generic/barrier.h>
-#define rmb()   mb()
-#define wmb()   mb()
-#define read_barrier_depends()  do { } while(0)
-#define set_mb(__var, __value)  do { __var = __value; mb(); } while(0)
-#define smp_mb()        __asm__ __volatile__("":::"memory")
-#define smp_rmb()       __asm__ __volatile__("":::"memory")
-#define smp_wmb()       __asm__ __volatile__("":::"memory")
-#define smp_read_barrier_depends()      do { } while(0)
 #endif /* !(__SPARC_BARRIER_H) */
diff --git a/arch/sparc/include/asm/barrier_64.h b/arch/sparc/include/asm/barrier_64.h
index 95d45986f908..b5aad964558e 100644
--- a/arch/sparc/include/asm/barrier_64.h
+++ b/arch/sparc/include/asm/barrier_64.h
@@ -53,4 +53,19 @@ do {	__asm__ __volatile__("ba,pt	%%xcc, 1f\n\t" \
 #define smp_read_barrier_depends()      do { } while(0)
+#define smp_store_release(p, v)                                         \
+do {                                                                    \
+        compiletime_assert_atomic_type(*p);                             \
+        barrier();                                                      \
+        ACCESS_ONCE(*p) = (v);                                          \
+} while (0)
+#define smp_load_acquire(p)                                             \
+({                                                                      \
+        typeof(*p) ___p1 = ACCESS_ONCE(*p);                             \
+        compiletime_assert_atomic_type(*p);                             \
+        barrier();                                                      \
+        ___p1;                                                          \
+})
 #endif /* !(__SPARC64_BARRIER_H) */
diff --git a/arch/sparc/include/asm/uaccess_64.h b/arch/sparc/include/asm/uaccess_64.h
index e562d3caee57..ad7e178337f1 100644
--- a/arch/sparc/include/asm/uaccess_64.h
+++ b/arch/sparc/include/asm/uaccess_64.h
@@ -262,8 +262,8 @@ extern unsigned long __must_check __clear_user(void __user *, unsigned long);
 extern __must_check long strlen_user(const char __user *str);
 extern __must_check long strnlen_user(const char __user *str, long n);
-#define __copy_to_user_inatomic ___copy_to_user
+#define __copy_to_user_inatomic __copy_to_user
-#define __copy_from_user_inatomic ___copy_from_user
+#define __copy_from_user_inatomic __copy_from_user
 struct pt_regs;
 extern unsigned long compute_effective_address(struct pt_regs *,
diff --git a/arch/sparc/kernel/iommu.c b/arch/sparc/kernel/iommu.c
index 070ed141aac7..76663b019eb5 100644
--- a/arch/sparc/kernel/iommu.c
+++ b/arch/sparc/kernel/iommu.c
@@ -854,7 +854,7 @@ int dma_supported(struct device *dev, u64 device_mask)
                return 1;
 #ifdef CONFIG_PCI
-        if (dev->bus == &pci_bus_type)
+        if (dev_is_pci(dev))
                return pci64_dma_supported(to_pci_dev(dev), device_mask);
 #endif
diff --git a/arch/sparc/kernel/ioport.c b/arch/sparc/kernel/ioport.c
index 2096468de9b2..e7e215dfa866 100644
--- a/arch/sparc/kernel/ioport.c
+++ b/arch/sparc/kernel/ioport.c
@@ -666,10 +666,9 @@ EXPORT_SYMBOL(dma_ops);
 */
 int dma_supported(struct device *dev, u64 mask)
 {
-#ifdef CONFIG_PCI
+        if (dev_is_pci(dev))
-        if (dev->bus == &pci_bus_type)
                return 1;
-#endif
        return 0;
 }
 EXPORT_SYMBOL(dma_supported);
diff --git a/arch/sparc/kernel/kgdb_64.c b/arch/sparc/kernel/kgdb_64.c
index 60b19f50c80a..b45fe3fb4d2c 100644
--- a/arch/sparc/kernel/kgdb_64.c
+++ b/arch/sparc/kernel/kgdb_64.c
@@ -6,6 +6,7 @@
 #include <linux/kgdb.h>
 #include <linux/kdebug.h>
 #include <linux/ftrace.h>
+#include <linux/context_tracking.h>
 #include <asm/cacheflush.h>
 #include <asm/kdebug.h>
diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index b66a5338231e..b085311dcd0e 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c
@@ -123,11 +123,12 @@ void smp_callin(void)
                rmb();
        set_cpu_online(cpuid, true);
-        local_irq_enable();
        /* idle thread is expected to have preempt disabled */
        preempt_disable();
+        local_irq_enable();
        cpu_startup_entry(CPUHP_ONLINE);
 }
diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
index 218b6b23c378..01fe9946d388 100644
--- a/arch/sparc/net/bpf_jit_comp.c
+++ b/arch/sparc/net/bpf_jit_comp.c
@@ -497,9 +497,20 @@ void bpf_jit_compile(struct sk_filter *fp)
                        case BPF_S_ALU_MUL_K:   /* A *= K */
                                emit_alu_K(MUL, K);
                                break;
-                        case BPF_S_ALU_DIV_K:   /* A /= K */
+                        case BPF_S_ALU_DIV_K:   /* A /= K with K != 0*/
-                                emit_alu_K(MUL, K);
+                                if (K == 1)
-                                emit_read_y(r_A);
+                                        break;
+                                emit_write_y(G0);
+#ifdef CONFIG_SPARC32
+                                /* The Sparc v8 architecture requires
+                                 * three instructions between a %y
+                                 * register write and the first use.
+                                 */
+                                emit_nop();
+                                emit_nop();
+                                emit_nop();
+#endif
+                                emit_alu_K(DIV, K);
                                break;
                        case BPF_S_ALU_DIV_X:   /* A /= X; */
                                emit_cmpi(r_X, 0);
diff --git a/arch/tile/include/asm/barrier.h b/arch/tile/include/asm/barrier.h
index a9a73da5865d..b5a05d050a8f 100644
--- a/arch/tile/include/asm/barrier.h
+++ b/arch/tile/include/asm/barrier.h
@@ -22,59 +22,6 @@
 #include <arch/spr_def.h>
 #include <asm/timex.h>
-/*
- * read_barrier_depends - Flush all pending reads that subsequents reads
- * depend on.
- *
- * No data-dependent reads from memory-like regions are ever reordered
- * over this barrier.  All reads preceding this primitive are guaranteed
- * to access memory (but not necessarily other CPUs' caches) before any
- * reads following this primitive that depend on the data return by
- * any of the preceding reads.  This primitive is much lighter weight than
- * rmb() on most CPUs, and is never heavier weight than is
- * rmb().
- *
- * These ordering constraints are respected by both the local CPU
- * and the compiler.
- *
- * Ordering is not guaranteed by anything other than these primitives,
- * not even by data dependencies.  See the documentation for
- * memory_barrier() for examples and URLs to more information.
- *
- * For example, the following code would force ordering (the initial
- * value of "a" is zero, "b" is one, and "p" is "&a"):
- *
- * <programlisting>
- *      CPU 0                           CPU 1
- *
- *      b = 2;
- *      memory_barrier();
- *      p = &b;                         q = p;
- *                                      read_barrier_depends();
- *                                      d = *q;
- * </programlisting>
- *
- * because the read of "*q" depends on the read of "p" and these
- * two reads are separated by a read_barrier_depends().  However,
- * the following code, with the same initial values for "a" and "b":
- *
- * <programlisting>
- *      CPU 0                           CPU 1
- *
- *      a = 2;
- *      memory_barrier();
- *      b = 3;                          y = b;
- *                                      read_barrier_depends();
- *                                      x = a;
- * </programlisting>
- *
- * does not enforce ordering, since there is no data dependency between
- * the read of "a" and the read of "b".  Therefore, on some CPUs, such
- * as Alpha, "y" could be set to 3 and "x" to 0.  Use rmb()
- * in cases like this where there are no data dependencies.
- */
-#define read_barrier_depends()  do { } while (0)
 #define __sync()        __insn_mf()
 #include <hv/syscall_public.h>
@@ -125,20 +72,7 @@ mb_incoherent(void)
 #define mb()            fast_mb()
 #define iob()           fast_iob()
-#ifdef CONFIG_SMP
+#include <asm-generic/barrier.h>
-#define smp_mb()        mb()
-#define smp_rmb()       rmb()
-#define smp_wmb()       wmb()
-#define smp_read_barrier_depends()      read_barrier_depends()
-#else
-#define smp_mb()        barrier()
-#define smp_rmb()       barrier()
-#define smp_wmb()       barrier()
-#define smp_read_barrier_depends()      do { } while (0)
-#endif
-#define set_mb(var, value) \
-        do { var = value; mb(); } while (0)
 #endif /* !__ASSEMBLY__ */
 #endif /* _ASM_TILE_BARRIER_H */
diff --git a/arch/unicore32/include/asm/barrier.h b/arch/unicore32/include/asm/barrier.h
index a6620e5336b6..83d6a520f4bd 100644
--- a/arch/unicore32/include/asm/barrier.h
+++ b/arch/unicore32/include/asm/barrier.h
@@ -14,15 +14,6 @@
 #define dsb() __asm__ __volatile__ ("" : : : "memory")
 #define dmb() __asm__ __volatile__ ("" : : : "memory")
-#define mb()                            barrier()
+#include <asm-generic/barrier.h>
-#define rmb()                           barrier()
-#define wmb()                           barrier()
-#define smp_mb()                        barrier()
-#define smp_rmb()                       barrier()
-#define smp_wmb()                       barrier()
-#define read_barrier_depends()          do { } while (0)
-#define smp_read_barrier_depends()      do { } while (0)
-#define set_mb(var, value)              do { var = value; smp_mb(); } while (0)
 #endif /* __UNICORE_BARRIER_H__ */
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 0952ecd60eca..cd18b8393400 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -125,6 +125,7 @@ config X86
        select RTC_LIB
        select HAVE_DEBUG_STACKOVERFLOW
        select HAVE_IRQ_EXIT_ON_IRQ_STACK if X86_64
+        select HAVE_CC_STACKPROTECTOR
 config INSTRUCTION_DECODER
        def_bool y
@@ -438,42 +439,26 @@ config X86_INTEL_CE
          This option compiles in support for the CE4100 SOC for settop
          boxes and media devices.
-config X86_WANT_INTEL_MID
+config X86_INTEL_MID
        bool "Intel MID platform support"
        depends on X86_32
        depends on X86_EXTENDED_PLATFORM
-        ---help---
-          Select to build a kernel capable of supporting Intel MID platform
-          systems which do not have the PCI legacy interfaces (Moorestown,
-          Medfield). If you are building for a PC class system say N here.
-if X86_WANT_INTEL_MID
-config X86_INTEL_MID
-        bool
-config X86_MDFLD
-       bool "Medfield MID platform"
        depends on PCI
        depends on PCI_GOANY
        depends on X86_IO_APIC
-        select X86_INTEL_MID
        select SFI
+        select I2C
        select DW_APB_TIMER
        select APB_TIMER
-        select I2C
-        select SPI
        select INTEL_SCU_IPC
-        select X86_PLATFORM_DEVICES
        select MFD_INTEL_MSIC
        ---help---
-          Medfield is Intel's Low Power Intel Architecture (LPIA) based Moblin
+          Select to build a kernel capable of supporting Intel MID (Mobile
-          Internet Device(MID) platform. 
+          Internet Device) platform systems which do not have the PCI legacy
-          Unlike standard x86 PCs, Medfield does not have many legacy devices
+          interfaces. If you are building for a PC class system say N here.
-          nor standard legacy replacement devices/features. e.g. Medfield does
-          not contain i8259, i8254, HPET, legacy BIOS, most of the io ports.
-endif
+          Intel MID platforms are based on an Intel processor and chipset which
+          consume less power than most of the x86 derivatives.
 config X86_INTEL_LPSS
        bool "Intel Low Power Subsystem Support"
@@ -1080,10 +1065,6 @@ config MICROCODE_OLD_INTERFACE
        def_bool y
        depends on MICROCODE
-config MICROCODE_INTEL_LIB
-        def_bool y
-        depends on MICROCODE_INTEL
 config MICROCODE_INTEL_EARLY
        def_bool n
@@ -1617,22 +1598,6 @@ config SECCOMP
          If unsure, say Y. Only embedded should say N here.
-config CC_STACKPROTECTOR
-        bool "Enable -fstack-protector buffer overflow detection"
-        ---help---
-          This option turns on the -fstack-protector GCC feature. This
-          feature puts, at the beginning of functions, a canary value on
-          the stack just before the return address, and validates
-          the value just before actually returning.  Stack based buffer
-          overflows (that need to overwrite this return address) now also
-          overwrite the canary, which gets detected and the attack is then
-          neutralized via a kernel panic.
-          This feature requires gcc version 4.2 or above, or a distribution
-          gcc with the feature backported. Older versions are automatically
-          detected and for those versions, this configuration option is
-          ignored. (and a warning is printed during bootup)
 source kernel/Kconfig.hz
 config KEXEC
@@ -1728,16 +1693,67 @@ config RELOCATABLE
          Note: If CONFIG_RELOCATABLE=y, then the kernel runs from the address
          it has been loaded at and the compile time physical address
-          (CONFIG_PHYSICAL_START) is ignored.
+          (CONFIG_PHYSICAL_START) is used as the minimum location.
-# Relocation on x86-32 needs some additional build support
+config RANDOMIZE_BASE
+        bool "Randomize the address of the kernel image"
+        depends on RELOCATABLE
+        depends on !HIBERNATION
+        default n
+        ---help---
+           Randomizes the physical and virtual address at which the
+           kernel image is decompressed, as a security feature that
+           deters exploit attempts relying on knowledge of the location
+           of kernel internals.
+           Entropy is generated using the RDRAND instruction if it is
+           supported. If RDTSC is supported, it is used as well. If
+           neither RDRAND nor RDTSC are supported, then randomness is
+           read from the i8254 timer.
+           The kernel will be offset by up to RANDOMIZE_BASE_MAX_OFFSET,
+           and aligned according to PHYSICAL_ALIGN. Since the kernel is
+           built using 2GiB addressing, and PHYSICAL_ALGIN must be at a
+           minimum of 2MiB, only 10 bits of entropy is theoretically
+           possible. At best, due to page table layouts, 64-bit can use
+           9 bits of entropy and 32-bit uses 8 bits.
+           If unsure, say N.
+config RANDOMIZE_BASE_MAX_OFFSET
+        hex "Maximum kASLR offset allowed" if EXPERT
+        depends on RANDOMIZE_BASE
+        range 0x0 0x20000000 if X86_32
+        default "0x20000000" if X86_32
+        range 0x0 0x40000000 if X86_64
+        default "0x40000000" if X86_64
+        ---help---
+          The lesser of RANDOMIZE_BASE_MAX_OFFSET and available physical
+          memory is used to determine the maximal offset in bytes that will
+          be applied to the kernel when kernel Address Space Layout
+          Randomization (kASLR) is active. This must be a multiple of
+          PHYSICAL_ALIGN.
+          On 32-bit this is limited to 512MiB by page table layouts. The
+          default is 512MiB.
+          On 64-bit this is limited by how the kernel fixmap page table is
+          positioned, so this cannot be larger than 1GiB currently. Without
+          RANDOMIZE_BASE, there is a 512MiB to 1.5GiB split between kernel
+          and modules. When RANDOMIZE_BASE_MAX_OFFSET is above 512MiB, the
+          modules area will shrink to compensate, up to the current maximum
+          1GiB to 1GiB split. The default is 1GiB.
+          If unsure, leave at the default value.
+# Relocation on x86 needs some additional build support
 config X86_NEED_RELOCS
        def_bool y
-        depends on X86_32 && RELOCATABLE
+        depends on RANDOMIZE_BASE || (X86_32 && RELOCATABLE)
 config PHYSICAL_ALIGN
        hex "Alignment value to which kernel should be aligned"
-        default "0x1000000"
+        default "0x200000"
        range 0x2000 0x1000000 if X86_32
        range 0x200000 0x1000000 if X86_64
        ---help---
@@ -2393,6 +2409,14 @@ config X86_DMA_REMAP
        bool
        depends on STA2X11
+config IOSF_MBI
+        bool
+        depends on PCI
+        ---help---
+          To be selected by modules requiring access to the Intel OnChip System
+          Fabric (IOSF) Sideband MailBox Interface (MBI). For MBI platforms
+          enumerable by PCI.
 source "net/Kconfig"
 source "drivers/Kconfig"
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index 57d021507120..13b22e0f681d 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -89,13 +89,11 @@ else
        KBUILD_CFLAGS += -maccumulate-outgoing-args
 endif
+# Make sure compiler does not have buggy stack-protector support.
 ifdef CONFIG_CC_STACKPROTECTOR
        cc_has_sp := $(srctree)/scripts/gcc-x86_$(BITS)-has-stack-protector.sh
-        ifeq ($(shell $(CONFIG_SHELL) $(cc_has_sp) $(CC) $(KBUILD_CPPFLAGS) $(biarch)),y)
+        ifneq ($(shell $(CONFIG_SHELL) $(cc_has_sp) $(CC) $(KBUILD_CPPFLAGS) $(biarch)),y)
-                stackp-y := -fstack-protector
+                $(warning stack-protector enabled but compiler support broken)
-                KBUILD_CFLAGS += $(stackp-y)
-        else
-                $(warning stack protector enabled but no compiler support)
        endif
 endif
diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile
index d9c11956fce0..de7066918005 100644
--- a/arch/x86/boot/Makefile
+++ b/arch/x86/boot/Makefile
@@ -20,7 +20,7 @@ targets		:= vmlinux.bin setup.bin setup.elf bzImage
 targets         += fdimage fdimage144 fdimage288 image.iso mtools.conf
 subdir-         := compressed
-setup-y         += a20.o bioscall.o cmdline.o copy.o cpu.o cpucheck.o
+setup-y         += a20.o bioscall.o cmdline.o copy.o cpu.o cpuflags.o cpucheck.o
 setup-y         += early_serial_console.o edd.o header.o main.o mca.o memory.o
 setup-y         += pm.o pmjump.o printf.o regs.o string.o tty.o video.o
 setup-y         += video-mode.o version.o
diff --git a/arch/x86/boot/bioscall.S b/arch/x86/boot/bioscall.S
index 1dfbf64e52a2..d401b4a262b0 100644
--- a/arch/x86/boot/bioscall.S
+++ b/arch/x86/boot/bioscall.S
@@ -1,6 +1,6 @@
 /* -----------------------------------------------------------------------
 *
- *   Copyright 2009 Intel Corporation; author H. Peter Anvin
+ *   Copyright 2009-2014 Intel Corporation; author H. Peter Anvin
 *
 *   This file is part of the Linux kernel, and is made available under
 *   the terms of the GNU General Public License version 2 or (at your
@@ -13,8 +13,8 @@
 * touching registers they shouldn't be.
 */
-        .code16gcc
+        .code16
-        .text
+        .section ".inittext","ax"
        .globl  intcall
        .type   intcall, @function
 intcall:
diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
index ef72baeff484..50f8c5e0f37e 100644
--- a/arch/x86/boot/boot.h
+++ b/arch/x86/boot/boot.h
@@ -26,9 +26,8 @@
 #include <asm/boot.h>
 #include <asm/setup.h>
 #include "bitops.h"
-#include <asm/cpufeature.h>
-#include <asm/processor-flags.h>
 #include "ctype.h"
+#include "cpuflags.h"
 /* Useful macros */
 #define BUILD_BUG_ON(condition) ((void)sizeof(char[1 - 2*!!(condition)]))
@@ -307,14 +306,7 @@ static inline int cmdline_find_option_bool(const char *option)
        return __cmdline_find_option_bool(cmd_line_ptr, option);
 }
 /* cpu.c, cpucheck.c */
-struct cpu_features {
-        int level;              /* Family, or 64 for x86-64 */
-        int model;
-        u32 flags[NCAPINTS];
-};
-extern struct cpu_features cpu;
 int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr);
 int validate_cpu(void);
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index c8a6792e7842..0fcd9133790c 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -28,7 +28,7 @@ HOST_EXTRACFLAGS += -I$(srctree)/tools/include
 VMLINUX_OBJS = $(obj)/vmlinux.lds $(obj)/head_$(BITS).o $(obj)/misc.o \
        $(obj)/string.o $(obj)/cmdline.o $(obj)/early_serial_console.o \
-        $(obj)/piggy.o
+        $(obj)/piggy.o $(obj)/cpuflags.o $(obj)/aslr.o
 $(obj)/eboot.o: KBUILD_CFLAGS += -fshort-wchar -mno-red-zone
diff --git a/arch/x86/boot/compressed/aslr.c b/arch/x86/boot/compressed/aslr.c
new file mode 100644
index 000000000000..90a21f430117
--- /dev/null
+++ b/arch/x86/boot/compressed/aslr.c
@@ -0,0 +1,316 @@
+#include "misc.h"
+#ifdef CONFIG_RANDOMIZE_BASE
+#include <asm/msr.h>
+#include <asm/archrandom.h>
+#include <asm/e820.h>
+#include <generated/compile.h>
+#include <linux/module.h>
+#include <linux/uts.h>
+#include <linux/utsname.h>
+#include <generated/utsrelease.h>
+/* Simplified build-specific string for starting entropy. */
+static const char build_str[] = UTS_RELEASE " (" LINUX_COMPILE_BY "@"
+                LINUX_COMPILE_HOST ") (" LINUX_COMPILER ") " UTS_VERSION;
+#define I8254_PORT_CONTROL      0x43
+#define I8254_PORT_COUNTER0     0x40
+#define I8254_CMD_READBACK      0xC0
+#define I8254_SELECT_COUNTER0   0x02
+#define I8254_STATUS_NOTREADY   0x40
+static inline u16 i8254(void)
+{
+        u16 status, timer;
+        do {
+                outb(I8254_PORT_CONTROL,
+                     I8254_CMD_READBACK | I8254_SELECT_COUNTER0);
+                status = inb(I8254_PORT_COUNTER0);
+                timer  = inb(I8254_PORT_COUNTER0);
+                timer |= inb(I8254_PORT_COUNTER0) << 8;
+        } while (status & I8254_STATUS_NOTREADY);
+        return timer;
+}
+static unsigned long rotate_xor(unsigned long hash, const void *area,
+                                size_t size)
+{
+        size_t i;
+        unsigned long *ptr = (unsigned long *)area;
+        for (i = 0; i < size / sizeof(hash); i++) {
+                /* Rotate by odd number of bits and XOR. */
+                hash = (hash << ((sizeof(hash) * 8) - 7)) | (hash >> 7);
+                hash ^= ptr[i];
+        }
+        return hash;
+}
+/* Attempt to create a simple but unpredictable starting entropy. */
+static unsigned long get_random_boot(void)
+{
+        unsigned long hash = 0;
+        hash = rotate_xor(hash, build_str, sizeof(build_str));
+        hash = rotate_xor(hash, real_mode, sizeof(*real_mode));
+        return hash;
+}
+static unsigned long get_random_long(void)
+{
+#ifdef CONFIG_X86_64
+        const unsigned long mix_const = 0x5d6008cbf3848dd3UL;
+#else
+        const unsigned long mix_const = 0x3f39e593UL;
+#endif
+        unsigned long raw, random = get_random_boot();
+        bool use_i8254 = true;
+        debug_putstr("KASLR using");
+        if (has_cpuflag(X86_FEATURE_RDRAND)) {
+                debug_putstr(" RDRAND");
+                if (rdrand_long(&raw)) {
+                        random ^= raw;
+                        use_i8254 = false;
+                }
+        }
+        if (has_cpuflag(X86_FEATURE_TSC)) {
+                debug_putstr(" RDTSC");
+                rdtscll(raw);
+                random ^= raw;
+                use_i8254 = false;
+        }
+        if (use_i8254) {
+                debug_putstr(" i8254");
+                random ^= i8254();
+        }
+        /* Circular multiply for better bit diffusion */
+        asm("mul %3"
+            : "=a" (random), "=d" (raw)
+            : "a" (random), "rm" (mix_const));
+        random += raw;
+        debug_putstr("...\n");
+        return random;
+}
+struct mem_vector {
+        unsigned long start;
+        unsigned long size;
+};
+#define MEM_AVOID_MAX 5
+struct mem_vector mem_avoid[MEM_AVOID_MAX];
+static bool mem_contains(struct mem_vector *region, struct mem_vector *item)
+{
+        /* Item at least partially before region. */
+        if (item->start < region->start)
+                return false;
+        /* Item at least partially after region. */
+        if (item->start + item->size > region->start + region->size)
+                return false;
+        return true;
+}
+static bool mem_overlaps(struct mem_vector *one, struct mem_vector *two)
+{
+        /* Item one is entirely before item two. */
+        if (one->start + one->size <= two->start)
+                return false;
+        /* Item one is entirely after item two. */
+        if (one->start >= two->start + two->size)
+                return false;
+        return true;
+}
+static void mem_avoid_init(unsigned long input, unsigned long input_size,
+                           unsigned long output, unsigned long output_size)
+{
+        u64 initrd_start, initrd_size;
+        u64 cmd_line, cmd_line_size;
+        unsigned long unsafe, unsafe_len;
+        char *ptr;
+        /*
+         * Avoid the region that is unsafe to overlap during
+         * decompression (see calculations at top of misc.c).
+         */
+        unsafe_len = (output_size >> 12) + 32768 + 18;
+        unsafe = (unsigned long)input + input_size - unsafe_len;
+        mem_avoid[0].start = unsafe;
+        mem_avoid[0].size = unsafe_len;
+        /* Avoid initrd. */
+        initrd_start  = (u64)real_mode->ext_ramdisk_image << 32;
+        initrd_start |= real_mode->hdr.ramdisk_image;
+        initrd_size  = (u64)real_mode->ext_ramdisk_size << 32;
+        initrd_size |= real_mode->hdr.ramdisk_size;
+        mem_avoid[1].start = initrd_start;
+        mem_avoid[1].size = initrd_size;
+        /* Avoid kernel command line. */
+        cmd_line  = (u64)real_mode->ext_cmd_line_ptr << 32;
+        cmd_line |= real_mode->hdr.cmd_line_ptr;
+        /* Calculate size of cmd_line. */
+        ptr = (char *)(unsigned long)cmd_line;
+        for (cmd_line_size = 0; ptr[cmd_line_size++]; )
+                ;
+        mem_avoid[2].start = cmd_line;
+        mem_avoid[2].size = cmd_line_size;
+        /* Avoid heap memory. */
+        mem_avoid[3].start = (unsigned long)free_mem_ptr;
+        mem_avoid[3].size = BOOT_HEAP_SIZE;
+        /* Avoid stack memory. */
+        mem_avoid[4].start = (unsigned long)free_mem_end_ptr;
+        mem_avoid[4].size = BOOT_STACK_SIZE;
+}
+/* Does this memory vector overlap a known avoided area? */
+bool mem_avoid_overlap(struct mem_vector *img)
+{
+        int i;
+        for (i = 0; i < MEM_AVOID_MAX; i++) {
+                if (mem_overlaps(img, &mem_avoid[i]))
+                        return true;
+        }
+        return false;
+}
+unsigned long slots[CONFIG_RANDOMIZE_BASE_MAX_OFFSET / CONFIG_PHYSICAL_ALIGN];
+unsigned long slot_max = 0;
+static void slots_append(unsigned long addr)
+{
+        /* Overflowing the slots list should be impossible. */
+        if (slot_max >= CONFIG_RANDOMIZE_BASE_MAX_OFFSET /
+                        CONFIG_PHYSICAL_ALIGN)
+                return;
+        slots[slot_max++] = addr;
+}
+static unsigned long slots_fetch_random(void)
+{
+        /* Handle case of no slots stored. */
+        if (slot_max == 0)
+                return 0;
+        return slots[get_random_long() % slot_max];
+}
+static void process_e820_entry(struct e820entry *entry,
+                               unsigned long minimum,
+                               unsigned long image_size)
+{
+        struct mem_vector region, img;
+        /* Skip non-RAM entries. */
+        if (entry->type != E820_RAM)
+                return;
+        /* Ignore entries entirely above our maximum. */
+        if (entry->addr >= CONFIG_RANDOMIZE_BASE_MAX_OFFSET)
+                return;
+        /* Ignore entries entirely below our minimum. */
+        if (entry->addr + entry->size < minimum)
+                return;
+        region.start = entry->addr;
+        region.size = entry->size;
+        /* Potentially raise address to minimum location. */
+        if (region.start < minimum)
+                region.start = minimum;
+        /* Potentially raise address to meet alignment requirements. */
+        region.start = ALIGN(region.start, CONFIG_PHYSICAL_ALIGN);
+        /* Did we raise the address above the bounds of this e820 region? */
+        if (region.start > entry->addr + entry->size)
+                return;
+        /* Reduce size by any delta from the original address. */
+        region.size -= region.start - entry->addr;
+        /* Reduce maximum size to fit end of image within maximum limit. */
+        if (region.start + region.size > CONFIG_RANDOMIZE_BASE_MAX_OFFSET)
+                region.size = CONFIG_RANDOMIZE_BASE_MAX_OFFSET - region.start;
+        /* Walk each aligned slot and check for avoided areas. */
+        for (img.start = region.start, img.size = image_size ;
+             mem_contains(&region, &img) ;
+             img.start += CONFIG_PHYSICAL_ALIGN) {
+                if (mem_avoid_overlap(&img))
+                        continue;
+                slots_append(img.start);
+        }
+}
+static unsigned long find_random_addr(unsigned long minimum,
+                                      unsigned long size)
+{
+        int i;
+        unsigned long addr;
+        /* Make sure minimum is aligned. */
+        minimum = ALIGN(minimum, CONFIG_PHYSICAL_ALIGN);
+        /* Verify potential e820 positions, appending to slots list. */
+        for (i = 0; i < real_mode->e820_entries; i++) {
+                process_e820_entry(&real_mode->e820_map[i], minimum, size);
+        }
+        return slots_fetch_random();
+}
+unsigned char *choose_kernel_location(unsigned char *input,
+                                      unsigned long input_size,
+                                      unsigned char *output,
+                                      unsigned long output_size)
+{
+        unsigned long choice = (unsigned long)output;
+        unsigned long random;
+        if (cmdline_find_option_bool("nokaslr")) {
+                debug_putstr("KASLR disabled...\n");
+                goto out;
+        }
+        /* Record the various known unsafe memory ranges. */
+        mem_avoid_init((unsigned long)input, input_size,
+                       (unsigned long)output, output_size);
+        /* Walk e820 and find a random address. */
+        random = find_random_addr(choice, output_size);
+        if (!random) {
+                debug_putstr("KASLR could not find suitable E820 region...\n");
+                goto out;
+        }
+        /* Always enforce the minimum. */
+        if (random < choice)
+                goto out;
+        choice = random;
+out:
+        return (unsigned char *)choice;
+}
+#endif /* CONFIG_RANDOMIZE_BASE */
diff --git a/arch/x86/boot/compressed/cmdline.c b/arch/x86/boot/compressed/cmdline.c
index bffd73b45b1f..b68e3033e6b9 100644
--- a/arch/x86/boot/compressed/cmdline.c
+++ b/arch/x86/boot/compressed/cmdline.c
@@ -1,6 +1,6 @@
 #include "misc.h"
-#ifdef CONFIG_EARLY_PRINTK
+#if CONFIG_EARLY_PRINTK || CONFIG_RANDOMIZE_BASE
 static unsigned long fs;
 static inline void set_fs(unsigned long seg)
diff --git a/arch/x86/boot/compressed/cpuflags.c b/arch/x86/boot/compressed/cpuflags.c
new file mode 100644
index 000000000000..aa313466118b
--- /dev/null
+++ b/arch/x86/boot/compressed/cpuflags.c
@@ -0,0 +1,12 @@
+#ifdef CONFIG_RANDOMIZE_BASE
+#include "../cpuflags.c"
+bool has_cpuflag(int flag)
+{
+        get_cpuflags();
+        return test_bit(flag, cpu.flags);
+}
+#endif
diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
index 5d6f6891b188..9116aac232c7 100644
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -117,9 +117,11 @@ preferred_addr:
        addl    %eax, %ebx
        notl    %eax
        andl    %eax, %ebx
-#else
+        cmpl    $LOAD_PHYSICAL_ADDR, %ebx
-        movl    $LOAD_PHYSICAL_ADDR, %ebx
+        jge     1f
 #endif
+        movl    $LOAD_PHYSICAL_ADDR, %ebx
+1:
        /* Target address to relocate to for decompression */
        addl    $z_extract_offset, %ebx
@@ -191,14 +193,14 @@ relocated:
        leal    boot_heap(%ebx), %eax
        pushl   %eax            /* heap area */
        pushl   %esi            /* real mode pointer */
-        call    decompress_kernel
+        call    decompress_kernel /* returns kernel location in %eax */
        addl    $24, %esp
 /*
 * Jump to the decompressed kernel.
 */
        xorl    %ebx, %ebx
-        jmp     *%ebp
+        jmp     *%eax
 /*
 * Stack and heap for uncompression
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index c337422b575d..c5c1ae0997e7 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -94,9 +94,11 @@ ENTRY(startup_32)
        addl    %eax, %ebx
        notl    %eax
        andl    %eax, %ebx
-#else
+        cmpl    $LOAD_PHYSICAL_ADDR, %ebx
-        movl    $LOAD_PHYSICAL_ADDR, %ebx
+        jge     1f
 #endif
+        movl    $LOAD_PHYSICAL_ADDR, %ebx
+1:
        /* Target address to relocate to for decompression */
        addl    $z_extract_offset, %ebx
@@ -269,9 +271,11 @@ preferred_addr:
        addq    %rax, %rbp
        notq    %rax
        andq    %rax, %rbp
-#else
+        cmpq    $LOAD_PHYSICAL_ADDR, %rbp
-        movq    $LOAD_PHYSICAL_ADDR, %rbp
+        jge     1f
 #endif
+        movq    $LOAD_PHYSICAL_ADDR, %rbp
+1:
        /* Target address to relocate to for decompression */
        leaq    z_extract_offset(%rbp), %rbx
@@ -339,13 +343,13 @@ relocated:
        movl    $z_input_len, %ecx      /* input_len */
        movq    %rbp, %r8               /* output target address */
        movq    $z_output_len, %r9      /* decompressed length */
-        call    decompress_kernel
+        call    decompress_kernel       /* returns kernel location in %rax */
        popq    %rsi
 /*
 * Jump to the decompressed kernel.
 */
-        jmp     *%rbp
+        jmp     *%rax
        .code32
 no_longmode:
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 434f077d2c4d..196eaf373a06 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -112,14 +112,8 @@ struct boot_params *real_mode;		/* Pointer to real-mode data */
 void *memset(void *s, int c, size_t n);
 void *memcpy(void *dest, const void *src, size_t n);
-#ifdef CONFIG_X86_64
+memptr free_mem_ptr;
-#define memptr long
+memptr free_mem_end_ptr;
-#else
-#define memptr unsigned
-#endif
-static memptr free_mem_ptr;
-static memptr free_mem_end_ptr;
 static char *vidmem;
 static int vidport;
@@ -395,7 +389,7 @@ static void parse_elf(void *output)
        free(phdrs);
 }
-asmlinkage void decompress_kernel(void *rmode, memptr heap,
+asmlinkage void *decompress_kernel(void *rmode, memptr heap,
                                  unsigned char *input_data,
                                  unsigned long input_len,
                                  unsigned char *output,
@@ -422,6 +416,10 @@ asmlinkage void decompress_kernel(void *rmode, memptr heap,
        free_mem_ptr     = heap;        /* Heap */
        free_mem_end_ptr = heap + BOOT_HEAP_SIZE;
+        output = choose_kernel_location(input_data, input_len,
+                                        output, output_len);
+        /* Validate memory location choices. */
        if ((unsigned long)output & (MIN_KERNEL_ALIGN - 1))
                error("Destination address inappropriately aligned");
 #ifdef CONFIG_X86_64
@@ -441,5 +439,5 @@ asmlinkage void decompress_kernel(void *rmode, memptr heap,
        parse_elf(output);
        handle_relocations(output, output_len);
        debug_putstr("done.\nBooting the kernel.\n");
-        return;
+        return output;
 }
diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h
index 674019d8e235..24e3e569a13c 100644
--- a/arch/x86/boot/compressed/misc.h
+++ b/arch/x86/boot/compressed/misc.h
@@ -23,7 +23,15 @@
 #define BOOT_BOOT_H
 #include "../ctype.h"
+#ifdef CONFIG_X86_64
+#define memptr long
+#else
+#define memptr unsigned
+#endif
 /* misc.c */
+extern memptr free_mem_ptr;
+extern memptr free_mem_end_ptr;
 extern struct boot_params *real_mode;           /* Pointer to real-mode data */
 void __putstr(const char *s);
 #define error_putstr(__x)  __putstr(__x)
@@ -39,23 +47,40 @@ static inline void debug_putstr(const char *s)
 #endif
-#ifdef CONFIG_EARLY_PRINTK
+#if CONFIG_EARLY_PRINTK || CONFIG_RANDOMIZE_BASE
 /* cmdline.c */
 int cmdline_find_option(const char *option, char *buffer, int bufsize);
 int cmdline_find_option_bool(const char *option);
+#endif
-/* early_serial_console.c */
-extern int early_serial_base;
-void console_init(void);
+#if CONFIG_RANDOMIZE_BASE
+/* aslr.c */
+unsigned char *choose_kernel_location(unsigned char *input,
+                                      unsigned long input_size,
+                                      unsigned char *output,
+                                      unsigned long output_size);
+/* cpuflags.c */
+bool has_cpuflag(int flag);
 #else
+static inline
+unsigned char *choose_kernel_location(unsigned char *input,
+                                      unsigned long input_size,
+                                      unsigned char *output,
+                                      unsigned long output_size)
+{
+        return output;
+}
+#endif
+#ifdef CONFIG_EARLY_PRINTK
 /* early_serial_console.c */
+extern int early_serial_base;
+void console_init(void);
+#else
 static const int early_serial_base;
 static inline void console_init(void)
 { }
 #endif
 #endif
diff --git a/arch/x86/boot/copy.S b/arch/x86/boot/copy.S
index 11f272c6f5e9..1eb7d298b47d 100644
--- a/arch/x86/boot/copy.S
+++ b/arch/x86/boot/copy.S
@@ -14,7 +14,7 @@
 * Memory copy routines
 */
-        .code16gcc
+        .code16
        .text
 GLOBAL(memcpy)
@@ -30,7 +30,7 @@ GLOBAL(memcpy)
        rep; movsb
        popw    %di
        popw    %si
-        ret
+        retl
 ENDPROC(memcpy)
 GLOBAL(memset)
@@ -45,25 +45,25 @@ GLOBAL(memset)
        andw    $3, %cx
        rep; stosb
        popw    %di
-        ret
+        retl
 ENDPROC(memset)
 GLOBAL(copy_from_fs)
        pushw   %ds
        pushw   %fs
        popw    %ds
-        call    memcpy
+        calll   memcpy
        popw    %ds
-        ret
+        retl
 ENDPROC(copy_from_fs)
 GLOBAL(copy_to_fs)
        pushw   %es
        pushw   %fs
        popw    %es
-        call    memcpy
+        calll   memcpy
        popw    %es
-        ret
+        retl
 ENDPROC(copy_to_fs)
 #if 0 /* Not currently used, but can be enabled as needed */
@@ -71,17 +71,17 @@ GLOBAL(copy_from_gs)
        pushw   %ds
        pushw   %gs
        popw    %ds
-        call    memcpy
+        calll   memcpy
        popw    %ds
-        ret
+        retl
 ENDPROC(copy_from_gs)
 GLOBAL(copy_to_gs)
        pushw   %es
        pushw   %gs
        popw    %es
-        call    memcpy
+        calll   memcpy
        popw    %es
-        ret
+        retl
 ENDPROC(copy_to_gs)
 #endif
diff --git a/arch/x86/boot/cpucheck.c b/arch/x86/boot/cpucheck.c
index 4d3ff037201f..100a9a10076a 100644
--- a/arch/x86/boot/cpucheck.c
+++ b/arch/x86/boot/cpucheck.c
@@ -28,8 +28,6 @@
 #include <asm/required-features.h>
 #include <asm/msr-index.h>
-struct cpu_features cpu;
-static u32 cpu_vendor[3];
 static u32 err_flags[NCAPINTS];
 static const int req_level = CONFIG_X86_MINIMUM_CPU_FAMILY;
@@ -69,92 +67,8 @@ static int is_transmeta(void)
               cpu_vendor[2] == A32('M', 'x', '8', '6');
 }
-static int has_fpu(void)
-{
-        u16 fcw = -1, fsw = -1;
-        u32 cr0;
-        asm("movl %%cr0,%0" : "=r" (cr0));
-        if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
-                cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
-                asm volatile("movl %0,%%cr0" : : "r" (cr0));
-        }
-        asm volatile("fninit ; fnstsw %0 ; fnstcw %1"
-                     : "+m" (fsw), "+m" (fcw));
-        return fsw == 0 && (fcw & 0x103f) == 0x003f;
-}
-static int has_eflag(u32 mask)
-{
-        u32 f0, f1;
-        asm("pushfl ; "
-            "pushfl ; "
-            "popl %0 ; "
-            "movl %0,%1 ; "
-            "xorl %2,%1 ; "
-            "pushl %1 ; "
-            "popfl ; "
-            "pushfl ; "
-            "popl %1 ; "
-            "popfl"
-            : "=&r" (f0), "=&r" (f1)
-            : "ri" (mask));
-        return !!((f0^f1) & mask);
-}
-static void get_flags(void)
-{
-        u32 max_intel_level, max_amd_level;
-        u32 tfms;
-        if (has_fpu())
-                set_bit(X86_FEATURE_FPU, cpu.flags);
-        if (has_eflag(X86_EFLAGS_ID)) {
-                asm("cpuid"
-                    : "=a" (max_intel_level),
-                      "=b" (cpu_vendor[0]),
-                      "=d" (cpu_vendor[1]),
-                      "=c" (cpu_vendor[2])
-                    : "a" (0));
-                if (max_intel_level >= 0x00000001 &&
-                    max_intel_level <= 0x0000ffff) {
-                        asm("cpuid"
-                            : "=a" (tfms),
-                              "=c" (cpu.flags[4]),
-                              "=d" (cpu.flags[0])
-                            : "a" (0x00000001)
-                            : "ebx");
-                        cpu.level = (tfms >> 8) & 15;
-                        cpu.model = (tfms >> 4) & 15;
-                        if (cpu.level >= 6)
-                                cpu.model += ((tfms >> 16) & 0xf) << 4;
-                }
-                asm("cpuid"
-                    : "=a" (max_amd_level)
-                    : "a" (0x80000000)
-                    : "ebx", "ecx", "edx");
-                if (max_amd_level >= 0x80000001 &&
-                    max_amd_level <= 0x8000ffff) {
-                        u32 eax = 0x80000001;
-                        asm("cpuid"
-                            : "+a" (eax),
-                              "=c" (cpu.flags[6]),
-                              "=d" (cpu.flags[1])
-                            : : "ebx");
-                }
-        }
-}
 /* Returns a bitmask of which words we have error bits in */
-static int check_flags(void)
+static int check_cpuflags(void)
 {
        u32 err;
        int i;
@@ -187,8 +101,8 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
        if (has_eflag(X86_EFLAGS_AC))
                cpu.level = 4;
-        get_flags();
+        get_cpuflags();
-        err = check_flags();
+        err = check_cpuflags();
        if (test_bit(X86_FEATURE_LM, cpu.flags))
                cpu.level = 64;
@@ -207,8 +121,8 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
                eax &= ~(1 << 15);
                asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-                get_flags();    /* Make sure it really did something */
+                get_cpuflags(); /* Make sure it really did something */
-                err = check_flags();
+                err = check_cpuflags();
        } else if (err == 0x01 &&
                   !(err_flags[0] & ~(1 << X86_FEATURE_CX8)) &&
                   is_centaur() && cpu.model >= 6) {
@@ -223,7 +137,7 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
                asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
                set_bit(X86_FEATURE_CX8, cpu.flags);
-                err = check_flags();
+                err = check_cpuflags();
        } else if (err == 0x01 && is_transmeta()) {
                /* Transmeta might have masked feature bits in word 0 */
@@ -238,7 +152,7 @@ int check_cpu(int *cpu_level_ptr, int *req_level_ptr, u32 **err_flags_ptr)
                    : : "ecx", "ebx");
                asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
-                err = check_flags();
+                err = check_cpuflags();
        }
        if (err_flags_ptr)
diff --git a/arch/x86/boot/cpuflags.c b/arch/x86/boot/cpuflags.c
new file mode 100644
index 000000000000..a9fcb7cfb241
--- /dev/null
+++ b/arch/x86/boot/cpuflags.c
@@ -0,0 +1,104 @@
+#include <linux/types.h>
+#include "bitops.h"
+#include <asm/processor-flags.h>
+#include <asm/required-features.h>
+#include <asm/msr-index.h>
+#include "cpuflags.h"
+struct cpu_features cpu;
+u32 cpu_vendor[3];
+static bool loaded_flags;
+static int has_fpu(void)
+{
+        u16 fcw = -1, fsw = -1;
+        unsigned long cr0;
+        asm volatile("mov %%cr0,%0" : "=r" (cr0));
+        if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
+                cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
+                asm volatile("mov %0,%%cr0" : : "r" (cr0));
+        }
+        asm volatile("fninit ; fnstsw %0 ; fnstcw %1"
+                     : "+m" (fsw), "+m" (fcw));
+        return fsw == 0 && (fcw & 0x103f) == 0x003f;
+}
+int has_eflag(unsigned long mask)
+{
+        unsigned long f0, f1;
+        asm volatile("pushf     \n\t"
+                     "pushf     \n\t"
+                     "pop %0    \n\t"
+                     "mov %0,%1 \n\t"
+                     "xor %2,%1 \n\t"
+                     "push %1   \n\t"
+                     "popf      \n\t"
+                     "pushf     \n\t"
+                     "pop %1    \n\t"
+                     "popf"
+                     : "=&r" (f0), "=&r" (f1)
+                     : "ri" (mask));
+        return !!((f0^f1) & mask);
+}
+/* Handle x86_32 PIC using ebx. */
+#if defined(__i386__) && defined(__PIC__)
+# define EBX_REG "=r"
+#else
+# define EBX_REG "=b"
+#endif
+static inline void cpuid(u32 id, u32 *a, u32 *b, u32 *c, u32 *d)
+{
+        asm volatile(".ifnc %%ebx,%3 ; movl  %%ebx,%3 ; .endif  \n\t"
+                     "cpuid                                     \n\t"
+                     ".ifnc %%ebx,%3 ; xchgl %%ebx,%3 ; .endif  \n\t"
+                    : "=a" (*a), "=c" (*c), "=d" (*d), EBX_REG (*b)
+                    : "a" (id)
+        );
+}
+void get_cpuflags(void)
+{
+        u32 max_intel_level, max_amd_level;
+        u32 tfms;
+        u32 ignored;
+        if (loaded_flags)
+                return;
+        loaded_flags = true;
+        if (has_fpu())
+                set_bit(X86_FEATURE_FPU, cpu.flags);
+        if (has_eflag(X86_EFLAGS_ID)) {
+                cpuid(0x0, &max_intel_level, &cpu_vendor[0], &cpu_vendor[2],
+                      &cpu_vendor[1]);
+                if (max_intel_level >= 0x00000001 &&
+                    max_intel_level <= 0x0000ffff) {
+                        cpuid(0x1, &tfms, &ignored, &cpu.flags[4],
+                              &cpu.flags[0]);
+                        cpu.level = (tfms >> 8) & 15;
+                        cpu.model = (tfms >> 4) & 15;
+                        if (cpu.level >= 6)
+                                cpu.model += ((tfms >> 16) & 0xf) << 4;
+                }
+                cpuid(0x80000000, &max_amd_level, &ignored, &ignored,
+                      &ignored);
+                if (max_amd_level >= 0x80000001 &&
+                    max_amd_level <= 0x8000ffff) {
+                        cpuid(0x80000001, &ignored, &ignored, &cpu.flags[6],
+                              &cpu.flags[1]);
+                }
+        }
+}
diff --git a/arch/x86/boot/cpuflags.h b/arch/x86/boot/cpuflags.h
new file mode 100644
index 000000000000..ea97697e51e4
--- /dev/null
+++ b/arch/x86/boot/cpuflags.h
@@ -0,0 +1,19 @@
+#ifndef BOOT_CPUFLAGS_H
+#define BOOT_CPUFLAGS_H
+#include <asm/cpufeature.h>
+#include <asm/processor-flags.h>
+struct cpu_features {
+        int level;              /* Family, or 64 for x86-64 */
+        int model;
+        u32 flags[NCAPINTS];
+};
+extern struct cpu_features cpu;
+extern u32 cpu_vendor[3];
+int has_eflag(unsigned long mask);
+void get_cpuflags(void);
+#endif
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index 9ec06a1f6d61..ec3b8ba68096 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -391,7 +391,14 @@ xloadflags:
 #else
 # define XLF23 0
 #endif
-                        .word XLF0 | XLF1 | XLF23
+#if defined(CONFIG_X86_64) && defined(CONFIG_EFI) && defined(CONFIG_KEXEC)
+# define XLF4 XLF_EFI_KEXEC
+#else
+# define XLF4 0
+#endif
+                        .word XLF0 | XLF1 | XLF23 | XLF4
 cmdline_size:   .long   COMMAND_LINE_SIZE-1     #length of the command line,
                                                #added with boot protocol
diff --git a/arch/x86/include/asm/archrandom.h b/arch/x86/include/asm/archrandom.h
index 0d9ec770f2f8..e6a92455740e 100644
--- a/arch/x86/include/asm/archrandom.h
+++ b/arch/x86/include/asm/archrandom.h
@@ -39,6 +39,20 @@
 #ifdef CONFIG_ARCH_RANDOM
+/* Instead of arch_get_random_long() when alternatives haven't run. */
+static inline int rdrand_long(unsigned long *v)
+{
+        int ok;
+        asm volatile("1: " RDRAND_LONG "\n\t"
+                     "jc 2f\n\t"
+                     "decl %0\n\t"
+                     "jnz 1b\n\t"
+                     "2:"
+                     : "=r" (ok), "=a" (*v)
+                     : "0" (RDRAND_RETRY_LOOPS));
+        return ok;
+}
 #define GET_RANDOM(name, type, rdrand, nop)                     \
 static inline int name(type *v)                                 \
 {                                                               \
@@ -68,6 +82,13 @@ GET_RANDOM(arch_get_random_int, unsigned int, RDRAND_INT, ASM_NOP3);
 #endif /* CONFIG_X86_64 */
+#else
+static inline int rdrand_long(unsigned long *v)
+{
+        return 0;
+}
 #endif  /* CONFIG_ARCH_RANDOM */
 extern void x86_init_rdrand(struct cpuinfo_x86 *c);
diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h
index c6cd358a1eec..04a48903b2eb 100644
--- a/arch/x86/include/asm/barrier.h
+++ b/arch/x86/include/asm/barrier.h
@@ -92,12 +92,53 @@
 #endif
 #define smp_read_barrier_depends()      read_barrier_depends()
 #define set_mb(var, value) do { (void)xchg(&var, value); } while (0)
-#else
+#else /* !SMP */
 #define smp_mb()        barrier()
 #define smp_rmb()       barrier()
 #define smp_wmb()       barrier()
 #define smp_read_barrier_depends()      do { } while (0)
 #define set_mb(var, value) do { var = value; barrier(); } while (0)
+#endif /* SMP */
+#if defined(CONFIG_X86_OOSTORE) || defined(CONFIG_X86_PPRO_FENCE)
+/*
+ * For either of these options x86 doesn't have a strong TSO memory
+ * model and we should fall back to full barriers.
+ */
+#define smp_store_release(p, v)                                         \
+do {                                                                    \
+        compiletime_assert_atomic_type(*p);                             \
+        smp_mb();                                                       \
+        ACCESS_ONCE(*p) = (v);                                          \
+} while (0)
+#define smp_load_acquire(p)                                             \
+({                                                                      \
+        typeof(*p) ___p1 = ACCESS_ONCE(*p);                             \
+        compiletime_assert_atomic_type(*p);                             \
+        smp_mb();                                                       \
+        ___p1;                                                          \
+})
+#else /* regular x86 TSO memory ordering */
+#define smp_store_release(p, v)                                         \
+do {                                                                    \
+        compiletime_assert_atomic_type(*p);                             \
+        barrier();                                                      \
+        ACCESS_ONCE(*p) = (v);                                          \
+} while (0)
+#define smp_load_acquire(p)                                             \
+({                                                                      \
+        typeof(*p) ___p1 = ACCESS_ONCE(*p);                             \
+        compiletime_assert_atomic_type(*p);                             \
+        barrier();                                                      \
+        ___p1;                                                          \
+})
 #endif
 /*
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index 89270b4318db..e099f9502ace 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -216,6 +216,7 @@
 #define X86_FEATURE_ERMS        (9*32+ 9) /* Enhanced REP MOVSB/STOSB */
 #define X86_FEATURE_INVPCID     (9*32+10) /* Invalidate Processor Context ID */
 #define X86_FEATURE_RTM         (9*32+11) /* Restricted Transactional Memory */
+#define X86_FEATURE_MPX         (9*32+14) /* Memory Protection Extension */
 #define X86_FEATURE_RDSEED      (9*32+18) /* The RDSEED instruction */
 #define X86_FEATURE_ADX         (9*32+19) /* The ADCX and ADOX instructions */
 #define X86_FEATURE_SMAP        (9*32+20) /* Supervisor Mode Access Prevention */
diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h
index 65c6e6e3a552..3b978c472d08 100644
--- a/arch/x86/include/asm/efi.h
+++ b/arch/x86/include/asm/efi.h
@@ -1,6 +1,24 @@
 #ifndef _ASM_X86_EFI_H
 #define _ASM_X86_EFI_H
+/*
+ * We map the EFI regions needed for runtime services non-contiguously,
+ * with preserved alignment on virtual addresses starting from -4G down
+ * for a total max space of 64G. This way, we provide for stable runtime
+ * services addresses across kernels so that a kexec'd kernel can still
+ * use them.
+ *
+ * This is the main reason why we're doing stable VA mappings for RT
+ * services.
+ *
+ * This flag is used in conjuction with a chicken bit called
+ * "efi=old_map" which can be used as a fallback to the old runtime
+ * services mapping method in case there's some b0rkage with a
+ * particular EFI implementation (haha, it is hard to hold up the
+ * sarcasm here...).
+ */
+#define EFI_OLD_MEMMAP          EFI_ARCH_1
 #ifdef CONFIG_X86_32
 #define EFI_LOADER_SIGNATURE    "EL32"
@@ -69,24 +87,31 @@ extern u64 efi_call6(void *fp, u64 arg1, u64 arg2, u64 arg3,
        efi_call6((f), (u64)(a1), (u64)(a2), (u64)(a3),         \
                  (u64)(a4), (u64)(a5), (u64)(a6))
+#define _efi_call_virtX(x, f, ...)                                      \
+({                                                                      \
+        efi_status_t __s;                                               \
+                                                                        \
+        efi_sync_low_kernel_mappings();                                 \
+        preempt_disable();                                              \
+        __s = efi_call##x((void *)efi.systab->runtime->f, __VA_ARGS__); \
+        preempt_enable();                                               \
+        __s;                                                            \
+})
 #define efi_call_virt0(f)                               \
-        efi_call0((efi.systab->runtime->f))
+        _efi_call_virtX(0, f)
-#define efi_call_virt1(f, a1)                                   \
+#define efi_call_virt1(f, a1)                           \
-        efi_call1((efi.systab->runtime->f), (u64)(a1))
+        _efi_call_virtX(1, f, (u64)(a1))
-#define efi_call_virt2(f, a1, a2)                                       \
+#define efi_call_virt2(f, a1, a2)                       \
-        efi_call2((efi.systab->runtime->f), (u64)(a1), (u64)(a2))
+        _efi_call_virtX(2, f, (u64)(a1), (u64)(a2))
-#define efi_call_virt3(f, a1, a2, a3)                                   \
+#define efi_call_virt3(f, a1, a2, a3)                   \
-        efi_call3((efi.systab->runtime->f), (u64)(a1), (u64)(a2), \
+        _efi_call_virtX(3, f, (u64)(a1), (u64)(a2), (u64)(a3))
-                  (u64)(a3))
+#define efi_call_virt4(f, a1, a2, a3, a4)               \
-#define efi_call_virt4(f, a1, a2, a3, a4)                               \
+        _efi_call_virtX(4, f, (u64)(a1), (u64)(a2), (u64)(a3), (u64)(a4))
-        efi_call4((efi.systab->runtime->f), (u64)(a1), (u64)(a2), \
+#define efi_call_virt5(f, a1, a2, a3, a4, a5)           \
-                  (u64)(a3), (u64)(a4))
+        _efi_call_virtX(5, f, (u64)(a1), (u64)(a2), (u64)(a3), (u64)(a4), (u64)(a5))
-#define efi_call_virt5(f, a1, a2, a3, a4, a5)                           \
+#define efi_call_virt6(f, a1, a2, a3, a4, a5, a6)       \
-        efi_call5((efi.systab->runtime->f), (u64)(a1), (u64)(a2), \
+        _efi_call_virtX(6, f, (u64)(a1), (u64)(a2), (u64)(a3), (u64)(a4), (u64)(a5), (u64)(a6))
-                  (u64)(a3), (u64)(a4), (u64)(a5))
-#define efi_call_virt6(f, a1, a2, a3, a4, a5, a6)                       \
-        efi_call6((efi.systab->runtime->f), (u64)(a1), (u64)(a2), \
-                  (u64)(a3), (u64)(a4), (u64)(a5), (u64)(a6))
 extern void __iomem *efi_ioremap(unsigned long addr, unsigned long size,
                                 u32 type, u64 attribute);
@@ -95,12 +120,28 @@ extern void __iomem *efi_ioremap(unsigned long addr, unsigned long size,
 extern int add_efi_memmap;
 extern unsigned long x86_efi_facility;
+extern struct efi_scratch efi_scratch;
 extern void efi_set_executable(efi_memory_desc_t *md, bool executable);
 extern int efi_memblock_x86_reserve_range(void);
 extern void efi_call_phys_prelog(void);
 extern void efi_call_phys_epilog(void);
 extern void efi_unmap_memmap(void);
 extern void efi_memory_uc(u64 addr, unsigned long size);
+extern void __init efi_map_region(efi_memory_desc_t *md);
+extern void __init efi_map_region_fixed(efi_memory_desc_t *md);
+extern void efi_sync_low_kernel_mappings(void);
+extern void efi_setup_page_tables(void);
+extern void __init old_map_region(efi_memory_desc_t *md);
+struct efi_setup_data {
+        u64 fw_vendor;
+        u64 runtime;
+        u64 tables;
+        u64 smbios;
+        u64 reserved[8];
+};
+extern u64 efi_setup;
 #ifdef CONFIG_EFI
@@ -110,7 +151,7 @@ static inline bool efi_is_native(void)
 }
 extern struct console early_efi_console;
+extern void parse_efi_setup(u64 phys_addr, u32 data_len);
 #else
 /*
 * IF EFI is not configured, have the EFI calls return -ENOSYS.
@@ -122,6 +163,7 @@ extern struct console early_efi_console;
 #define efi_call4(_f, _a1, _a2, _a3, _a4)               (-ENOSYS)
 #define efi_call5(_f, _a1, _a2, _a3, _a4, _a5)          (-ENOSYS)
 #define efi_call6(_f, _a1, _a2, _a3, _a4, _a5, _a6)     (-ENOSYS)
+static inline void parse_efi_setup(u64 phys_addr, u32 data_len) {}
 #endif /* CONFIG_EFI */
 #endif /* _ASM_X86_EFI_H */
diff --git a/arch/x86/include/asm/fpu-internal.h b/arch/x86/include/asm/fpu-internal.h
index c49a613c6452..cea1c76d49bf 100644
--- a/arch/x86/include/asm/fpu-internal.h
+++ b/arch/x86/include/asm/fpu-internal.h
@@ -293,12 +293,13 @@ static inline int restore_fpu_checking(struct task_struct *tsk)
        /* AMD K7/K8 CPUs don't save/restore FDP/FIP/FOP unless an exception
           is pending.  Clear the x87 state here by setting it to fixed
           values. "m" is a random variable that should be in L1 */
-        alternative_input(
+        if (unlikely(static_cpu_has(X86_FEATURE_FXSAVE_LEAK))) {
-                ASM_NOP8 ASM_NOP2,
+                asm volatile(
-                "emms\n\t"              /* clear stack tags */
+                        "fnclex\n\t"
-                "fildl %P[addr]",       /* set F?P to defined value */
+                        "emms\n\t"
-                X86_FEATURE_FXSAVE_LEAK,
+                        "fildl %P[addr]"        /* set F?P to defined value */
-                [addr] "m" (tsk->thread.fpu.has_fpu));
+                        : : [addr] "m" (tsk->thread.fpu.has_fpu));
+        }
        return fpu_restore_checking(&tsk->thread.fpu);
 }
diff --git a/arch/x86/include/asm/futex.h b/arch/x86/include/asm/futex.h
index be27ba1e947a..b4c1f5453436 100644
--- a/arch/x86/include/asm/futex.h
+++ b/arch/x86/include/asm/futex.h
@@ -110,26 +110,7 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
 static inline int futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
                                                u32 oldval, u32 newval)
 {
-        int ret = 0;
+        return user_atomic_cmpxchg_inatomic(uval, uaddr, oldval, newval);
-        if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
-                return -EFAULT;
-        asm volatile("\t" ASM_STAC "\n"
-                     "1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"
-                     "2:\t" ASM_CLAC "\n"
-                     "\t.section .fixup, \"ax\"\n"
-                     "3:\tmov     %3, %0\n"
-                     "\tjmp     2b\n"
-                     "\t.previous\n"
-                     _ASM_EXTABLE(1b, 3b)
-                     : "+r" (ret), "=a" (oldval), "+m" (*uaddr)
-                     : "i" (-EFAULT), "r" (newval), "1" (oldval)
-                     : "memory"
-        );
-        *uval = oldval;
-        return ret;
 }
 #endif
diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
index cba45d99ac1a..67d69b8e2d20 100644
--- a/arch/x86/include/asm/hw_irq.h
+++ b/arch/x86/include/asm/hw_irq.h
@@ -191,6 +191,9 @@ extern void (*__initconst interrupt[NR_VECTORS-FIRST_EXTERNAL_VECTOR])(void);
 #define trace_interrupt interrupt
 #endif
+#define VECTOR_UNDEFINED        -1
+#define VECTOR_RETRIGGERED      -2
 typedef int vector_irq_t[NR_VECTORS];
 DECLARE_PER_CPU(vector_irq_t, vector_irq);
 extern void setup_vector_irq(int cpu);
diff --git a/arch/x86/include/asm/intel-mid.h b/arch/x86/include/asm/intel-mid.h
index 459769d39263..e34e097b6f9d 100644
--- a/arch/x86/include/asm/intel-mid.h
+++ b/arch/x86/include/asm/intel-mid.h
@@ -51,10 +51,41 @@ struct devs_id {
 enum intel_mid_cpu_type {
        /* 1 was Moorestown */
        INTEL_MID_CPU_CHIP_PENWELL = 2,
+        INTEL_MID_CPU_CHIP_CLOVERVIEW,
+        INTEL_MID_CPU_CHIP_TANGIER,
 };
 extern enum intel_mid_cpu_type __intel_mid_cpu_chip;
+/**
+ * struct intel_mid_ops - Interface between intel-mid & sub archs
+ * @arch_setup: arch_setup function to re-initialize platform
+ *             structures (x86_init, x86_platform_init)
+ *
+ * This structure can be extended if any new interface is required
+ * between intel-mid & its sub arch files.
+ */
+struct intel_mid_ops {
+        void (*arch_setup)(void);
+};
+/* Helper API's for INTEL_MID_OPS_INIT */
+#define DECLARE_INTEL_MID_OPS_INIT(cpuname, cpuid)      \
+                                [cpuid] = get_##cpuname##_ops
+/* Maximum number of CPU ops */
+#define MAX_CPU_OPS(a) (sizeof(a)/sizeof(void *))
+/*
+ * For every new cpu addition, a weak get_<cpuname>_ops() function needs be
+ * declared in arch/x86/platform/intel_mid/intel_mid_weak_decls.h.
+ */
+#define INTEL_MID_OPS_INIT {\
+        DECLARE_INTEL_MID_OPS_INIT(penwell, INTEL_MID_CPU_CHIP_PENWELL), \
+        DECLARE_INTEL_MID_OPS_INIT(cloverview, INTEL_MID_CPU_CHIP_CLOVERVIEW), \
+        DECLARE_INTEL_MID_OPS_INIT(tangier, INTEL_MID_CPU_CHIP_TANGIER) \
+};
 #ifdef CONFIG_X86_INTEL_MID
 static inline enum intel_mid_cpu_type intel_mid_identify_cpu(void)
@@ -86,8 +117,21 @@ extern enum intel_mid_timer_options intel_mid_timer_options;
 * Penwell uses spread spectrum clock, so the freq number is not exactly
 * the same as reported by MSR based on SDM.
 */
-#define PENWELL_FSB_FREQ_83SKU         83200
+#define FSB_FREQ_83SKU  83200
-#define PENWELL_FSB_FREQ_100SKU        99840
+#define FSB_FREQ_100SKU 99840
+#define FSB_FREQ_133SKU 133000
+#define FSB_FREQ_167SKU 167000
+#define FSB_FREQ_200SKU 200000
+#define FSB_FREQ_267SKU 267000
+#define FSB_FREQ_333SKU 333000
+#define FSB_FREQ_400SKU 400000
+/* Bus Select SoC Fuse value */
+#define BSEL_SOC_FUSE_MASK      0x7
+#define BSEL_SOC_FUSE_001       0x1 /* FSB 133MHz */
+#define BSEL_SOC_FUSE_101       0x5 /* FSB 100MHz */
+#define BSEL_SOC_FUSE_111       0x7 /* FSB 83MHz */
 #define SFI_MTMR_MAX_NUM 8
 #define SFI_MRTC_MAX    8
diff --git a/arch/x86/include/asm/iosf_mbi.h b/arch/x86/include/asm/iosf_mbi.h
new file mode 100644
index 000000000000..8e71c7941767
--- /dev/null
+++ b/arch/x86/include/asm/iosf_mbi.h
@@ -0,0 +1,90 @@
+/*
+ * iosf_mbi.h: Intel OnChip System Fabric MailBox access support
+ */
+#ifndef IOSF_MBI_SYMS_H
+#define IOSF_MBI_SYMS_H
+#define MBI_MCR_OFFSET          0xD0
+#define MBI_MDR_OFFSET          0xD4
+#define MBI_MCRX_OFFSET         0xD8
+#define MBI_RD_MASK             0xFEFFFFFF
+#define MBI_WR_MASK             0X01000000
+#define MBI_MASK_HI             0xFFFFFF00
+#define MBI_MASK_LO             0x000000FF
+#define MBI_ENABLE              0xF0
+/* Baytrail available units */
+#define BT_MBI_UNIT_AUNIT       0x00
+#define BT_MBI_UNIT_SMC         0x01
+#define BT_MBI_UNIT_CPU         0x02
+#define BT_MBI_UNIT_BUNIT       0x03
+#define BT_MBI_UNIT_PMC         0x04
+#define BT_MBI_UNIT_GFX         0x06
+#define BT_MBI_UNIT_SMI         0x0C
+#define BT_MBI_UNIT_USB         0x43
+#define BT_MBI_UNIT_SATA        0xA3
+#define BT_MBI_UNIT_PCIE        0xA6
+/* Baytrail read/write opcodes */
+#define BT_MBI_AUNIT_READ       0x10
+#define BT_MBI_AUNIT_WRITE      0x11
+#define BT_MBI_SMC_READ         0x10
+#define BT_MBI_SMC_WRITE        0x11
+#define BT_MBI_CPU_READ         0x10
+#define BT_MBI_CPU_WRITE        0x11
+#define BT_MBI_BUNIT_READ       0x10
+#define BT_MBI_BUNIT_WRITE      0x11
+#define BT_MBI_PMC_READ         0x06
+#define BT_MBI_PMC_WRITE        0x07
+#define BT_MBI_GFX_READ         0x00
+#define BT_MBI_GFX_WRITE        0x01
+#define BT_MBI_SMIO_READ        0x06
+#define BT_MBI_SMIO_WRITE       0x07
+#define BT_MBI_USB_READ         0x06
+#define BT_MBI_USB_WRITE        0x07
+#define BT_MBI_SATA_READ        0x00
+#define BT_MBI_SATA_WRITE       0x01
+#define BT_MBI_PCIE_READ        0x00
+#define BT_MBI_PCIE_WRITE       0x01
+/**
+ * iosf_mbi_read() - MailBox Interface read command
+ * @port:       port indicating subunit being accessed
+ * @opcode:     port specific read or write opcode
+ * @offset:     register address offset
+ * @mdr:        register data to be read
+ *
+ * Locking is handled by spinlock - cannot sleep.
+ * Return: Nonzero on error
+ */
+int iosf_mbi_read(u8 port, u8 opcode, u32 offset, u32 *mdr);
+/**
+ * iosf_mbi_write() - MailBox unmasked write command
+ * @port:       port indicating subunit being accessed
+ * @opcode:     port specific read or write opcode
+ * @offset:     register address offset
+ * @mdr:        register data to be written
+ *
+ * Locking is handled by spinlock - cannot sleep.
+ * Return: Nonzero on error
+ */
+int iosf_mbi_write(u8 port, u8 opcode, u32 offset, u32 mdr);
+/**
+ * iosf_mbi_modify() - MailBox masked write command
+ * @port:       port indicating subunit being accessed
+ * @opcode:     port specific read or write opcode
+ * @offset:     register address offset
+ * @mdr:        register data being modified
+ * @mask:       mask indicating bits in mdr to be modified
+ *
+ * Locking is handled by spinlock - cannot sleep.
+ * Return: Nonzero on error
+ */
+int iosf_mbi_modify(u8 port, u8 opcode, u32 offset, u32 mdr, u32 mask);
+#endif /* IOSF_MBI_SYMS_H */
diff --git a/arch/x86/include/asm/irq.h b/arch/x86/include/asm/irq.h
index 0ea10f27d613..cb6cfcd034cf 100644
--- a/arch/x86/include/asm/irq.h
+++ b/arch/x86/include/asm/irq.h
@@ -25,6 +25,7 @@ extern void irq_ctx_init(int cpu);
 #ifdef CONFIG_HOTPLUG_CPU
 #include <linux/cpumask.h>
+extern int check_irq_vectors_for_cpu_disable(void);
 extern void fixup_irqs(void);
 extern void irq_force_complete_move(int);
 #endif
diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h
index c696a8687567..6e4ce2df87cf 100644
--- a/arch/x86/include/asm/mce.h
+++ b/arch/x86/include/asm/mce.h
@@ -118,7 +118,6 @@ extern void mce_register_decode_chain(struct notifier_block *nb);
 extern void mce_unregister_decode_chain(struct notifier_block *nb);
 #include <linux/percpu.h>
-#include <linux/init.h>
 #include <linux/atomic.h>
 extern int mce_p5_enabled;
diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h
index f98bd6625318..b59827e76529 100644
--- a/arch/x86/include/asm/microcode.h
+++ b/arch/x86/include/asm/microcode.h
@@ -1,6 +1,21 @@
 #ifndef _ASM_X86_MICROCODE_H
 #define _ASM_X86_MICROCODE_H
+#define native_rdmsr(msr, val1, val2)                   \
+do {                                                    \
+        u64 __val = native_read_msr((msr));             \
+        (void)((val1) = (u32)__val);                    \
+        (void)((val2) = (u32)(__val >> 32));            \
+} while (0)
+#define native_wrmsr(msr, low, high)                    \
+        native_write_msr(msr, low, high)
+#define native_wrmsrl(msr, val)                         \
+        native_write_msr((msr),                         \
+                         (u32)((u64)(val)),             \
+                         (u32)((u64)(val) >> 32))
 struct cpu_signature {
        unsigned int sig;
        unsigned int pf;
diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h
index 4c019179a57d..b7b10b82d3e5 100644
--- a/arch/x86/include/asm/microcode_amd.h
+++ b/arch/x86/include/asm/microcode_amd.h
@@ -61,11 +61,10 @@ extern int __apply_microcode_amd(struct microcode_amd *mc_amd);
 extern int apply_microcode_amd(int cpu);
 extern enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size);
+#define PATCH_MAX_SIZE PAGE_SIZE
+extern u8 amd_ucode_patch[PATCH_MAX_SIZE];
 #ifdef CONFIG_MICROCODE_AMD_EARLY
-#ifdef CONFIG_X86_32
-#define MPB_MAX_SIZE PAGE_SIZE
-extern u8 amd_bsp_mpb[MPB_MAX_SIZE];
-#endif
 extern void __init load_ucode_amd_bsp(void);
 extern void load_ucode_amd_ap(void);
 extern int __init save_microcode_in_initrd_amd(void);
diff --git a/arch/x86/include/asm/mpspec.h b/arch/x86/include/asm/mpspec.h
index 3142a94c7b4b..3e6b4920ef5d 100644
--- a/arch/x86/include/asm/mpspec.h
+++ b/arch/x86/include/asm/mpspec.h
@@ -1,7 +1,6 @@
 #ifndef _ASM_X86_MPSPEC_H
 #define _ASM_X86_MPSPEC_H
-#include <linux/init.h>
 #include <asm/mpspec_def.h>
 #include <asm/x86_init.h>
diff --git a/arch/x86/include/asm/mwait.h b/arch/x86/include/asm/mwait.h
index 2f366d0ac6b4..1da25a5f96f9 100644
--- a/arch/x86/include/asm/mwait.h
+++ b/arch/x86/include/asm/mwait.h
@@ -1,6 +1,8 @@
 #ifndef _ASM_X86_MWAIT_H
 #define _ASM_X86_MWAIT_H
+#include <linux/sched.h>
 #define MWAIT_SUBSTATE_MASK             0xf
 #define MWAIT_CSTATE_MASK               0xf
 #define MWAIT_SUBSTATE_SIZE             4
@@ -13,4 +15,45 @@
 #define MWAIT_ECX_INTERRUPT_BREAK       0x1
+static inline void __monitor(const void *eax, unsigned long ecx,
+                             unsigned long edx)
+{
+        /* "monitor %eax, %ecx, %edx;" */
+        asm volatile(".byte 0x0f, 0x01, 0xc8;"
+                     :: "a" (eax), "c" (ecx), "d"(edx));
+}
+static inline void __mwait(unsigned long eax, unsigned long ecx)
+{
+        /* "mwait %eax, %ecx;" */
+        asm volatile(".byte 0x0f, 0x01, 0xc9;"
+                     :: "a" (eax), "c" (ecx));
+}
+/*
+ * This uses new MONITOR/MWAIT instructions on P4 processors with PNI,
+ * which can obviate IPI to trigger checking of need_resched.
+ * We execute MONITOR against need_resched and enter optimized wait state
+ * through MWAIT. Whenever someone changes need_resched, we would be woken
+ * up from MWAIT (without an IPI).
+ *
+ * New with Core Duo processors, MWAIT can take some hints based on CPU
+ * capability.
+ */
+static inline void mwait_idle_with_hints(unsigned long eax, unsigned long ecx)
+{
+        if (!current_set_polling_and_test()) {
+                if (static_cpu_has(X86_FEATURE_CLFLUSH_MONITOR)) {
+                        mb();
+                        clflush((void *)&current_thread_info()->flags);
+                        mb();
+                }
+                __monitor((void *)&current_thread_info()->flags, 0, 0);
+                if (!need_resched())
+                        __mwait(eax, ecx);
+        }
+        current_clr_polling();
+}
 #endif /* _ASM_X86_MWAIT_H */
diff --git a/arch/x86/include/asm/page.h b/arch/x86/include/asm/page.h
index c87892442e53..775873d3be55 100644
--- a/arch/x86/include/asm/page.h
+++ b/arch/x86/include/asm/page.h
@@ -71,6 +71,7 @@ extern bool __virt_addr_valid(unsigned long kaddr);
 #include <asm-generic/getorder.h>
 #define __HAVE_ARCH_GATE_AREA 1
+#define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
 #endif  /* __KERNEL__ */
 #endif /* _ASM_X86_PAGE_H */
diff --git a/arch/x86/include/asm/page_32.h b/arch/x86/include/asm/page_32.h
index 4d550d04b609..904f528cc8e8 100644
--- a/arch/x86/include/asm/page_32.h
+++ b/arch/x86/include/asm/page_32.h
@@ -5,10 +5,6 @@
 #ifndef __ASSEMBLY__
-#ifdef CONFIG_HUGETLB_PAGE
-#define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
-#endif
 #define __phys_addr_nodebug(x)  ((x) - PAGE_OFFSET)
 #ifdef CONFIG_DEBUG_VIRTUAL
 extern unsigned long __phys_addr(unsigned long);
diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
index 43dcd804ebd5..8de6d9cf3b95 100644
--- a/arch/x86/include/asm/page_64_types.h
+++ b/arch/x86/include/asm/page_64_types.h
@@ -39,9 +39,18 @@
 #define __VIRTUAL_MASK_SHIFT    47
 /*
- * Kernel image size is limited to 512 MB (see level2_kernel_pgt in
+ * Kernel image size is limited to 1GiB due to the fixmap living in the
- * arch/x86/kernel/head_64.S), and it is mapped here:
+ * next 1GiB (see level2_kernel_pgt in arch/x86/kernel/head_64.S). Use
+ * 512MiB by default, leaving 1.5GiB for modules once the page tables
+ * are fully set up. If kernel ASLR is configured, it can extend the
+ * kernel page table mapping, reducing the size of the modules area.
 */
-#define KERNEL_IMAGE_SIZE       (512 * 1024 * 1024)
+#define KERNEL_IMAGE_SIZE_DEFAULT      (512 * 1024 * 1024)
+#if defined(CONFIG_RANDOMIZE_BASE) && \
+        CONFIG_RANDOMIZE_BASE_MAX_OFFSET > KERNEL_IMAGE_SIZE_DEFAULT
+#define KERNEL_IMAGE_SIZE   CONFIG_RANDOMIZE_BASE_MAX_OFFSET
+#else
+#define KERNEL_IMAGE_SIZE      KERNEL_IMAGE_SIZE_DEFAULT
+#endif
 #endif /* _ASM_X86_PAGE_64_DEFS_H */
diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
index 3bf2dd0cf61f..0d193e234647 100644
--- a/arch/x86/include/asm/pgtable-2level.h
+++ b/arch/x86/include/asm/pgtable-2level.h
@@ -55,6 +55,13 @@ static inline pmd_t native_pmdp_get_and_clear(pmd_t *xp)
 #define native_pmdp_get_and_clear(xp) native_local_pmdp_get_and_clear(xp)
 #endif
+/* Bit manipulation helper on pte/pgoff entry */
+static inline unsigned long pte_bitop(unsigned long value, unsigned int rightshift,
+                                      unsigned long mask, unsigned int leftshift)
+{
+        return ((value >> rightshift) & mask) << leftshift;
+}
 #ifdef CONFIG_MEM_SOFT_DIRTY
 /*
@@ -71,31 +78,34 @@ static inline pmd_t native_pmdp_get_and_clear(pmd_t *xp)
 #define PTE_FILE_BITS2          (PTE_FILE_SHIFT3 - PTE_FILE_SHIFT2 - 1)
 #define PTE_FILE_BITS3          (PTE_FILE_SHIFT4 - PTE_FILE_SHIFT3 - 1)
-#define pte_to_pgoff(pte)                                               \
+#define PTE_FILE_MASK1          ((1U << PTE_FILE_BITS1) - 1)
-        ((((pte).pte_low >> (PTE_FILE_SHIFT1))                          \
+#define PTE_FILE_MASK2          ((1U << PTE_FILE_BITS2) - 1)
-          & ((1U << PTE_FILE_BITS1) - 1)))                              \
+#define PTE_FILE_MASK3          ((1U << PTE_FILE_BITS3) - 1)
-        + ((((pte).pte_low >> (PTE_FILE_SHIFT2))                        \
-            & ((1U << PTE_FILE_BITS2) - 1))                             \
+#define PTE_FILE_LSHIFT2        (PTE_FILE_BITS1)
-           << (PTE_FILE_BITS1))                                         \
+#define PTE_FILE_LSHIFT3        (PTE_FILE_BITS1 + PTE_FILE_BITS2)
-        + ((((pte).pte_low >> (PTE_FILE_SHIFT3))                        \
+#define PTE_FILE_LSHIFT4        (PTE_FILE_BITS1 + PTE_FILE_BITS2 + PTE_FILE_BITS3)
-            & ((1U << PTE_FILE_BITS3) - 1))                             \
-           << (PTE_FILE_BITS1 + PTE_FILE_BITS2))                        \
+static __always_inline pgoff_t pte_to_pgoff(pte_t pte)
-        + ((((pte).pte_low >> (PTE_FILE_SHIFT4)))                       \
+{
-            << (PTE_FILE_BITS1 + PTE_FILE_BITS2 + PTE_FILE_BITS3))
+        return (pgoff_t)
+                (pte_bitop(pte.pte_low, PTE_FILE_SHIFT1, PTE_FILE_MASK1,  0)                +
-#define pgoff_to_pte(off)                                               \
+                 pte_bitop(pte.pte_low, PTE_FILE_SHIFT2, PTE_FILE_MASK2,  PTE_FILE_LSHIFT2) +
-        ((pte_t) { .pte_low =                                           \
+                 pte_bitop(pte.pte_low, PTE_FILE_SHIFT3, PTE_FILE_MASK3,  PTE_FILE_LSHIFT3) +
-         ((((off)) & ((1U << PTE_FILE_BITS1) - 1)) << PTE_FILE_SHIFT1)  \
+                 pte_bitop(pte.pte_low, PTE_FILE_SHIFT4,           -1UL,  PTE_FILE_LSHIFT4));
-         + ((((off) >> PTE_FILE_BITS1)                                  \
+}
-             & ((1U << PTE_FILE_BITS2) - 1))                            \
-            << PTE_FILE_SHIFT2)                                         \
+static __always_inline pte_t pgoff_to_pte(pgoff_t off)
-         + ((((off) >> (PTE_FILE_BITS1 + PTE_FILE_BITS2))               \
+{
-             & ((1U << PTE_FILE_BITS3) - 1))                            \
+        return (pte_t){
-            << PTE_FILE_SHIFT3)                                         \
+                .pte_low =
-         + ((((off) >>                                                  \
+                        pte_bitop(off,                0, PTE_FILE_MASK1,  PTE_FILE_SHIFT1) +
-              (PTE_FILE_BITS1 + PTE_FILE_BITS2 + PTE_FILE_BITS3)))      \
+                        pte_bitop(off, PTE_FILE_LSHIFT2, PTE_FILE_MASK2,  PTE_FILE_SHIFT2) +
-            << PTE_FILE_SHIFT4)                                         \
+                        pte_bitop(off, PTE_FILE_LSHIFT3, PTE_FILE_MASK3,  PTE_FILE_SHIFT3) +
-         + _PAGE_FILE })
+                        pte_bitop(off, PTE_FILE_LSHIFT4,           -1UL,  PTE_FILE_SHIFT4) +
+                        _PAGE_FILE,
+        };
+}
 #else /* CONFIG_MEM_SOFT_DIRTY */
@@ -115,22 +125,30 @@ static inline pmd_t native_pmdp_get_and_clear(pmd_t *xp)
 #define PTE_FILE_BITS1          (PTE_FILE_SHIFT2 - PTE_FILE_SHIFT1 - 1)
 #define PTE_FILE_BITS2          (PTE_FILE_SHIFT3 - PTE_FILE_SHIFT2 - 1)
-#define pte_to_pgoff(pte)                                               \
+#define PTE_FILE_MASK1          ((1U << PTE_FILE_BITS1) - 1)
-        ((((pte).pte_low >> PTE_FILE_SHIFT1)                            \
+#define PTE_FILE_MASK2          ((1U << PTE_FILE_BITS2) - 1)
-          & ((1U << PTE_FILE_BITS1) - 1))                               \
-         + ((((pte).pte_low >> PTE_FILE_SHIFT2)                         \
+#define PTE_FILE_LSHIFT2        (PTE_FILE_BITS1)
-             & ((1U << PTE_FILE_BITS2) - 1)) << PTE_FILE_BITS1)         \
+#define PTE_FILE_LSHIFT3        (PTE_FILE_BITS1 + PTE_FILE_BITS2)
-         + (((pte).pte_low >> PTE_FILE_SHIFT3)                          \
-            << (PTE_FILE_BITS1 + PTE_FILE_BITS2)))
+static __always_inline pgoff_t pte_to_pgoff(pte_t pte)
+{
-#define pgoff_to_pte(off)                                               \
+        return (pgoff_t)
-        ((pte_t) { .pte_low =                                           \
+                (pte_bitop(pte.pte_low, PTE_FILE_SHIFT1, PTE_FILE_MASK1,  0)                +
-         (((off) & ((1U << PTE_FILE_BITS1) - 1)) << PTE_FILE_SHIFT1)    \
+                 pte_bitop(pte.pte_low, PTE_FILE_SHIFT2, PTE_FILE_MASK2,  PTE_FILE_LSHIFT2) +
-         + ((((off) >> PTE_FILE_BITS1) & ((1U << PTE_FILE_BITS2) - 1))  \
+                 pte_bitop(pte.pte_low, PTE_FILE_SHIFT3,           -1UL,  PTE_FILE_LSHIFT3));
-            << PTE_FILE_SHIFT2)                                         \
+}
-         + (((off) >> (PTE_FILE_BITS1 + PTE_FILE_BITS2))                \
-            << PTE_FILE_SHIFT3)                                         \
+static __always_inline pte_t pgoff_to_pte(pgoff_t off)
-         + _PAGE_FILE })
+{
+        return (pte_t){
+                .pte_low =
+                        pte_bitop(off,                0, PTE_FILE_MASK1,  PTE_FILE_SHIFT1) +
+                        pte_bitop(off, PTE_FILE_LSHIFT2, PTE_FILE_MASK2,  PTE_FILE_SHIFT2) +
+                        pte_bitop(off, PTE_FILE_LSHIFT3,           -1UL,  PTE_FILE_SHIFT3) +
+                        _PAGE_FILE,
+        };
+}
 #endif /* CONFIG_MEM_SOFT_DIRTY */
diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
index 2d883440cb9a..c883bf726398 100644
--- a/arch/x86/include/asm/pgtable_64_types.h
+++ b/arch/x86/include/asm/pgtable_64_types.h
@@ -58,7 +58,7 @@ typedef struct { pteval_t pte; } pte_t;
 #define VMALLOC_START    _AC(0xffffc90000000000, UL)
 #define VMALLOC_END      _AC(0xffffe8ffffffffff, UL)
 #define VMEMMAP_START    _AC(0xffffea0000000000, UL)
-#define MODULES_VADDR    _AC(0xffffffffa0000000, UL)
+#define MODULES_VADDR    (__START_KERNEL_map + KERNEL_IMAGE_SIZE)
 #define MODULES_END      _AC(0xffffffffff000000, UL)
 #define MODULES_LEN   (MODULES_END - MODULES_VADDR)
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index 0ecac257fb26..a83aa44bb1fb 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -382,7 +382,8 @@ static inline void update_page_count(int level, unsigned long pages) { }
 */
 extern pte_t *lookup_address(unsigned long address, unsigned int *level);
 extern phys_addr_t slow_virt_to_phys(void *__address);
+extern int kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address,
+                                   unsigned numpages, unsigned long page_flags);
 #endif  /* !__ASSEMBLY__ */
 #endif /* _ASM_X86_PGTABLE_DEFS_H */
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 7b034a4057f9..fdedd38fd0fc 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -27,7 +27,6 @@ struct mm_struct;
 #include <linux/cache.h>
 #include <linux/threads.h>
 #include <linux/math64.h>
-#include <linux/init.h>
 #include <linux/err.h>
 #include <linux/irqflags.h>
@@ -72,6 +71,7 @@ extern u16 __read_mostly tlb_lli_4m[NR_INFO];
 extern u16 __read_mostly tlb_lld_4k[NR_INFO];
 extern u16 __read_mostly tlb_lld_2m[NR_INFO];
 extern u16 __read_mostly tlb_lld_4m[NR_INFO];
+extern u16 __read_mostly tlb_lld_1g[NR_INFO];
 extern s8  __read_mostly tlb_flushall_shift;
 /*
@@ -370,6 +370,20 @@ struct ymmh_struct {
        u32 ymmh_space[64];
 };
+/* We don't support LWP yet: */
+struct lwp_struct {
+        u8 reserved[128];
+};
+struct bndregs_struct {
+        u64 bndregs[8];
+} __packed;
+struct bndcsr_struct {
+        u64 cfg_reg_u;
+        u64 status_reg;
+} __packed;
 struct xsave_hdr_struct {
        u64 xstate_bv;
        u64 reserved1[2];
@@ -380,6 +394,9 @@ struct xsave_struct {
        struct i387_fxsave_struct i387;
        struct xsave_hdr_struct xsave_hdr;
        struct ymmh_struct ymmh;
+        struct lwp_struct lwp;
+        struct bndregs_struct bndregs;
+        struct bndcsr_struct bndcsr;
        /* new processor state extensions will go here */
 } __attribute__ ((packed, aligned (64)));
@@ -700,29 +717,6 @@ static inline void sync_core(void)
 #endif
 }
-static inline void __monitor(const void *eax, unsigned long ecx,
-                             unsigned long edx)
-{
-        /* "monitor %eax, %ecx, %edx;" */
-        asm volatile(".byte 0x0f, 0x01, 0xc8;"
-                     :: "a" (eax), "c" (ecx), "d"(edx));
-}
-static inline void __mwait(unsigned long eax, unsigned long ecx)
-{
-        /* "mwait %eax, %ecx;" */
-        asm volatile(".byte 0x0f, 0x01, 0xc9;"
-                     :: "a" (eax), "c" (ecx));
-}
-static inline void __sti_mwait(unsigned long eax, unsigned long ecx)
-{
-        trace_hardirqs_on();
-        /* "mwait %eax, %ecx;" */
-        asm volatile("sti; .byte 0x0f, 0x01, 0xc9;"
-                     :: "a" (eax), "c" (ecx));
-}
 extern void select_idle_routine(const struct cpuinfo_x86 *c);
 extern void init_amd_e400_c1e_mask(void);
diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
index 942a08623a1a..14fd6fd75a19 100644
--- a/arch/x86/include/asm/ptrace.h
+++ b/arch/x86/include/asm/ptrace.h
@@ -60,7 +60,6 @@ struct pt_regs {
 #endif /* !__i386__ */
-#include <linux/init.h>
 #ifdef CONFIG_PARAVIRT
 #include <asm/paravirt_types.h>
 #endif
diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h
index 59bcf4e22418..d62c9f809bc5 100644
--- a/arch/x86/include/asm/setup.h
+++ b/arch/x86/include/asm/setup.h
@@ -3,7 +3,6 @@
 #include <uapi/asm/setup.h>
 #define COMMAND_LINE_SIZE 2048
 #include <linux/linkage.h>
@@ -29,6 +28,8 @@
 #include <asm/bootparam.h>
 #include <asm/x86_init.h>
+extern u64 relocated_ramdisk;
 /* Interrupt control for vSMPowered x86_64 systems */
 #ifdef CONFIG_X86_64
 void vsmp_init(void);
diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
index 4137890e88e3..8cd27e08e23c 100644
--- a/arch/x86/include/asm/smp.h
+++ b/arch/x86/include/asm/smp.h
@@ -2,7 +2,6 @@
 #define _ASM_X86_SMP_H
 #ifndef __ASSEMBLY__
 #include <linux/cpumask.h>
-#include <linux/init.h>
 #include <asm/percpu.h>
 /*
diff --git a/arch/x86/include/asm/timer.h b/arch/x86/include/asm/timer.h
index 34baa0eb5d0c..a04eabd43d06 100644
--- a/arch/x86/include/asm/timer.h
+++ b/arch/x86/include/asm/timer.h
@@ -1,9 +1,9 @@
 #ifndef _ASM_X86_TIMER_H
 #define _ASM_X86_TIMER_H
-#include <linux/init.h>
 #include <linux/pm.h>
 #include <linux/percpu.h>
 #include <linux/interrupt.h>
+#include <linux/math64.h>
 #define TICK_SIZE (tick_nsec / 1000)
@@ -12,68 +12,26 @@ extern int recalibrate_cpu_khz(void);
 extern int no_timer_check;
-/* Accelerators for sched_clock()
+/*
- * convert from cycles(64bits) => nanoseconds (64bits)
+ * We use the full linear equation: f(x) = a + b*x, in order to allow
- *  basic equation:
+ * a continuous function in the face of dynamic freq changes.
- *              ns = cycles / (freq / ns_per_sec)
- *              ns = cycles * (ns_per_sec / freq)
- *              ns = cycles * (10^9 / (cpu_khz * 10^3))
- *              ns = cycles * (10^6 / cpu_khz)
 *
- *      Then we use scaling math (suggested by george@mvista.com) to get:
+ * Continuity means that when our frequency changes our slope (b); we want to
- *              ns = cycles * (10^6 * SC / cpu_khz) / SC
+ * ensure that: f(t) == f'(t), which gives: a + b*t == a' + b'*t.
- *              ns = cycles * cyc2ns_scale / SC
 *
- *      And since SC is a constant power of two, we can convert the div
+ * Without an offset (a) the above would not be possible.
- *  into a shift.
 *
- *  We can use khz divisor instead of mhz to keep a better precision, since
+ * See the comment near cycles_2_ns() for details on how we compute (b).
- *  cyc2ns_scale is limited to 10^6 * 2^10, which fits in 32 bits.
- *  (mathieu.desnoyers@polymtl.ca)
- *
- *                      -johnstul@us.ibm.com "math is hard, lets go shopping!"
- *
- * In:
- *
- * ns = cycles * cyc2ns_scale / SC
- *
- * Although we may still have enough bits to store the value of ns,
- * in some cases, we may not have enough bits to store cycles * cyc2ns_scale,
- * leading to an incorrect result.
- *
- * To avoid this, we can decompose 'cycles' into quotient and remainder
- * of division by SC.  Then,
- *
- * ns = (quot * SC + rem) * cyc2ns_scale / SC
- *    = quot * cyc2ns_scale + (rem * cyc2ns_scale) / SC
- *
- *                      - sqazi@google.com
 */
+struct cyc2ns_data {
-DECLARE_PER_CPU(unsigned long, cyc2ns);
+        u32 cyc2ns_mul;
-DECLARE_PER_CPU(unsigned long long, cyc2ns_offset);
+        u32 cyc2ns_shift;
+        u64 cyc2ns_offset;
-#define CYC2NS_SCALE_FACTOR 10 /* 2^10, carefully chosen */
+        u32 __count;
+        /* u32 hole */
-static inline unsigned long long __cycles_2_ns(unsigned long long cyc)
+}; /* 24 bytes -- do not grow */
-{
-        int cpu = smp_processor_id();
+extern struct cyc2ns_data *cyc2ns_read_begin(void);
-        unsigned long long ns = per_cpu(cyc2ns_offset, cpu);
+extern void cyc2ns_read_end(struct cyc2ns_data *);
-        ns += mult_frac(cyc, per_cpu(cyc2ns, cpu),
-                        (1UL << CYC2NS_SCALE_FACTOR));
-        return ns;
-}
-static inline unsigned long long cycles_2_ns(unsigned long long cyc)
-{
-        unsigned long long ns;
-        unsigned long flags;
-        local_irq_save(flags);
-        ns = __cycles_2_ns(cyc);
-        local_irq_restore(flags);
-        return ns;
-}
 #endif /* _ASM_X86_TIMER_H */
diff --git a/arch/x86/include/asm/tsc.h b/arch/x86/include/asm/tsc.h
index 235be70d5bb4..57ae63cd6ee2 100644
--- a/arch/x86/include/asm/tsc.h
+++ b/arch/x86/include/asm/tsc.h
@@ -65,4 +65,7 @@ extern int notsc_setup(char *);
 extern void tsc_save_sched_clock_state(void);
 extern void tsc_restore_sched_clock_state(void);
+/* MSR based TSC calibration for Intel Atom SoC platforms */
+int try_msr_calibrate_tsc(unsigned long *fast_calibrate);
 #endif /* _ASM_X86_TSC_H */
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 8ec57c07b125..0d592e0a5b84 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -40,22 +40,30 @@
 /*
 * Test whether a block of memory is a valid user space address.
 * Returns 0 if the range is valid, nonzero otherwise.
- *
- * This is equivalent to the following test:
- * (u33)addr + (u33)size > (u33)current->addr_limit.seg (u65 for x86_64)
- *
- * This needs 33-bit (65-bit for x86_64) arithmetic. We have a carry...
 */
+static inline bool __chk_range_not_ok(unsigned long addr, unsigned long size, unsigned long limit)
+{
+        /*
+         * If we have used "sizeof()" for the size,
+         * we know it won't overflow the limit (but
+         * it might overflow the 'addr', so it's
+         * important to subtract the size from the
+         * limit, not add it to the address).
+         */
+        if (__builtin_constant_p(size))
+                return addr > limit - size;
+        /* Arbitrary sizes? Be careful about overflow */
+        addr += size;
+        if (addr < size)
+                return true;
+        return addr > limit;
+}
 #define __range_not_ok(addr, size, limit)                               \
 ({                                                                      \
-        unsigned long flag, roksum;                                     \
        __chk_user_ptr(addr);                                           \
-        asm("add %3,%1 ; sbb %0,%0 ; cmp %1,%4 ; sbb $0,%0"             \
+        __chk_range_not_ok((unsigned long __force)(addr), size, limit); \
-            : "=&r" (flag), "=r" (roksum)                               \
-            : "1" (addr), "g" ((long)(size)),                           \
-              "rm" (limit));                                            \
-        flag;                                                           \
 })
 /**
@@ -78,7 +86,7 @@
 * this function, memory access functions may still return -EFAULT.
 */
 #define access_ok(type, addr, size) \
-        (likely(__range_not_ok(addr, size, user_addr_max()) == 0))
+        likely(!__range_not_ok(addr, size, user_addr_max()))
 /*
 * The exception table consists of pairs of addresses relative to the
@@ -525,6 +533,98 @@ extern __must_check long strnlen_user(const char __user *str, long n);
 unsigned long __must_check clear_user(void __user *mem, unsigned long len);
 unsigned long __must_check __clear_user(void __user *mem, unsigned long len);
+extern void __cmpxchg_wrong_size(void)
+        __compiletime_error("Bad argument size for cmpxchg");
+#define __user_atomic_cmpxchg_inatomic(uval, ptr, old, new, size)       \
+({                                                                      \
+        int __ret = 0;                                                  \
+        __typeof__(ptr) __uval = (uval);                                \
+        __typeof__(*(ptr)) __old = (old);                               \
+        __typeof__(*(ptr)) __new = (new);                               \
+        switch (size) {                                                 \
+        case 1:                                                         \
+        {                                                               \
+                asm volatile("\t" ASM_STAC "\n"                         \
+                        "1:\t" LOCK_PREFIX "cmpxchgb %4, %2\n"          \
+                        "2:\t" ASM_CLAC "\n"                            \
+                        "\t.section .fixup, \"ax\"\n"                   \
+                        "3:\tmov     %3, %0\n"                          \
+                        "\tjmp     2b\n"                                \
+                        "\t.previous\n"                                 \
+                        _ASM_EXTABLE(1b, 3b)                            \
+                        : "+r" (__ret), "=a" (__old), "+m" (*(ptr))     \
+                        : "i" (-EFAULT), "q" (__new), "1" (__old)       \
+                        : "memory"                                      \
+                );                                                      \
+                break;                                                  \
+        }                                                               \
+        case 2:                                                         \
+        {                                                               \
+                asm volatile("\t" ASM_STAC "\n"                         \
+                        "1:\t" LOCK_PREFIX "cmpxchgw %4, %2\n"          \
+                        "2:\t" ASM_CLAC "\n"                            \
+                        "\t.section .fixup, \"ax\"\n"                   \
+                        "3:\tmov     %3, %0\n"                          \
+                        "\tjmp     2b\n"                                \
+                        "\t.previous\n"                                 \
+                        _ASM_EXTABLE(1b, 3b)                            \
+                        : "+r" (__ret), "=a" (__old), "+m" (*(ptr))     \
+                        : "i" (-EFAULT), "r" (__new), "1" (__old)       \
+                        : "memory"                                      \
+                );                                                      \
+                break;                                                  \
+        }                                                               \
+        case 4:                                                         \
+        {                                                               \
+                asm volatile("\t" ASM_STAC "\n"                         \
+                        "1:\t" LOCK_PREFIX "cmpxchgl %4, %2\n"          \
+                        "2:\t" ASM_CLAC "\n"                            \
+                        "\t.section .fixup, \"ax\"\n"                   \
+                        "3:\tmov     %3, %0\n"                          \
+                        "\tjmp     2b\n"                                \
+                        "\t.previous\n"                                 \
+                        _ASM_EXTABLE(1b, 3b)                            \
+                        : "+r" (__ret), "=a" (__old), "+m" (*(ptr))     \
+                        : "i" (-EFAULT), "r" (__new), "1" (__old)       \
+                        : "memory"                                      \
+                );                                                      \
+                break;                                                  \
+        }                                                               \
+        case 8:                                                         \
+        {                                                               \
+                if (!IS_ENABLED(CONFIG_X86_64))                         \
+                        __cmpxchg_wrong_size();                         \
+                                                                        \
+                asm volatile("\t" ASM_STAC "\n"                         \
+                        "1:\t" LOCK_PREFIX "cmpxchgq %4, %2\n"          \
+                        "2:\t" ASM_CLAC "\n"                            \
+                        "\t.section .fixup, \"ax\"\n"                   \
+                        "3:\tmov     %3, %0\n"                          \
+                        "\tjmp     2b\n"                                \
+                        "\t.previous\n"                                 \
+                        _ASM_EXTABLE(1b, 3b)                            \
+                        : "+r" (__ret), "=a" (__old), "+m" (*(ptr))     \
+                        : "i" (-EFAULT), "r" (__new), "1" (__old)       \
+                        : "memory"                                      \
+                );                                                      \
+                break;                                                  \
+        }                                                               \
+        default:                                                        \
+                __cmpxchg_wrong_size();                                 \
+        }                                                               \
+        *__uval = __old;                                                \
+        __ret;                                                          \
+})
+#define user_atomic_cmpxchg_inatomic(uval, ptr, old, new)               \
+({                                                                      \
+        access_ok(VERIFY_WRITE, (ptr), sizeof(*(ptr))) ?                \
+                __user_atomic_cmpxchg_inatomic((uval), (ptr),           \
+                                (old), (new), sizeof(*(ptr))) :         \
+                -EFAULT;                                                \
+})
 /*
 * movsl can be slow when source and dest are not both 8-byte aligned
 */
diff --git a/arch/x86/include/asm/uaccess_64.h b/arch/x86/include/asm/uaccess_64.h
index 190413d0de57..12a26b979bf1 100644
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -204,13 +204,13 @@ int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
 static __must_check __always_inline int
 __copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
 {
-        return __copy_from_user_nocheck(dst, (__force const void *)src, size);
+        return __copy_from_user_nocheck(dst, src, size);
 }
 static __must_check __always_inline int
 __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
 {
-        return __copy_to_user_nocheck((__force void *)dst, src, size);
+        return __copy_to_user_nocheck(dst, src, size);
 }
 extern long __copy_user_nocache(void *dst, const void __user *src,
diff --git a/arch/x86/include/asm/xsave.h b/arch/x86/include/asm/xsave.h
index 0415cdabb5a6..554738963b28 100644
--- a/arch/x86/include/asm/xsave.h
+++ b/arch/x86/include/asm/xsave.h
@@ -9,6 +9,8 @@
 #define XSTATE_FP       0x1
 #define XSTATE_SSE      0x2
 #define XSTATE_YMM      0x4
+#define XSTATE_BNDREGS  0x8
+#define XSTATE_BNDCSR   0x10
 #define XSTATE_FPSSE    (XSTATE_FP | XSTATE_SSE)
@@ -20,10 +22,14 @@
 #define XSAVE_YMM_SIZE      256
 #define XSAVE_YMM_OFFSET    (XSAVE_HDR_SIZE + XSAVE_HDR_OFFSET)
-/*
+/* Supported features which support lazy state saving */
- * These are the features that the OS can handle currently.
+#define XSTATE_LAZY     (XSTATE_FP | XSTATE_SSE | XSTATE_YMM)
- */
-#define XCNTXT_MASK     (XSTATE_FP | XSTATE_SSE | XSTATE_YMM)
+/* Supported features which require eager state saving */
+#define XSTATE_EAGER    (XSTATE_BNDREGS | XSTATE_BNDCSR)
+/* All currently supported features */
+#define XCNTXT_MASK     (XSTATE_LAZY | XSTATE_EAGER)
 #ifdef CONFIG_X86_64
 #define REX_PREFIX      "0x48, "
diff --git a/arch/x86/include/uapi/asm/bootparam.h b/arch/x86/include/uapi/asm/bootparam.h
index 9c3733c5f8f7..225b0988043a 100644
--- a/arch/x86/include/uapi/asm/bootparam.h
+++ b/arch/x86/include/uapi/asm/bootparam.h
@@ -6,6 +6,7 @@
 #define SETUP_E820_EXT                  1
 #define SETUP_DTB                       2
 #define SETUP_PCI                       3
+#define SETUP_EFI                       4
 /* ram_size flags */
 #define RAMDISK_IMAGE_START_MASK        0x07FF
@@ -23,6 +24,7 @@
 #define XLF_CAN_BE_LOADED_ABOVE_4G      (1<<1)
 #define XLF_EFI_HANDOVER_32             (1<<2)
 #define XLF_EFI_HANDOVER_64             (1<<3)
+#define XLF_EFI_KEXEC                   (1<<4)
 #ifndef __ASSEMBLY__
diff --git a/arch/x86/include/uapi/asm/msr-index.h b/arch/x86/include/uapi/asm/msr-index.h
index 37813b5ddc37..59cea185ad1d 100644
--- a/arch/x86/include/uapi/asm/msr-index.h
+++ b/arch/x86/include/uapi/asm/msr-index.h
@@ -184,6 +184,7 @@
 #define MSR_AMD64_PATCH_LOADER          0xc0010020
 #define MSR_AMD64_OSVW_ID_LENGTH        0xc0010140
 #define MSR_AMD64_OSVW_STATUS           0xc0010141
+#define MSR_AMD64_LS_CFG                0xc0011020
 #define MSR_AMD64_DC_CFG                0xc0011022
 #define MSR_AMD64_BU_CFG2               0xc001102a
 #define MSR_AMD64_IBSFETCHCTL           0xc0011030
diff --git a/arch/x86/include/uapi/asm/stat.h b/arch/x86/include/uapi/asm/stat.h
index 7b3ddc348585..bc03eb5d6360 100644
--- a/arch/x86/include/uapi/asm/stat.h
+++ b/arch/x86/include/uapi/asm/stat.h
@@ -1,6 +1,8 @@
 #ifndef _ASM_X86_STAT_H
 #define _ASM_X86_STAT_H
+#include <asm/posix_types.h>
 #define STAT_HAVE_NSEC 1
 #ifdef __i386__
@@ -78,26 +80,26 @@ struct stat64 {
 #else /* __i386__ */
 struct stat {
-        unsigned long   st_dev;
+        __kernel_ulong_t        st_dev;
-        unsigned long   st_ino;
+        __kernel_ulong_t        st_ino;
-        unsigned long   st_nlink;
+        __kernel_ulong_t        st_nlink;
-        unsigned int    st_mode;
+        unsigned int            st_mode;
-        unsigned int    st_uid;
+        unsigned int            st_uid;
-        unsigned int    st_gid;
+        unsigned int            st_gid;
-        unsigned int    __pad0;
+        unsigned int            __pad0;
-        unsigned long   st_rdev;
+        __kernel_ulong_t        st_rdev;
-        long            st_size;
+        __kernel_long_t         st_size;
-        long            st_blksize;
+        __kernel_long_t         st_blksize;
-        long            st_blocks;      /* Number 512-byte blocks allocated. */
+        __kernel_long_t         st_blocks;      /* Number 512-byte blocks allocated. */
-        unsigned long   st_atime;
+        __kernel_ulong_t        st_atime;
-        unsigned long   st_atime_nsec;
+        __kernel_ulong_t        st_atime_nsec;
-        unsigned long   st_mtime;
+        __kernel_ulong_t        st_mtime;
-        unsigned long   st_mtime_nsec;
+        __kernel_ulong_t        st_mtime_nsec;
-        unsigned long   st_ctime;
+        __kernel_ulong_t        st_ctime;
-        unsigned long   st_ctime_nsec;
+        __kernel_ulong_t        st_ctime_nsec;
-        long            __unused[3];
+        __kernel_long_t         __unused[3];
 };
 /* We don't need to memset the whole thing just to initialize the padding */
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index 9b0a34e2cd79..cb648c84b327 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -29,10 +29,11 @@ obj-$(CONFIG_X86_64)	+= sys_x86_64.o x8664_ksyms_64.o
 obj-y                   += syscall_$(BITS).o
 obj-$(CONFIG_X86_64)    += vsyscall_64.o
 obj-$(CONFIG_X86_64)    += vsyscall_emu_64.o
+obj-$(CONFIG_SYSFS)     += ksysfs.o
 obj-y                   += bootflag.o e820.o
 obj-y                   += pci-dma.o quirks.o topology.o kdebugfs.o
 obj-y                   += alternative.o i8253.o pci-nommu.o hw_breakpoint.o
-obj-y                   += tsc.o io_delay.o rtc.o
+obj-y                   += tsc.o tsc_msr.o io_delay.o rtc.o
 obj-y                   += pci-iommu_table.o
 obj-y                   += resource.o
@@ -91,15 +92,6 @@ obj-$(CONFIG_PARAVIRT_CLOCK)	+= pvclock.o
 obj-$(CONFIG_PCSPKR_PLATFORM)   += pcspeaker.o
-obj-$(CONFIG_MICROCODE_EARLY)           += microcode_core_early.o
-obj-$(CONFIG_MICROCODE_INTEL_EARLY)     += microcode_intel_early.o
-obj-$(CONFIG_MICROCODE_INTEL_LIB)       += microcode_intel_lib.o
-microcode-y                             := microcode_core.o
-microcode-$(CONFIG_MICROCODE_INTEL)     += microcode_intel.o
-microcode-$(CONFIG_MICROCODE_AMD)       += microcode_amd.o
-obj-$(CONFIG_MICROCODE_AMD_EARLY)       += microcode_amd_early.o
-obj-$(CONFIG_MICROCODE)                 += microcode.o
 obj-$(CONFIG_X86_CHECK_BIOS_CORRUPTION) += check.o
 obj-$(CONFIG_SWIOTLB)                   += pci-swiotlb.o
@@ -111,6 +103,7 @@ obj-$(CONFIG_EFI)			+= sysfb_efi.o
 obj-$(CONFIG_PERF_EVENTS)               += perf_regs.o
 obj-$(CONFIG_TRACING)                   += tracepoint.o
+obj-$(CONFIG_IOSF_MBI)                  += iosf_mbi.o
 ###
 # 64 bit specific files
diff --git a/arch/x86/kernel/acpi/cstate.c b/arch/x86/kernel/acpi/cstate.c
index d2b7f27781bc..e69182fd01cf 100644
--- a/arch/x86/kernel/acpi/cstate.c
+++ b/arch/x86/kernel/acpi/cstate.c
@@ -150,29 +150,6 @@ int acpi_processor_ffh_cstate_probe(unsigned int cpu,
 }
 EXPORT_SYMBOL_GPL(acpi_processor_ffh_cstate_probe);
-/*
- * This uses new MONITOR/MWAIT instructions on P4 processors with PNI,
- * which can obviate IPI to trigger checking of need_resched.
- * We execute MONITOR against need_resched and enter optimized wait state
- * through MWAIT. Whenever someone changes need_resched, we would be woken
- * up from MWAIT (without an IPI).
- *
- * New with Core Duo processors, MWAIT can take some hints based on CPU
- * capability.
- */
-void mwait_idle_with_hints(unsigned long ax, unsigned long cx)
-{
-        if (!need_resched()) {
-                if (this_cpu_has(X86_FEATURE_CLFLUSH_MONITOR))
-                        clflush((void *)&current_thread_info()->flags);
-                __monitor((void *)&current_thread_info()->flags, 0, 0);
-                smp_mb();
-                if (!need_resched())
-                        __mwait(ax, cx);
-        }
-}
 void acpi_processor_ffh_cstate_enter(struct acpi_processor_cx *cx)
 {
        unsigned int cpu = smp_processor_id();
diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c
index d278736bf774..7f26c9a70a9e 100644
--- a/arch/x86/kernel/apic/apic.c
+++ b/arch/x86/kernel/apic/apic.c
@@ -75,6 +75,13 @@ unsigned int max_physical_apicid;
 physid_mask_t phys_cpu_present_map;
 /*
+ * Processor to be disabled specified by kernel parameter
+ * disable_cpu_apicid=<int>, mostly used for the kdump 2nd kernel to
+ * avoid undefined behaviour caused by sending INIT from AP to BSP.
+ */
+static unsigned int disabled_cpu_apicid __read_mostly = BAD_APICID;
+/*
 * Map cpu index to physical APIC ID
 */
 DEFINE_EARLY_PER_CPU_READ_MOSTLY(u16, x86_cpu_to_apicid, BAD_APICID);
@@ -1968,7 +1975,7 @@ __visible void smp_trace_spurious_interrupt(struct pt_regs *regs)
 */
 static inline void __smp_error_interrupt(struct pt_regs *regs)
 {
-        u32 v0, v1;
+        u32 v;
        u32 i = 0;
        static const char * const error_interrupt_reason[] = {
                "Send CS error",                /* APIC Error Bit 0 */
@@ -1982,21 +1989,20 @@ static inline void __smp_error_interrupt(struct pt_regs *regs)
        };
        /* First tickle the hardware, only then report what went on. -- REW */
-        v0 = apic_read(APIC_ESR);
        apic_write(APIC_ESR, 0);
-        v1 = apic_read(APIC_ESR);
+        v = apic_read(APIC_ESR);
        ack_APIC_irq();
        atomic_inc(&irq_err_count);
-        apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x(%02x)",
+        apic_printk(APIC_DEBUG, KERN_DEBUG "APIC error on CPU%d: %02x",
-                    smp_processor_id(), v0 , v1);
+                    smp_processor_id(), v);
-        v1 = v1 & 0xff;
+        v &= 0xff;
-        while (v1) {
+        while (v) {
-                if (v1 & 0x1)
+                if (v & 0x1)
                        apic_printk(APIC_DEBUG, KERN_CONT " : %s", error_interrupt_reason[i]);
                i++;
-                v1 >>= 1;
+                v >>= 1;
        }
        apic_printk(APIC_DEBUG, KERN_CONT "\n");
@@ -2115,6 +2121,39 @@ int generic_processor_info(int apicid, int version)
                                phys_cpu_present_map);
        /*
+         * boot_cpu_physical_apicid is designed to have the apicid
+         * returned by read_apic_id(), i.e, the apicid of the
+         * currently booting-up processor. However, on some platforms,
+         * it is temporarily modified by the apicid reported as BSP
+         * through MP table. Concretely:
+         *
+         * - arch/x86/kernel/mpparse.c: MP_processor_info()
+         * - arch/x86/mm/amdtopology.c: amd_numa_init()
+         * - arch/x86/platform/visws/visws_quirks.c: MP_processor_info()
+         *
+         * This function is executed with the modified
+         * boot_cpu_physical_apicid. So, disabled_cpu_apicid kernel
+         * parameter doesn't work to disable APs on kdump 2nd kernel.
+         *
+         * Since fixing handling of boot_cpu_physical_apicid requires
+         * another discussion and tests on each platform, we leave it
+         * for now and here we use read_apic_id() directly in this
+         * function, generic_processor_info().
+         */
+        if (disabled_cpu_apicid != BAD_APICID &&
+            disabled_cpu_apicid != read_apic_id() &&
+            disabled_cpu_apicid == apicid) {
+                int thiscpu = num_processors + disabled_cpus;
+                pr_warning("APIC: Disabling requested cpu."
+                           " Processor %d/0x%x ignored.\n",
+                           thiscpu, apicid);
+                disabled_cpus++;
+                return -ENODEV;
+        }
+        /*
         * If boot cpu has not been detected yet, then only allow upto
         * nr_cpu_ids - 1 processors and keep one slot free for boot cpu
         */
@@ -2592,3 +2631,12 @@ static int __init lapic_insert_resource(void)
 * that is using request_resource
 */
 late_initcall(lapic_insert_resource);
+static int __init apic_set_disabled_cpu_apicid(char *arg)
+{
+        if (!arg || !get_option(&arg, &disabled_cpu_apicid))
+                return -EINVAL;
+        return 0;
+}
+early_param("disable_cpu_apicid", apic_set_disabled_cpu_apicid);
diff --git a/arch/x86/kernel/apic/apic_flat_64.c b/arch/x86/kernel/apic/apic_flat_64.c
index 00c77cf78e9e..5d5b9eb2b7a4 100644
--- a/arch/x86/kernel/apic/apic_flat_64.c
+++ b/arch/x86/kernel/apic/apic_flat_64.c
@@ -14,7 +14,6 @@
 #include <linux/string.h>
 #include <linux/kernel.h>
 #include <linux/ctype.h>
-#include <linux/init.h>
 #include <linux/hardirq.h>
 #include <linux/module.h>
 #include <asm/smp.h>
diff --git a/arch/x86/kernel/apic/apic_noop.c b/arch/x86/kernel/apic/apic_noop.c
index e145f28b4099..191ce75c0e54 100644
--- a/arch/x86/kernel/apic/apic_noop.c
+++ b/arch/x86/kernel/apic/apic_noop.c
@@ -15,7 +15,6 @@
 #include <linux/string.h>
 #include <linux/kernel.h>
 #include <linux/ctype.h>
-#include <linux/init.h>
 #include <linux/errno.h>
 #include <asm/fixmap.h>
 #include <asm/mpspec.h>
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
index e63a5bd2a78f..a43f068ebec1 100644
--- a/arch/x86/kernel/apic/io_apic.c
+++ b/arch/x86/kernel/apic/io_apic.c
@@ -1142,9 +1142,10 @@ next:
                if (test_bit(vector, used_vectors))
                        goto next;
-                for_each_cpu_and(new_cpu, tmp_mask, cpu_online_mask)
+                for_each_cpu_and(new_cpu, tmp_mask, cpu_online_mask) {
-                        if (per_cpu(vector_irq, new_cpu)[vector] != -1)
+                        if (per_cpu(vector_irq, new_cpu)[vector] > VECTOR_UNDEFINED)
                                goto next;
+                }
                /* Found one! */
                current_vector = vector;
                current_offset = offset;
@@ -1183,7 +1184,7 @@ static void __clear_irq_vector(int irq, struct irq_cfg *cfg)
        vector = cfg->vector;
        for_each_cpu_and(cpu, cfg->domain, cpu_online_mask)
-                per_cpu(vector_irq, cpu)[vector] = -1;
+                per_cpu(vector_irq, cpu)[vector] = VECTOR_UNDEFINED;
        cfg->vector = 0;
        cpumask_clear(cfg->domain);
@@ -1191,11 +1192,10 @@ static void __clear_irq_vector(int irq, struct irq_cfg *cfg)
        if (likely(!cfg->move_in_progress))
                return;
        for_each_cpu_and(cpu, cfg->old_domain, cpu_online_mask) {
-                for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS;
+                for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; vector++) {
-                                                                vector++) {
                        if (per_cpu(vector_irq, cpu)[vector] != irq)
                                continue;
-                        per_cpu(vector_irq, cpu)[vector] = -1;
+                        per_cpu(vector_irq, cpu)[vector] = VECTOR_UNDEFINED;
                        break;
                }
        }
@@ -1228,12 +1228,12 @@ void __setup_vector_irq(int cpu)
        /* Mark the free vectors */
        for (vector = 0; vector < NR_VECTORS; ++vector) {
                irq = per_cpu(vector_irq, cpu)[vector];
-                if (irq < 0)
+                if (irq <= VECTOR_UNDEFINED)
                        continue;
                cfg = irq_cfg(irq);
                if (!cpumask_test_cpu(cpu, cfg->domain))
-                        per_cpu(vector_irq, cpu)[vector] = -1;
+                        per_cpu(vector_irq, cpu)[vector] = VECTOR_UNDEFINED;
        }
        raw_spin_unlock(&vector_lock);
 }
@@ -2202,13 +2202,13 @@ asmlinkage void smp_irq_move_cleanup_interrupt(void)
        me = smp_processor_id();
        for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; vector++) {
-                unsigned int irq;
+                int irq;
                unsigned int irr;
                struct irq_desc *desc;
                struct irq_cfg *cfg;
                irq = __this_cpu_read(vector_irq[vector]);
-                if (irq == -1)
+                if (irq <= VECTOR_UNDEFINED)
                        continue;
                desc = irq_to_desc(irq);
diff --git a/arch/x86/kernel/apic/ipi.c b/arch/x86/kernel/apic/ipi.c
index 7434d8556d09..62071569bd50 100644
--- a/arch/x86/kernel/apic/ipi.c
+++ b/arch/x86/kernel/apic/ipi.c
@@ -1,6 +1,5 @@
 #include <linux/cpumask.h>
 #include <linux/interrupt.h>
-#include <linux/init.h>
 #include <linux/mm.h>
 #include <linux/delay.h>
diff --git a/arch/x86/kernel/apic/summit_32.c b/arch/x86/kernel/apic/summit_32.c
index 77c95c0e1bf7..00146f9b0254 100644
--- a/arch/x86/kernel/apic/summit_32.c
+++ b/arch/x86/kernel/apic/summit_32.c
@@ -29,7 +29,6 @@
 #define pr_fmt(fmt) "summit: %s: " fmt, __func__
 #include <linux/mm.h>
-#include <linux/init.h>
 #include <asm/io.h>
 #include <asm/bios_ebda.h>
diff --git a/arch/x86/kernel/apic/x2apic_cluster.c b/arch/x86/kernel/apic/x2apic_cluster.c
index 140e29db478d..cac85ee6913f 100644
--- a/arch/x86/kernel/apic/x2apic_cluster.c
+++ b/arch/x86/kernel/apic/x2apic_cluster.c
@@ -3,7 +3,6 @@
 #include <linux/string.h>
 #include <linux/kernel.h>
 #include <linux/ctype.h>
-#include <linux/init.h>
 #include <linux/dmar.h>
 #include <linux/cpu.h>
diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c
index 562a76d433c8..de231e328cae 100644
--- a/arch/x86/kernel/apic/x2apic_phys.c
+++ b/arch/x86/kernel/apic/x2apic_phys.c
@@ -3,7 +3,6 @@
 #include <linux/string.h>
 #include <linux/kernel.h>
 #include <linux/ctype.h>
-#include <linux/init.h>
 #include <linux/dmar.h>
 #include <asm/smp.h>
diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile
index 47b56a7e99cb..7fd54f09b011 100644
--- a/arch/x86/kernel/cpu/Makefile
+++ b/arch/x86/kernel/cpu/Makefile
@@ -36,12 +36,13 @@ obj-$(CONFIG_CPU_SUP_AMD)		+= perf_event_amd_iommu.o
 endif
 obj-$(CONFIG_CPU_SUP_INTEL)             += perf_event_p6.o perf_event_knc.o perf_event_p4.o
 obj-$(CONFIG_CPU_SUP_INTEL)             += perf_event_intel_lbr.o perf_event_intel_ds.o perf_event_intel.o
-obj-$(CONFIG_CPU_SUP_INTEL)             += perf_event_intel_uncore.o
+obj-$(CONFIG_CPU_SUP_INTEL)             += perf_event_intel_uncore.o perf_event_intel_rapl.o
 endif
 obj-$(CONFIG_X86_MCE)                   += mcheck/
 obj-$(CONFIG_MTRR)                      += mtrr/
+obj-$(CONFIG_MICROCODE)                 += microcode/
 obj-$(CONFIG_X86_LOCAL_APIC)            += perfctr-watchdog.o perf_event_amd_ibs.o
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index bca023bdd6b2..d3153e281d72 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -1,5 +1,4 @@
 #include <linux/export.h>
-#include <linux/init.h>
 #include <linux/bitops.h>
 #include <linux/elf.h>
 #include <linux/mm.h>
@@ -487,7 +486,7 @@ static void early_init_amd(struct cpuinfo_x86 *c)
                set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
                set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC);
                if (!check_tsc_unstable())
-                        sched_clock_stable = 1;
+                        set_sched_clock_stable();
        }
 #ifdef CONFIG_X86_64
@@ -508,6 +507,16 @@ static void early_init_amd(struct cpuinfo_x86 *c)
                        set_cpu_cap(c, X86_FEATURE_EXTD_APICID);
        }
 #endif
+        /* F16h erratum 793, CVE-2013-6885 */
+        if (c->x86 == 0x16 && c->x86_model <= 0xf) {
+                u64 val;
+                rdmsrl(MSR_AMD64_LS_CFG, val);
+                if (!(val & BIT(15)))
+                        wrmsrl(MSR_AMD64_LS_CFG, val | BIT(15));
+        }
 }
 static const int amd_erratum_383[];
@@ -790,14 +799,10 @@ static void cpu_detect_tlb_amd(struct cpuinfo_x86 *c)
        }
        /* Handle DTLB 2M and 4M sizes, fall back to L1 if L2 is disabled */
-        if (!((eax >> 16) & mask)) {
+        if (!((eax >> 16) & mask))
-                u32 a, b, c, d;
+                tlb_lld_2m[ENTRIES] = (cpuid_eax(0x80000005) >> 16) & 0xff;
+        else
-                cpuid(0x80000005, &a, &b, &c, &d);
-                tlb_lld_2m[ENTRIES] = (a >> 16) & 0xff;
-        } else {
                tlb_lld_2m[ENTRIES] = (eax >> 16) & mask;
-        }
        /* a 4M entry uses two 2M entries */
        tlb_lld_4m[ENTRIES] = tlb_lld_2m[ENTRIES] >> 1;
diff --git a/arch/x86/kernel/cpu/centaur.c b/arch/x86/kernel/cpu/centaur.c
index 8d5652dc99dd..8779edab684e 100644
--- a/arch/x86/kernel/cpu/centaur.c
+++ b/arch/x86/kernel/cpu/centaur.c
@@ -1,6 +1,5 @@
 #include <linux/bitops.h>
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <asm/processor.h>
 #include <asm/e820.h>
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 6abc172b8258..24b6fd10625a 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -472,6 +472,7 @@ u16 __read_mostly tlb_lli_4m[NR_INFO];
 u16 __read_mostly tlb_lld_4k[NR_INFO];
 u16 __read_mostly tlb_lld_2m[NR_INFO];
 u16 __read_mostly tlb_lld_4m[NR_INFO];
+u16 __read_mostly tlb_lld_1g[NR_INFO];
 /*
 * tlb_flushall_shift shows the balance point in replacing cr3 write
@@ -486,13 +487,13 @@ void cpu_detect_tlb(struct cpuinfo_x86 *c)
        if (this_cpu->c_detect_tlb)
                this_cpu->c_detect_tlb(c);
-        printk(KERN_INFO "Last level iTLB entries: 4KB %d, 2MB %d, 4MB %d\n" \
+        printk(KERN_INFO "Last level iTLB entries: 4KB %d, 2MB %d, 4MB %d\n"
-                "Last level dTLB entries: 4KB %d, 2MB %d, 4MB %d\n"          \
+                "Last level dTLB entries: 4KB %d, 2MB %d, 4MB %d, 1GB %d\n"
                "tlb_flushall_shift: %d\n",
                tlb_lli_4k[ENTRIES], tlb_lli_2m[ENTRIES],
                tlb_lli_4m[ENTRIES], tlb_lld_4k[ENTRIES],
                tlb_lld_2m[ENTRIES], tlb_lld_4m[ENTRIES],
-                tlb_flushall_shift);
+                tlb_lld_1g[ENTRIES], tlb_flushall_shift);
 }
 void detect_ht(struct cpuinfo_x86 *c)
diff --git a/arch/x86/kernel/cpu/cyrix.c b/arch/x86/kernel/cpu/cyrix.c
index d0969c75ab54..aaf152e79637 100644
--- a/arch/x86/kernel/cpu/cyrix.c
+++ b/arch/x86/kernel/cpu/cyrix.c
@@ -1,4 +1,3 @@
-#include <linux/init.h>
 #include <linux/bitops.h>
 #include <linux/delay.h>
 #include <linux/pci.h>
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index dc1ec0dff939..3db61c644e44 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -1,4 +1,3 @@
-#include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
@@ -93,7 +92,7 @@ static void early_init_intel(struct cpuinfo_x86 *c)
                set_cpu_cap(c, X86_FEATURE_CONSTANT_TSC);
                set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC);
                if (!check_tsc_unstable())
-                        sched_clock_stable = 1;
+                        set_sched_clock_stable();
        }
        /* Penwell and Cloverview have the TSC which doesn't sleep on S3 */
@@ -387,7 +386,8 @@ static void init_intel(struct cpuinfo_x86 *c)
                        set_cpu_cap(c, X86_FEATURE_PEBS);
        }
-        if (c->x86 == 6 && c->x86_model == 29 && cpu_has_clflush)
+        if (c->x86 == 6 && cpu_has_clflush &&
+            (c->x86_model == 29 || c->x86_model == 46 || c->x86_model == 47))
                set_cpu_cap(c, X86_FEATURE_CLFLUSH_MONITOR);
 #ifdef CONFIG_X86_64
@@ -505,6 +505,7 @@ static unsigned int intel_size_cache(struct cpuinfo_x86 *c, unsigned int size)
 #define TLB_DATA0_2M_4M 0x23
 #define STLB_4K         0x41
+#define STLB_4K_2M      0x42
 static const struct _tlb_table intel_tlb_table[] = {
        { 0x01, TLB_INST_4K,            32,     " TLB_INST 4 KByte pages, 4-way set associative" },
@@ -525,13 +526,20 @@ static const struct _tlb_table intel_tlb_table[] = {
        { 0x5b, TLB_DATA_4K_4M,         64,     " TLB_DATA 4 KByte and 4 MByte pages" },
        { 0x5c, TLB_DATA_4K_4M,         128,    " TLB_DATA 4 KByte and 4 MByte pages" },
        { 0x5d, TLB_DATA_4K_4M,         256,    " TLB_DATA 4 KByte and 4 MByte pages" },
+        { 0x61, TLB_INST_4K,            48,     " TLB_INST 4 KByte pages, full associative" },
+        { 0x63, TLB_DATA_1G,            4,      " TLB_DATA 1 GByte pages, 4-way set associative" },
+        { 0x76, TLB_INST_2M_4M,         8,      " TLB_INST 2-MByte or 4-MByte pages, fully associative" },
        { 0xb0, TLB_INST_4K,            128,    " TLB_INST 4 KByte pages, 4-way set associative" },
        { 0xb1, TLB_INST_2M_4M,         4,      " TLB_INST 2M pages, 4-way, 8 entries or 4M pages, 4-way entries" },
        { 0xb2, TLB_INST_4K,            64,     " TLB_INST 4KByte pages, 4-way set associative" },
        { 0xb3, TLB_DATA_4K,            128,    " TLB_DATA 4 KByte pages, 4-way set associative" },
        { 0xb4, TLB_DATA_4K,            256,    " TLB_DATA 4 KByte pages, 4-way associative" },
+        { 0xb5, TLB_INST_4K,            64,     " TLB_INST 4 KByte pages, 8-way set ssociative" },
+        { 0xb6, TLB_INST_4K,            128,    " TLB_INST 4 KByte pages, 8-way set ssociative" },
        { 0xba, TLB_DATA_4K,            64,     " TLB_DATA 4 KByte pages, 4-way associative" },
        { 0xc0, TLB_DATA_4K_4M,         8,      " TLB_DATA 4 KByte and 4 MByte pages, 4-way associative" },
+        { 0xc1, STLB_4K_2M,             1024,   " STLB 4 KByte and 2 MByte pages, 8-way associative" },
+        { 0xc2, TLB_DATA_2M_4M,         16,     " DTLB 2 MByte/4MByte pages, 4-way associative" },
        { 0xca, STLB_4K,                512,    " STLB 4 KByte pages, 4-way associative" },
        { 0x00, 0, 0 }
 };
@@ -557,6 +565,20 @@ static void intel_tlb_lookup(const unsigned char desc)
                if (tlb_lld_4k[ENTRIES] < intel_tlb_table[k].entries)
                        tlb_lld_4k[ENTRIES] = intel_tlb_table[k].entries;
                break;
+        case STLB_4K_2M:
+                if (tlb_lli_4k[ENTRIES] < intel_tlb_table[k].entries)
+                        tlb_lli_4k[ENTRIES] = intel_tlb_table[k].entries;
+                if (tlb_lld_4k[ENTRIES] < intel_tlb_table[k].entries)
+                        tlb_lld_4k[ENTRIES] = intel_tlb_table[k].entries;
+                if (tlb_lli_2m[ENTRIES] < intel_tlb_table[k].entries)
+                        tlb_lli_2m[ENTRIES] = intel_tlb_table[k].entries;
+                if (tlb_lld_2m[ENTRIES] < intel_tlb_table[k].entries)
+                        tlb_lld_2m[ENTRIES] = intel_tlb_table[k].entries;
+                if (tlb_lli_4m[ENTRIES] < intel_tlb_table[k].entries)
+                        tlb_lli_4m[ENTRIES] = intel_tlb_table[k].entries;
+                if (tlb_lld_4m[ENTRIES] < intel_tlb_table[k].entries)
+                        tlb_lld_4m[ENTRIES] = intel_tlb_table[k].entries;
+                break;
        case TLB_INST_ALL:
                if (tlb_lli_4k[ENTRIES] < intel_tlb_table[k].entries)
                        tlb_lli_4k[ENTRIES] = intel_tlb_table[k].entries;
@@ -602,6 +624,10 @@ static void intel_tlb_lookup(const unsigned char desc)
                if (tlb_lld_4m[ENTRIES] < intel_tlb_table[k].entries)
                        tlb_lld_4m[ENTRIES] = intel_tlb_table[k].entries;
                break;
+        case TLB_DATA_1G:
+                if (tlb_lld_1g[ENTRIES] < intel_tlb_table[k].entries)
+                        tlb_lld_1g[ENTRIES] = intel_tlb_table[k].entries;
+                break;
        }
 }
diff --git a/arch/x86/kernel/cpu/mcheck/mce-apei.c b/arch/x86/kernel/cpu/mcheck/mce-apei.c
index de8b60a53f69..a1aef9533154 100644
--- a/arch/x86/kernel/cpu/mcheck/mce-apei.c
+++ b/arch/x86/kernel/cpu/mcheck/mce-apei.c
@@ -33,22 +33,28 @@
 #include <linux/acpi.h>
 #include <linux/cper.h>
 #include <acpi/apei.h>
+#include <acpi/ghes.h>
 #include <asm/mce.h>
 #include "mce-internal.h"
-void apei_mce_report_mem_error(int corrected, struct cper_sec_mem_err *mem_err)
+void apei_mce_report_mem_error(int severity, struct cper_sec_mem_err *mem_err)
 {
        struct mce m;
-        /* Only corrected MC is reported */
+        if (!(mem_err->validation_bits & CPER_MEM_VALID_PA))
-        if (!corrected || !(mem_err->validation_bits & CPER_MEM_VALID_PA))
                return;
        mce_setup(&m);
        m.bank = 1;
-        /* Fake a memory read corrected error with unknown channel */
+        /* Fake a memory read error with unknown channel */
        m.status = MCI_STATUS_VAL | MCI_STATUS_EN | MCI_STATUS_ADDRV | 0x9f;
+        if (severity >= GHES_SEV_RECOVERABLE)
+                m.status |= MCI_STATUS_UC;
+        if (severity >= GHES_SEV_PANIC)
+                m.status |= MCI_STATUS_PCC;
        m.addr = mem_err->physical_addr;
        mce_log(&m);
        mce_notify_irq();
diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c
index b3218cdee95f..4d5419b249da 100644
--- a/arch/x86/kernel/cpu/mcheck/mce.c
+++ b/arch/x86/kernel/cpu/mcheck/mce.c
@@ -1638,15 +1638,15 @@ static void __mcheck_cpu_init_vendor(struct cpuinfo_x86 *c)
 static void mce_start_timer(unsigned int cpu, struct timer_list *t)
 {
-        unsigned long iv = mce_adjust_timer(check_interval * HZ);
+        unsigned long iv = check_interval * HZ;
-        __this_cpu_write(mce_next_interval, iv);
        if (mca_cfg.ignore_ce || !iv)
                return;
+        per_cpu(mce_next_interval, cpu) = iv;
        t->expires = round_jiffies(jiffies + iv);
-        add_timer_on(t, smp_processor_id());
+        add_timer_on(t, cpu);
 }
 static void __mcheck_cpu_init_timer(void)
@@ -2272,8 +2272,10 @@ static int mce_device_create(unsigned int cpu)
        dev->release = &mce_device_release;
        err = device_register(dev);
-        if (err)
+        if (err) {
+                put_device(dev);
                return err;
+        }
        for (i = 0; mce_device_attrs[i]; i++) {
                err = device_create_file(dev, mce_device_attrs[i]);
diff --git a/arch/x86/kernel/cpu/mcheck/mce_intel.c b/arch/x86/kernel/cpu/mcheck/mce_intel.c
index 4cfe0458ca66..fb6156fee6f7 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_intel.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_intel.c
@@ -6,7 +6,6 @@
 */
 #include <linux/gfp.h>
-#include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/percpu.h>
 #include <linux/sched.h>
diff --git a/arch/x86/kernel/cpu/mcheck/p5.c b/arch/x86/kernel/cpu/mcheck/p5.c
index 1c044b1ccc59..a3042989398c 100644
--- a/arch/x86/kernel/cpu/mcheck/p5.c
+++ b/arch/x86/kernel/cpu/mcheck/p5.c
@@ -5,7 +5,6 @@
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
-#include <linux/init.h>
 #include <linux/smp.h>
 #include <asm/processor.h>
diff --git a/arch/x86/kernel/cpu/mcheck/winchip.c b/arch/x86/kernel/cpu/mcheck/winchip.c
index e9a701aecaa1..7dc5564d0cdf 100644
--- a/arch/x86/kernel/cpu/mcheck/winchip.c
+++ b/arch/x86/kernel/cpu/mcheck/winchip.c
@@ -5,7 +5,6 @@
 #include <linux/interrupt.h>
 #include <linux/kernel.h>
 #include <linux/types.h>
-#include <linux/init.h>
 #include <asm/processor.h>
 #include <asm/mce.h>
diff --git a/arch/x86/kernel/cpu/microcode/Makefile b/arch/x86/kernel/cpu/microcode/Makefile
new file mode 100644
index 000000000000..285c85427c32
--- /dev/null
+++ b/arch/x86/kernel/cpu/microcode/Makefile
@@ -0,0 +1,7 @@
+microcode-y                             := core.o
+obj-$(CONFIG_MICROCODE)                 += microcode.o
+microcode-$(CONFIG_MICROCODE_INTEL)     += intel.o intel_lib.o
+microcode-$(CONFIG_MICROCODE_AMD)       += amd.o
+obj-$(CONFIG_MICROCODE_EARLY)           += core_early.o
+obj-$(CONFIG_MICROCODE_INTEL_EARLY)     += intel_early.o
+obj-$(CONFIG_MICROCODE_AMD_EARLY)       += amd_early.o
diff --git a/arch/x86/kernel/microcode_amd.c b/arch/x86/kernel/cpu/microcode/amd.c
index 22b3a1191ab3..8fffd845e22b 100644
--- a/arch/x86/kernel/microcode_amd.c
+++ b/arch/x86/kernel/cpu/microcode/amd.c
@@ -182,10 +182,10 @@ int __apply_microcode_amd(struct microcode_amd *mc_amd)
 {
        u32 rev, dummy;
-        wrmsrl(MSR_AMD64_PATCH_LOADER, (u64)(long)&mc_amd->hdr.data_code);
+        native_wrmsrl(MSR_AMD64_PATCH_LOADER, (u64)(long)&mc_amd->hdr.data_code);
        /* verify patch application was successful */
-        rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);
+        native_rdmsr(MSR_AMD64_PATCH_LEVEL, rev, dummy);
        if (rev != mc_amd->hdr.patch_id)
                return -1;
@@ -332,6 +332,9 @@ static int verify_and_add_patch(u8 family, u8 *fw, unsigned int leftover)
        patch->patch_id  = mc_hdr->patch_id;
        patch->equiv_cpu = proc_id;
+        pr_debug("%s: Added patch_id: 0x%08x, proc_id: 0x%04x\n",
+                 __func__, patch->patch_id, proc_id);
        /* ... and add to cache. */
        update_cache(patch);
@@ -390,9 +393,9 @@ enum ucode_state load_microcode_amd(u8 family, const u8 *data, size_t size)
        if (cpu_data(smp_processor_id()).cpu_index == boot_cpu_data.cpu_index) {
                struct ucode_patch *p = find_patch(smp_processor_id());
                if (p) {
-                        memset(amd_bsp_mpb, 0, MPB_MAX_SIZE);
+                        memset(amd_ucode_patch, 0, PATCH_MAX_SIZE);
-                        memcpy(amd_bsp_mpb, p->data, min_t(u32, ksize(p->data),
+                        memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data),
-                                                           MPB_MAX_SIZE));
+                                                               PATCH_MAX_SIZE));
                }
        }
 #endif
diff --git a/arch/x86/kernel/microcode_amd_early.c b/arch/x86/kernel/cpu/microcode/amd_early.c
index 6073104ccaa3..8384c0fa206f 100644
--- a/arch/x86/kernel/microcode_amd_early.c
+++ b/arch/x86/kernel/cpu/microcode/amd_early.c
@@ -2,6 +2,7 @@
 * Copyright (C) 2013 Advanced Micro Devices, Inc.
 *
 * Author: Jacob Shin <jacob.shin@amd.com>
+ * Fixes: Borislav Petkov <bp@suse.de>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -15,10 +16,18 @@
 #include <asm/setup.h>
 #include <asm/microcode_amd.h>
-static bool ucode_loaded;
+/*
+ * This points to the current valid container of microcode patches which we will
+ * save from the initrd before jettisoning its contents.
+ */
+static u8 *container;
+static size_t container_size;
 static u32 ucode_new_rev;
-static unsigned long ucode_offset;
+u8 amd_ucode_patch[PATCH_MAX_SIZE];
-static size_t ucode_size;
+static u16 this_equiv_id;
+struct cpio_data ucode_cpio;
 /*
 * Microcode patch container file is prepended to the initrd in cpio format.
@@ -32,9 +41,6 @@ static struct cpio_data __init find_ucode_in_initrd(void)
        char *path;
        void *start;
        size_t size;
-        unsigned long *uoffset;
-        size_t *usize;
-        struct cpio_data cd;
 #ifdef CONFIG_X86_32
        struct boot_params *p;
@@ -47,30 +53,50 @@ static struct cpio_data __init find_ucode_in_initrd(void)
        path    = (char *)__pa_nodebug(ucode_path);
        start   = (void *)p->hdr.ramdisk_image;
        size    = p->hdr.ramdisk_size;
-        uoffset = (unsigned long *)__pa_nodebug(&ucode_offset);
-        usize   = (size_t *)__pa_nodebug(&ucode_size);
 #else
        path    = ucode_path;
        start   = (void *)(boot_params.hdr.ramdisk_image + PAGE_OFFSET);
        size    = boot_params.hdr.ramdisk_size;
-        uoffset = &ucode_offset;
-        usize   = &ucode_size;
 #endif
-        cd = find_cpio_data(path, start, size, &offset);
+        return find_cpio_data(path, start, size, &offset);
-        if (!cd.data)
+}
-                return cd;
-        if (*(u32 *)cd.data != UCODE_MAGIC) {
+static size_t compute_container_size(u8 *data, u32 total_size)
-                cd.data = NULL;
+{
-                cd.size = 0;
+        size_t size = 0;
-                return cd;
+        u32 *header = (u32 *)data;
-        }
-        *uoffset = (u8 *)cd.data - (u8 *)start;
+        if (header[0] != UCODE_MAGIC ||
-        *usize   = cd.size;
+            header[1] != UCODE_EQUIV_CPU_TABLE_TYPE || /* type */
+            header[2] == 0)                            /* size */
+                return size;
-        return cd;
+        size = header[2] + CONTAINER_HDR_SZ;
+        total_size -= size;
+        data += size;
+        while (total_size) {
+                u16 patch_size;
+                header = (u32 *)data;
+                if (header[0] != UCODE_UCODE_TYPE)
+                        break;
+                /*
+                 * Sanity-check patch size.
+                 */
+                patch_size = header[1];
+                if (patch_size > PATCH_MAX_SIZE)
+                        break;
+                size       += patch_size + SECTION_HDR_SIZE;
+                data       += patch_size + SECTION_HDR_SIZE;
+                total_size -= patch_size + SECTION_HDR_SIZE;
+        }
+        return size;
 }
 /*
@@ -85,23 +111,22 @@ static struct cpio_data __init find_ucode_in_initrd(void)
 static void apply_ucode_in_initrd(void *ucode, size_t size)
 {
        struct equiv_cpu_entry *eq;
+        size_t *cont_sz;
        u32 *header;
-        u8  *data;
+        u8  *data, **cont;
        u16 eq_id = 0;
        int offset, left;
-        u32 rev, eax;
+        u32 rev, eax, ebx, ecx, edx;
        u32 *new_rev;
-        unsigned long *uoffset;
-        size_t *usize;
 #ifdef CONFIG_X86_32
        new_rev = (u32 *)__pa_nodebug(&ucode_new_rev);
-        uoffset = (unsigned long *)__pa_nodebug(&ucode_offset);
+        cont_sz = (size_t *)__pa_nodebug(&container_size);
-        usize   = (size_t *)__pa_nodebug(&ucode_size);
+        cont    = (u8 **)__pa_nodebug(&container);
 #else
        new_rev = &ucode_new_rev;
-        uoffset = &ucode_offset;
+        cont_sz = &container_size;
-        usize   = &ucode_size;
+        cont    = &container;
 #endif
        data   = ucode;
@@ -109,23 +134,37 @@ static void apply_ucode_in_initrd(void *ucode, size_t size)
        header = (u32 *)data;
        /* find equiv cpu table */
+        if (header[0] != UCODE_MAGIC ||
-        if (header[1] != UCODE_EQUIV_CPU_TABLE_TYPE || /* type */
+            header[1] != UCODE_EQUIV_CPU_TABLE_TYPE || /* type */
            header[2] == 0)                            /* size */
                return;
-        eax = cpuid_eax(0x00000001);
+        eax = 0x00000001;
+        ecx = 0;
+        native_cpuid(&eax, &ebx, &ecx, &edx);
        while (left > 0) {
                eq = (struct equiv_cpu_entry *)(data + CONTAINER_HDR_SZ);
+                *cont = data;
+                /* Advance past the container header */
                offset = header[2] + CONTAINER_HDR_SZ;
                data  += offset;
                left  -= offset;
                eq_id = find_equiv_id(eq, eax);
-                if (eq_id)
+                if (eq_id) {
+                        this_equiv_id = eq_id;
+                        *cont_sz = compute_container_size(*cont, left + offset);
+                        /*
+                         * truncate how much we need to iterate over in the
+                         * ucode update loop below
+                         */
+                        left = *cont_sz - offset;
                        break;
+                }
                /*
                 * support multiple container files appended together. if this
@@ -145,19 +184,18 @@ static void apply_ucode_in_initrd(void *ucode, size_t size)
                /* mark where the next microcode container file starts */
                offset    = data - (u8 *)ucode;
-                *uoffset += offset;
-                *usize   -= offset;
                ucode     = data;
        }
        if (!eq_id) {
-                *usize = 0;
+                *cont = NULL;
+                *cont_sz = 0;
                return;
        }
        /* find ucode and update if needed */
-        rdmsr(MSR_AMD64_PATCH_LEVEL, rev, eax);
+        native_rdmsr(MSR_AMD64_PATCH_LEVEL, rev, eax);
        while (left > 0) {
                struct microcode_amd *mc;
@@ -168,73 +206,83 @@ static void apply_ucode_in_initrd(void *ucode, size_t size)
                        break;
                mc = (struct microcode_amd *)(data + SECTION_HDR_SIZE);
-                if (eq_id == mc->hdr.processor_rev_id && rev < mc->hdr.patch_id)
-                        if (__apply_microcode_amd(mc) == 0) {
+                if (eq_id == mc->hdr.processor_rev_id && rev < mc->hdr.patch_id) {
+                        if (!__apply_microcode_amd(mc)) {
                                rev = mc->hdr.patch_id;
                                *new_rev = rev;
+                                /* save ucode patch */
+                                memcpy(amd_ucode_patch, mc,
+                                       min_t(u32, header[1], PATCH_MAX_SIZE));
                        }
+                }
                offset  = header[1] + SECTION_HDR_SIZE;
                data   += offset;
                left   -= offset;
        }
-        /* mark where this microcode container file ends */
-        offset  = *usize - (data - (u8 *)ucode);
-        *usize -= offset;
-        if (!(*new_rev))
-                *usize = 0;
 }
 void __init load_ucode_amd_bsp(void)
 {
-        struct cpio_data cd = find_ucode_in_initrd();
+        struct cpio_data cp;
-        if (!cd.data)
+        void **data;
+        size_t *size;
+#ifdef CONFIG_X86_32
+        data =  (void **)__pa_nodebug(&ucode_cpio.data);
+        size = (size_t *)__pa_nodebug(&ucode_cpio.size);
+#else
+        data = &ucode_cpio.data;
+        size = &ucode_cpio.size;
+#endif
+        cp = find_ucode_in_initrd();
+        if (!cp.data)
                return;
-        apply_ucode_in_initrd(cd.data, cd.size);
+        *data = cp.data;
+        *size = cp.size;
+        apply_ucode_in_initrd(cp.data, cp.size);
 }
 #ifdef CONFIG_X86_32
-u8 amd_bsp_mpb[MPB_MAX_SIZE];
 /*
 * On 32-bit, since AP's early load occurs before paging is turned on, we
 * cannot traverse cpu_equiv_table and pcache in kernel heap memory. So during
 * cold boot, AP will apply_ucode_in_initrd() just like the BSP. During
- * save_microcode_in_initrd_amd() BSP's patch is copied to amd_bsp_mpb, which
+ * save_microcode_in_initrd_amd() BSP's patch is copied to amd_ucode_patch,
- * is used upon resume from suspend.
+ * which is used upon resume from suspend.
 */
 void load_ucode_amd_ap(void)
 {
        struct microcode_amd *mc;
-        unsigned long *initrd;
-        unsigned long *uoffset;
        size_t *usize;
-        void *ucode;
+        void **ucode;
-        mc = (struct microcode_amd *)__pa(amd_bsp_mpb);
+        mc = (struct microcode_amd *)__pa(amd_ucode_patch);
        if (mc->hdr.patch_id && mc->hdr.processor_rev_id) {
                __apply_microcode_amd(mc);
                return;
        }
-        initrd  = (unsigned long *)__pa(&initrd_start);
+        ucode = (void *)__pa_nodebug(&container);
-        uoffset = (unsigned long *)__pa(&ucode_offset);
+        usize = (size_t *)__pa_nodebug(&container_size);
-        usize   = (size_t *)__pa(&ucode_size);
-        if (!*usize || !*initrd)
+        if (!*ucode || !*usize)
                return;
-        ucode = (void *)((unsigned long)__pa(*initrd) + *uoffset);
+        apply_ucode_in_initrd(*ucode, *usize);
-        apply_ucode_in_initrd(ucode, *usize);
 }
 static void __init collect_cpu_sig_on_bsp(void *arg)
 {
        unsigned int cpu = smp_processor_id();
        struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
        uci->cpu_sig.sig = cpuid_eax(0x00000001);
 }
 #else
@@ -242,36 +290,54 @@ void load_ucode_amd_ap(void)
 {
        unsigned int cpu = smp_processor_id();
        struct ucode_cpu_info *uci = ucode_cpu_info + cpu;
+        struct equiv_cpu_entry *eq;
+        struct microcode_amd *mc;
        u32 rev, eax;
+        u16 eq_id;
+        /* Exit if called on the BSP. */
+        if (!cpu)
+                return;
+        if (!container)
+                return;
        rdmsr(MSR_AMD64_PATCH_LEVEL, rev, eax);
-        eax = cpuid_eax(0x00000001);
        uci->cpu_sig.rev = rev;
        uci->cpu_sig.sig = eax;
-        if (cpu && !ucode_loaded) {
+        eax = cpuid_eax(0x00000001);
-                void *ucode;
+        eq  = (struct equiv_cpu_entry *)(container + CONTAINER_HDR_SZ);
-                if (!ucode_size || !initrd_start)
+        eq_id = find_equiv_id(eq, eax);
-                        return;
+        if (!eq_id)
+                return;
+        if (eq_id == this_equiv_id) {
+                mc = (struct microcode_amd *)amd_ucode_patch;
-                ucode = (void *)(initrd_start + ucode_offset);
+                if (mc && rev < mc->hdr.patch_id) {
-                eax   = ((eax >> 8) & 0xf) + ((eax >> 20) & 0xff);
+                        if (!__apply_microcode_amd(mc))
-                if (load_microcode_amd(eax, ucode, ucode_size) != UCODE_OK)
+                                ucode_new_rev = mc->hdr.patch_id;
+                }
+        } else {
+                if (!ucode_cpio.data)
                        return;
-                ucode_loaded = true;
+                /*
+                 * AP has a different equivalence ID than BSP, looks like
+                 * mixed-steppings silicon so go through the ucode blob anew.
+                 */
+                apply_ucode_in_initrd(ucode_cpio.data, ucode_cpio.size);
        }
-        apply_microcode_amd(cpu);
 }
 #endif
 int __init save_microcode_in_initrd_amd(void)
 {
        enum ucode_state ret;
-        void *ucode;
        u32 eax;
 #ifdef CONFIG_X86_32
@@ -280,22 +346,35 @@ int __init save_microcode_in_initrd_amd(void)
        if (!uci->cpu_sig.sig)
                smp_call_function_single(bsp, collect_cpu_sig_on_bsp, NULL, 1);
+        /*
+         * Take into account the fact that the ramdisk might get relocated
+         * and therefore we need to recompute the container's position in
+         * virtual memory space.
+         */
+        container = (u8 *)(__va((u32)relocated_ramdisk) +
+                           ((u32)container - boot_params.hdr.ramdisk_image));
 #endif
        if (ucode_new_rev)
                pr_info("microcode: updated early to new patch_level=0x%08x\n",
                        ucode_new_rev);
-        if (ucode_loaded || !ucode_size || !initrd_start)
+        if (!container)
-                return 0;
+                return -EINVAL;
-        ucode = (void *)(initrd_start + ucode_offset);
        eax   = cpuid_eax(0x00000001);
        eax   = ((eax >> 8) & 0xf) + ((eax >> 20) & 0xff);
-        ret = load_microcode_amd(eax, ucode, ucode_size);
+        ret = load_microcode_amd(eax, container, container_size);
        if (ret != UCODE_OK)
                return -EINVAL;
-        ucode_loaded = true;
+        /*
+         * This will be freed any msec now, stash patches for the current
+         * family and switch to patch cache for cpu hotplug, etc later.
+         */
+        container = NULL;
+        container_size = 0;
        return 0;
 }
diff --git a/arch/x86/kernel/microcode_core.c b/arch/x86/kernel/cpu/microcode/core.c
index 15c987698b0f..15c987698b0f 100644
--- a/arch/x86/kernel/microcode_core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
diff --git a/arch/x86/kernel/microcode_core_early.c b/arch/x86/kernel/cpu/microcode/core_early.c
index be7f8514f577..be7f8514f577 100644
--- a/arch/x86/kernel/microcode_core_early.c
+++ b/arch/x86/kernel/cpu/microcode/core_early.c
diff --git a/arch/x86/kernel/microcode_intel.c b/arch/x86/kernel/cpu/microcode/intel.c
index a276fa75d9b5..a276fa75d9b5 100644
--- a/arch/x86/kernel/microcode_intel.c
+++ b/arch/x86/kernel/cpu/microcode/intel.c
diff --git a/arch/x86/kernel/microcode_intel_early.c b/arch/x86/kernel/cpu/microcode/intel_early.c
index 1575deb2e636..18f739129e72 100644
--- a/arch/x86/kernel/microcode_intel_early.c
+++ b/arch/x86/kernel/cpu/microcode/intel_early.c
@@ -365,16 +365,6 @@ out:
        return state;
 }
-#define native_rdmsr(msr, val1, val2)           \
-do {                                            \
-        u64 __val = native_read_msr((msr));     \
-        (void)((val1) = (u32)__val);            \
-        (void)((val2) = (u32)(__val >> 32));    \
-} while (0)
-#define native_wrmsr(msr, low, high)            \
-        native_write_msr(msr, low, high);
 static int collect_cpu_info_early(struct ucode_cpu_info *uci)
 {
        unsigned int val[2];
diff --git a/arch/x86/kernel/microcode_intel_lib.c b/arch/x86/kernel/cpu/microcode/intel_lib.c
index ce69320d0179..ce69320d0179 100644
--- a/arch/x86/kernel/microcode_intel_lib.c
+++ b/arch/x86/kernel/cpu/microcode/intel_lib.c
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 8e132931614d..b88645191fe5 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1883,21 +1883,27 @@ static struct pmu pmu = {
 void arch_perf_update_userpage(struct perf_event_mmap_page *userpg, u64 now)
 {
+        struct cyc2ns_data *data;
        userpg->cap_user_time = 0;
        userpg->cap_user_time_zero = 0;
        userpg->cap_user_rdpmc = x86_pmu.attr_rdpmc;
        userpg->pmc_width = x86_pmu.cntval_bits;
-        if (!sched_clock_stable)
+        if (!sched_clock_stable())
                return;
+        data = cyc2ns_read_begin();
        userpg->cap_user_time = 1;
-        userpg->time_mult = this_cpu_read(cyc2ns);
+        userpg->time_mult = data->cyc2ns_mul;
-        userpg->time_shift = CYC2NS_SCALE_FACTOR;
+        userpg->time_shift = data->cyc2ns_shift;
-        userpg->time_offset = this_cpu_read(cyc2ns_offset) - now;
+        userpg->time_offset = data->cyc2ns_offset - now;
        userpg->cap_user_time_zero = 1;
-        userpg->time_zero = this_cpu_read(cyc2ns_offset);
+        userpg->time_zero = data->cyc2ns_offset;
+        cyc2ns_read_end(data);
 }
 /*
diff --git a/arch/x86/kernel/cpu/perf_event_amd_ibs.c b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
index e09f0bfb7b8f..4b8e4d3cd6ea 100644
--- a/arch/x86/kernel/cpu/perf_event_amd_ibs.c
+++ b/arch/x86/kernel/cpu/perf_event_amd_ibs.c
@@ -10,6 +10,7 @@
 #include <linux/module.h>
 #include <linux/pci.h>
 #include <linux/ptrace.h>
+#include <linux/syscore_ops.h>
 #include <asm/apic.h>
@@ -816,6 +817,18 @@ out:
        return ret;
 }
+static void ibs_eilvt_setup(void)
+{
+        /*
+         * Force LVT offset assignment for family 10h: The offsets are
+         * not assigned by the BIOS for this family, so the OS is
+         * responsible for doing it. If the OS assignment fails, fall
+         * back to BIOS settings and try to setup this.
+         */
+        if (boot_cpu_data.x86 == 0x10)
+                force_ibs_eilvt_setup();
+}
 static inline int get_ibs_lvt_offset(void)
 {
        u64 val;
@@ -851,6 +864,36 @@ static void clear_APIC_ibs(void *dummy)
                setup_APIC_eilvt(offset, 0, APIC_EILVT_MSG_FIX, 1);
 }
+#ifdef CONFIG_PM
+static int perf_ibs_suspend(void)
+{
+        clear_APIC_ibs(NULL);
+        return 0;
+}
+static void perf_ibs_resume(void)
+{
+        ibs_eilvt_setup();
+        setup_APIC_ibs(NULL);
+}
+static struct syscore_ops perf_ibs_syscore_ops = {
+        .resume         = perf_ibs_resume,
+        .suspend        = perf_ibs_suspend,
+};
+static void perf_ibs_pm_init(void)
+{
+        register_syscore_ops(&perf_ibs_syscore_ops);
+}
+#else
+static inline void perf_ibs_pm_init(void) { }
+#endif
 static int
 perf_ibs_cpu_notifier(struct notifier_block *self, unsigned long action, void *hcpu)
 {
@@ -877,18 +920,12 @@ static __init int amd_ibs_init(void)
        if (!caps)
                return -ENODEV; /* ibs not supported by the cpu */
-        /*
+        ibs_eilvt_setup();
-         * Force LVT offset assignment for family 10h: The offsets are
-         * not assigned by the BIOS for this family, so the OS is
-         * responsible for doing it. If the OS assignment fails, fall
-         * back to BIOS settings and try to setup this.
-         */
-        if (boot_cpu_data.x86 == 0x10)
-                force_ibs_eilvt_setup();
        if (!ibs_eilvt_valid())
                goto out;
+        perf_ibs_pm_init();
        get_online_cpus();
        ibs_caps = caps;
        /* make ibs_caps visible to other cpus: */
diff --git a/arch/x86/kernel/cpu/perf_event_intel_rapl.c b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
new file mode 100644
index 000000000000..5ad35ad94d0f
--- /dev/null
+++ b/arch/x86/kernel/cpu/perf_event_intel_rapl.c
@@ -0,0 +1,679 @@
+/*
+ * perf_event_intel_rapl.c: support Intel RAPL energy consumption counters
+ * Copyright (C) 2013 Google, Inc., Stephane Eranian
+ *
+ * Intel RAPL interface is specified in the IA-32 Manual Vol3b
+ * section 14.7.1 (September 2013)
+ *
+ * RAPL provides more controls than just reporting energy consumption
+ * however here we only expose the 3 energy consumption free running
+ * counters (pp0, pkg, dram).
+ *
+ * Each of those counters increments in a power unit defined by the
+ * RAPL_POWER_UNIT MSR. On SandyBridge, this unit is 1/(2^16) Joules
+ * but it can vary.
+ *
+ * Counter to rapl events mappings:
+ *
+ *  pp0 counter: consumption of all physical cores (power plane 0)
+ *        event: rapl_energy_cores
+ *    perf code: 0x1
+ *
+ *  pkg counter: consumption of the whole processor package
+ *        event: rapl_energy_pkg
+ *    perf code: 0x2
+ *
+ * dram counter: consumption of the dram domain (servers only)
+ *        event: rapl_energy_dram
+ *    perf code: 0x3
+ *
+ * dram counter: consumption of the builtin-gpu domain (client only)
+ *        event: rapl_energy_gpu
+ *    perf code: 0x4
+ *
+ * We manage those counters as free running (read-only). They may be
+ * use simultaneously by other tools, such as turbostat.
+ *
+ * The events only support system-wide mode counting. There is no
+ * sampling support because it does not make sense and is not
+ * supported by the RAPL hardware.
+ *
+ * Because we want to avoid floating-point operations in the kernel,
+ * the events are all reported in fixed point arithmetic (32.32).
+ * Tools must adjust the counts to convert them to Watts using
+ * the duration of the measurement. Tools may use a function such as
+ * ldexp(raw_count, -32);
+ */
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/perf_event.h>
+#include <asm/cpu_device_id.h>
+#include "perf_event.h"
+/*
+ * RAPL energy status counters
+ */
+#define RAPL_IDX_PP0_NRG_STAT   0       /* all cores */
+#define INTEL_RAPL_PP0          0x1     /* pseudo-encoding */
+#define RAPL_IDX_PKG_NRG_STAT   1       /* entire package */
+#define INTEL_RAPL_PKG          0x2     /* pseudo-encoding */
+#define RAPL_IDX_RAM_NRG_STAT   2       /* DRAM */
+#define INTEL_RAPL_RAM          0x3     /* pseudo-encoding */
+#define RAPL_IDX_PP1_NRG_STAT   3       /* DRAM */
+#define INTEL_RAPL_PP1          0x4     /* pseudo-encoding */
+/* Clients have PP0, PKG */
+#define RAPL_IDX_CLN    (1<<RAPL_IDX_PP0_NRG_STAT|\
+                         1<<RAPL_IDX_PKG_NRG_STAT|\
+                         1<<RAPL_IDX_PP1_NRG_STAT)
+/* Servers have PP0, PKG, RAM */
+#define RAPL_IDX_SRV    (1<<RAPL_IDX_PP0_NRG_STAT|\
+                         1<<RAPL_IDX_PKG_NRG_STAT|\
+                         1<<RAPL_IDX_RAM_NRG_STAT)
+/*
+ * event code: LSB 8 bits, passed in attr->config
+ * any other bit is reserved
+ */
+#define RAPL_EVENT_MASK 0xFFULL
+#define DEFINE_RAPL_FORMAT_ATTR(_var, _name, _format)           \
+static ssize_t __rapl_##_var##_show(struct kobject *kobj,       \
+                                struct kobj_attribute *attr,    \
+                                char *page)                     \
+{                                                               \
+        BUILD_BUG_ON(sizeof(_format) >= PAGE_SIZE);             \
+        return sprintf(page, _format "\n");                     \
+}                                                               \
+static struct kobj_attribute format_attr_##_var =               \
+        __ATTR(_name, 0444, __rapl_##_var##_show, NULL)
+#define RAPL_EVENT_DESC(_name, _config)                         \
+{                                                               \
+        .attr   = __ATTR(_name, 0444, rapl_event_show, NULL),   \
+        .config = _config,                                      \
+}
+#define RAPL_CNTR_WIDTH 32 /* 32-bit rapl counters */
+struct rapl_pmu {
+        spinlock_t       lock;
+        int              hw_unit;  /* 1/2^hw_unit Joule */
+        int              n_active; /* number of active events */
+        struct list_head active_list;
+        struct pmu       *pmu; /* pointer to rapl_pmu_class */
+        ktime_t          timer_interval; /* in ktime_t unit */
+        struct hrtimer   hrtimer;
+};
+static struct pmu rapl_pmu_class;
+static cpumask_t rapl_cpu_mask;
+static int rapl_cntr_mask;
+static DEFINE_PER_CPU(struct rapl_pmu *, rapl_pmu);
+static DEFINE_PER_CPU(struct rapl_pmu *, rapl_pmu_to_free);
+static inline u64 rapl_read_counter(struct perf_event *event)
+{
+        u64 raw;
+        rdmsrl(event->hw.event_base, raw);
+        return raw;
+}
+static inline u64 rapl_scale(u64 v)
+{
+        /*
+         * scale delta to smallest unit (1/2^32)
+         * users must then scale back: count * 1/(1e9*2^32) to get Joules
+         * or use ldexp(count, -32).
+         * Watts = Joules/Time delta
+         */
+        return v << (32 - __get_cpu_var(rapl_pmu)->hw_unit);
+}
+static u64 rapl_event_update(struct perf_event *event)
+{
+        struct hw_perf_event *hwc = &event->hw;
+        u64 prev_raw_count, new_raw_count;
+        s64 delta, sdelta;
+        int shift = RAPL_CNTR_WIDTH;
+again:
+        prev_raw_count = local64_read(&hwc->prev_count);
+        rdmsrl(event->hw.event_base, new_raw_count);
+        if (local64_cmpxchg(&hwc->prev_count, prev_raw_count,
+                            new_raw_count) != prev_raw_count) {
+                cpu_relax();
+                goto again;
+        }
+        /*
+         * Now we have the new raw value and have updated the prev
+         * timestamp already. We can now calculate the elapsed delta
+         * (event-)time and add that to the generic event.
+         *
+         * Careful, not all hw sign-extends above the physical width
+         * of the count.
+         */
+        delta = (new_raw_count << shift) - (prev_raw_count << shift);
+        delta >>= shift;
+        sdelta = rapl_scale(delta);
+        local64_add(sdelta, &event->count);
+        return new_raw_count;
+}
+static void rapl_start_hrtimer(struct rapl_pmu *pmu)
+{
+        __hrtimer_start_range_ns(&pmu->hrtimer,
+                        pmu->timer_interval, 0,
+                        HRTIMER_MODE_REL_PINNED, 0);
+}
+static void rapl_stop_hrtimer(struct rapl_pmu *pmu)
+{
+        hrtimer_cancel(&pmu->hrtimer);
+}
+static enum hrtimer_restart rapl_hrtimer_handle(struct hrtimer *hrtimer)
+{
+        struct rapl_pmu *pmu = __get_cpu_var(rapl_pmu);
+        struct perf_event *event;
+        unsigned long flags;
+        if (!pmu->n_active)
+                return HRTIMER_NORESTART;
+        spin_lock_irqsave(&pmu->lock, flags);
+        list_for_each_entry(event, &pmu->active_list, active_entry) {
+                rapl_event_update(event);
+        }
+        spin_unlock_irqrestore(&pmu->lock, flags);
+        hrtimer_forward_now(hrtimer, pmu->timer_interval);
+        return HRTIMER_RESTART;
+}
+static void rapl_hrtimer_init(struct rapl_pmu *pmu)
+{
+        struct hrtimer *hr = &pmu->hrtimer;
+        hrtimer_init(hr, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        hr->function = rapl_hrtimer_handle;
+}
+static void __rapl_pmu_event_start(struct rapl_pmu *pmu,
+                                   struct perf_event *event)
+{
+        if (WARN_ON_ONCE(!(event->hw.state & PERF_HES_STOPPED)))
+                return;
+        event->hw.state = 0;
+        list_add_tail(&event->active_entry, &pmu->active_list);
+        local64_set(&event->hw.prev_count, rapl_read_counter(event));
+        pmu->n_active++;
+        if (pmu->n_active == 1)
+                rapl_start_hrtimer(pmu);
+}
+static void rapl_pmu_event_start(struct perf_event *event, int mode)
+{
+        struct rapl_pmu *pmu = __get_cpu_var(rapl_pmu);
+        unsigned long flags;
+        spin_lock_irqsave(&pmu->lock, flags);
+        __rapl_pmu_event_start(pmu, event);
+        spin_unlock_irqrestore(&pmu->lock, flags);
+}
+static void rapl_pmu_event_stop(struct perf_event *event, int mode)
+{
+        struct rapl_pmu *pmu = __get_cpu_var(rapl_pmu);
+        struct hw_perf_event *hwc = &event->hw;
+        unsigned long flags;
+        spin_lock_irqsave(&pmu->lock, flags);
+        /* mark event as deactivated and stopped */
+        if (!(hwc->state & PERF_HES_STOPPED)) {
+                WARN_ON_ONCE(pmu->n_active <= 0);
+                pmu->n_active--;
+                if (pmu->n_active == 0)
+                        rapl_stop_hrtimer(pmu);
+                list_del(&event->active_entry);
+                WARN_ON_ONCE(hwc->state & PERF_HES_STOPPED);
+                hwc->state |= PERF_HES_STOPPED;
+        }
+        /* check if update of sw counter is necessary */
+        if ((mode & PERF_EF_UPDATE) && !(hwc->state & PERF_HES_UPTODATE)) {
+                /*
+                 * Drain the remaining delta count out of a event
+                 * that we are disabling:
+                 */
+                rapl_event_update(event);
+                hwc->state |= PERF_HES_UPTODATE;
+        }
+        spin_unlock_irqrestore(&pmu->lock, flags);
+}
+static int rapl_pmu_event_add(struct perf_event *event, int mode)
+{
+        struct rapl_pmu *pmu = __get_cpu_var(rapl_pmu);
+        struct hw_perf_event *hwc = &event->hw;
+        unsigned long flags;
+        spin_lock_irqsave(&pmu->lock, flags);
+        hwc->state = PERF_HES_UPTODATE | PERF_HES_STOPPED;
+        if (mode & PERF_EF_START)
+                __rapl_pmu_event_start(pmu, event);
+        spin_unlock_irqrestore(&pmu->lock, flags);
+        return 0;
+}
+static void rapl_pmu_event_del(struct perf_event *event, int flags)
+{
+        rapl_pmu_event_stop(event, PERF_EF_UPDATE);
+}
+static int rapl_pmu_event_init(struct perf_event *event)
+{
+        u64 cfg = event->attr.config & RAPL_EVENT_MASK;
+        int bit, msr, ret = 0;
+        /* only look at RAPL events */
+        if (event->attr.type != rapl_pmu_class.type)
+                return -ENOENT;
+        /* check only supported bits are set */
+        if (event->attr.config & ~RAPL_EVENT_MASK)
+                return -EINVAL;
+        /*
+         * check event is known (determines counter)
+         */
+        switch (cfg) {
+        case INTEL_RAPL_PP0:
+                bit = RAPL_IDX_PP0_NRG_STAT;
+                msr = MSR_PP0_ENERGY_STATUS;
+                break;
+        case INTEL_RAPL_PKG:
+                bit = RAPL_IDX_PKG_NRG_STAT;
+                msr = MSR_PKG_ENERGY_STATUS;
+                break;
+        case INTEL_RAPL_RAM:
+                bit = RAPL_IDX_RAM_NRG_STAT;
+                msr = MSR_DRAM_ENERGY_STATUS;
+                break;
+        case INTEL_RAPL_PP1:
+                bit = RAPL_IDX_PP1_NRG_STAT;
+                msr = MSR_PP1_ENERGY_STATUS;
+                break;
+        default:
+                return -EINVAL;
+        }
+        /* check event supported */
+        if (!(rapl_cntr_mask & (1 << bit)))
+                return -EINVAL;
+        /* unsupported modes and filters */
+        if (event->attr.exclude_user   ||
+            event->attr.exclude_kernel ||
+            event->attr.exclude_hv     ||
+            event->attr.exclude_idle   ||
+            event->attr.exclude_host   ||
+            event->attr.exclude_guest  ||
+            event->attr.sample_period) /* no sampling */
+                return -EINVAL;
+        /* must be done before validate_group */
+        event->hw.event_base = msr;
+        event->hw.config = cfg;
+        event->hw.idx = bit;
+        return ret;
+}
+static void rapl_pmu_event_read(struct perf_event *event)
+{
+        rapl_event_update(event);
+}
+static ssize_t rapl_get_attr_cpumask(struct device *dev,
+                                struct device_attribute *attr, char *buf)
+{
+        int n = cpulist_scnprintf(buf, PAGE_SIZE - 2, &rapl_cpu_mask);
+        buf[n++] = '\n';
+        buf[n] = '\0';
+        return n;
+}
+static DEVICE_ATTR(cpumask, S_IRUGO, rapl_get_attr_cpumask, NULL);
+static struct attribute *rapl_pmu_attrs[] = {
+        &dev_attr_cpumask.attr,
+        NULL,
+};
+static struct attribute_group rapl_pmu_attr_group = {
+        .attrs = rapl_pmu_attrs,
+};
+EVENT_ATTR_STR(energy-cores, rapl_cores, "event=0x01");
+EVENT_ATTR_STR(energy-pkg  ,   rapl_pkg, "event=0x02");
+EVENT_ATTR_STR(energy-ram  ,   rapl_ram, "event=0x03");
+EVENT_ATTR_STR(energy-gpu  ,   rapl_gpu, "event=0x04");
+EVENT_ATTR_STR(energy-cores.unit, rapl_cores_unit, "Joules");
+EVENT_ATTR_STR(energy-pkg.unit  ,   rapl_pkg_unit, "Joules");
+EVENT_ATTR_STR(energy-ram.unit  ,   rapl_ram_unit, "Joules");
+EVENT_ATTR_STR(energy-gpu.unit  ,   rapl_gpu_unit, "Joules");
+/*
+ * we compute in 0.23 nJ increments regardless of MSR
+ */
+EVENT_ATTR_STR(energy-cores.scale, rapl_cores_scale, "2.3283064365386962890625e-10");
+EVENT_ATTR_STR(energy-pkg.scale,     rapl_pkg_scale, "2.3283064365386962890625e-10");
+EVENT_ATTR_STR(energy-ram.scale,     rapl_ram_scale, "2.3283064365386962890625e-10");
+EVENT_ATTR_STR(energy-gpu.scale,     rapl_gpu_scale, "2.3283064365386962890625e-10");
+static struct attribute *rapl_events_srv_attr[] = {
+        EVENT_PTR(rapl_cores),
+        EVENT_PTR(rapl_pkg),
+        EVENT_PTR(rapl_ram),
+        EVENT_PTR(rapl_cores_unit),
+        EVENT_PTR(rapl_pkg_unit),
+        EVENT_PTR(rapl_ram_unit),
+        EVENT_PTR(rapl_cores_scale),
+        EVENT_PTR(rapl_pkg_scale),
+        EVENT_PTR(rapl_ram_scale),
+        NULL,
+};
+static struct attribute *rapl_events_cln_attr[] = {
+        EVENT_PTR(rapl_cores),
+        EVENT_PTR(rapl_pkg),
+        EVENT_PTR(rapl_gpu),
+        EVENT_PTR(rapl_cores_unit),
+        EVENT_PTR(rapl_pkg_unit),
+        EVENT_PTR(rapl_gpu_unit),
+        EVENT_PTR(rapl_cores_scale),
+        EVENT_PTR(rapl_pkg_scale),
+        EVENT_PTR(rapl_gpu_scale),
+        NULL,
+};
+static struct attribute_group rapl_pmu_events_group = {
+        .name = "events",
+        .attrs = NULL, /* patched at runtime */
+};
+DEFINE_RAPL_FORMAT_ATTR(event, event, "config:0-7");
+static struct attribute *rapl_formats_attr[] = {
+        &format_attr_event.attr,
+        NULL,
+};
+static struct attribute_group rapl_pmu_format_group = {
+        .name = "format",
+        .attrs = rapl_formats_attr,
+};
+const struct attribute_group *rapl_attr_groups[] = {
+        &rapl_pmu_attr_group,
+        &rapl_pmu_format_group,
+        &rapl_pmu_events_group,
+        NULL,
+};
+static struct pmu rapl_pmu_class = {
+        .attr_groups    = rapl_attr_groups,
+        .task_ctx_nr    = perf_invalid_context, /* system-wide only */
+        .event_init     = rapl_pmu_event_init,
+        .add            = rapl_pmu_event_add, /* must have */
+        .del            = rapl_pmu_event_del, /* must have */
+        .start          = rapl_pmu_event_start,
+        .stop           = rapl_pmu_event_stop,
+        .read           = rapl_pmu_event_read,
+};
+static void rapl_cpu_exit(int cpu)
+{
+        struct rapl_pmu *pmu = per_cpu(rapl_pmu, cpu);
+        int i, phys_id = topology_physical_package_id(cpu);
+        int target = -1;
+        /* find a new cpu on same package */
+        for_each_online_cpu(i) {
+                if (i == cpu)
+                        continue;
+                if (phys_id == topology_physical_package_id(i)) {
+                        target = i;
+                        break;
+                }
+        }
+        /*
+         * clear cpu from cpumask
+         * if was set in cpumask and still some cpu on package,
+         * then move to new cpu
+         */
+        if (cpumask_test_and_clear_cpu(cpu, &rapl_cpu_mask) && target >= 0)
+                cpumask_set_cpu(target, &rapl_cpu_mask);
+        WARN_ON(cpumask_empty(&rapl_cpu_mask));
+        /*
+         * migrate events and context to new cpu
+         */
+        if (target >= 0)
+                perf_pmu_migrate_context(pmu->pmu, cpu, target);
+        /* cancel overflow polling timer for CPU */
+        rapl_stop_hrtimer(pmu);
+}
+static void rapl_cpu_init(int cpu)
+{
+        int i, phys_id = topology_physical_package_id(cpu);
+        /* check if phys_is is already covered */
+        for_each_cpu(i, &rapl_cpu_mask) {
+                if (phys_id == topology_physical_package_id(i))
+                        return;
+        }
+        /* was not found, so add it */
+        cpumask_set_cpu(cpu, &rapl_cpu_mask);
+}
+static int rapl_cpu_prepare(int cpu)
+{
+        struct rapl_pmu *pmu = per_cpu(rapl_pmu, cpu);
+        int phys_id = topology_physical_package_id(cpu);
+        u64 ms;
+        if (pmu)
+                return 0;
+        if (phys_id < 0)
+                return -1;
+        pmu = kzalloc_node(sizeof(*pmu), GFP_KERNEL, cpu_to_node(cpu));
+        if (!pmu)
+                return -1;
+        spin_lock_init(&pmu->lock);
+        INIT_LIST_HEAD(&pmu->active_list);
+        /*
+         * grab power unit as: 1/2^unit Joules
+         *
+         * we cache in local PMU instance
+         */
+        rdmsrl(MSR_RAPL_POWER_UNIT, pmu->hw_unit);
+        pmu->hw_unit = (pmu->hw_unit >> 8) & 0x1FULL;
+        pmu->pmu = &rapl_pmu_class;
+        /*
+         * use reference of 200W for scaling the timeout
+         * to avoid missing counter overflows.
+         * 200W = 200 Joules/sec
+         * divide interval by 2 to avoid lockstep (2 * 100)
+         * if hw unit is 32, then we use 2 ms 1/200/2
+         */
+        if (pmu->hw_unit < 32)
+                ms = (1000 / (2 * 100)) * (1ULL << (32 - pmu->hw_unit - 1));
+        else
+                ms = 2;
+        pmu->timer_interval = ms_to_ktime(ms);
+        rapl_hrtimer_init(pmu);
+        /* set RAPL pmu for this cpu for now */
+        per_cpu(rapl_pmu, cpu) = pmu;
+        per_cpu(rapl_pmu_to_free, cpu) = NULL;
+        return 0;
+}
+static void rapl_cpu_kfree(int cpu)
+{
+        struct rapl_pmu *pmu = per_cpu(rapl_pmu_to_free, cpu);
+        kfree(pmu);
+        per_cpu(rapl_pmu_to_free, cpu) = NULL;
+}
+static int rapl_cpu_dying(int cpu)
+{
+        struct rapl_pmu *pmu = per_cpu(rapl_pmu, cpu);
+        if (!pmu)
+                return 0;
+        per_cpu(rapl_pmu, cpu) = NULL;
+        per_cpu(rapl_pmu_to_free, cpu) = pmu;
+        return 0;
+}
+static int rapl_cpu_notifier(struct notifier_block *self,
+                             unsigned long action, void *hcpu)
+{
+        unsigned int cpu = (long)hcpu;
+        switch (action & ~CPU_TASKS_FROZEN) {
+        case CPU_UP_PREPARE:
+                rapl_cpu_prepare(cpu);
+                break;
+        case CPU_STARTING:
+                rapl_cpu_init(cpu);
+                break;
+        case CPU_UP_CANCELED:
+        case CPU_DYING:
+                rapl_cpu_dying(cpu);
+                break;
+        case CPU_ONLINE:
+        case CPU_DEAD:
+                rapl_cpu_kfree(cpu);
+                break;
+        case CPU_DOWN_PREPARE:
+                rapl_cpu_exit(cpu);
+                break;
+        default:
+                break;
+        }
+        return NOTIFY_OK;
+}
+static const struct x86_cpu_id rapl_cpu_match[] = {
+        [0] = { .vendor = X86_VENDOR_INTEL, .family = 6 },
+        [1] = {},
+};
+static int __init rapl_pmu_init(void)
+{
+        struct rapl_pmu *pmu;
+        int cpu, ret;
+        /*
+         * check for Intel processor family 6
+         */
+        if (!x86_match_cpu(rapl_cpu_match))
+                return 0;
+        /* check supported CPU */
+        switch (boot_cpu_data.x86_model) {
+        case 42: /* Sandy Bridge */
+        case 58: /* Ivy Bridge */
+        case 60: /* Haswell */
+        case 69: /* Haswell-Celeron */
+                rapl_cntr_mask = RAPL_IDX_CLN;
+                rapl_pmu_events_group.attrs = rapl_events_cln_attr;
+                break;
+        case 45: /* Sandy Bridge-EP */
+        case 62: /* IvyTown */
+                rapl_cntr_mask = RAPL_IDX_SRV;
+                rapl_pmu_events_group.attrs = rapl_events_srv_attr;
+                break;
+        default:
+                /* unsupported */
+                return 0;
+        }
+        get_online_cpus();
+        for_each_online_cpu(cpu) {
+                rapl_cpu_prepare(cpu);
+                rapl_cpu_init(cpu);
+        }
+        perf_cpu_notifier(rapl_cpu_notifier);
+        ret = perf_pmu_register(&rapl_pmu_class, "power", -1);
+        if (WARN_ON(ret)) {
+                pr_info("RAPL PMU detected, registration failed (%d), RAPL PMU disabled\n", ret);
+                put_online_cpus();
+                return -1;
+        }
+        pmu = __get_cpu_var(rapl_pmu);
+        pr_info("RAPL PMU detected, hw unit 2^-%d Joules,"
+                " API unit is 2^-32 Joules,"
+                " %d fixed counters"
+                " %llu ms ovfl timer\n",
+                pmu->hw_unit,
+                hweight32(rapl_cntr_mask),
+                ktime_to_ms(pmu->timer_interval));
+        put_online_cpus();
+        return 0;
+}
+device_initcall(rapl_pmu_init);
diff --git a/arch/x86/kernel/cpu/rdrand.c b/arch/x86/kernel/cpu/rdrand.c
index 88db010845cb..384df5105fbc 100644
--- a/arch/x86/kernel/cpu/rdrand.c
+++ b/arch/x86/kernel/cpu/rdrand.c
@@ -31,20 +31,6 @@ static int __init x86_rdrand_setup(char *s)
 }
 __setup("nordrand", x86_rdrand_setup);
-/* We can't use arch_get_random_long() here since alternatives haven't run */
-static inline int rdrand_long(unsigned long *v)
-{
-        int ok;
-        asm volatile("1: " RDRAND_LONG "\n\t"
-                     "jc 2f\n\t"
-                     "decl %0\n\t"
-                     "jnz 1b\n\t"
-                     "2:"
-                     : "=r" (ok), "=a" (*v)
-                     : "0" (RDRAND_RETRY_LOOPS));
-        return ok;
-}
 /*
 * Force a reseed cycle; we are architecturally guaranteed a reseed
 * after no more than 512 128-bit chunks of random data.  This also
diff --git a/arch/x86/kernel/cpu/transmeta.c b/arch/x86/kernel/cpu/transmeta.c
index aa0430d69b90..3fa0e5ad86b4 100644
--- a/arch/x86/kernel/cpu/transmeta.c
+++ b/arch/x86/kernel/cpu/transmeta.c
@@ -1,6 +1,5 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
-#include <linux/init.h>
 #include <asm/processor.h>
 #include <asm/msr.h>
 #include "cpu.h"
diff --git a/arch/x86/kernel/cpu/umc.c b/arch/x86/kernel/cpu/umc.c
index 75c5ad5d35cc..ef9c2a0078bd 100644
--- a/arch/x86/kernel/cpu/umc.c
+++ b/arch/x86/kernel/cpu/umc.c
@@ -1,5 +1,4 @@
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <asm/processor.h>
 #include "cpu.h"
diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
index 18677a90d6a3..a57902efe2d5 100644
--- a/arch/x86/kernel/crash.c
+++ b/arch/x86/kernel/crash.c
@@ -7,7 +7,6 @@
 *
 */
-#include <linux/init.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/smp.h>
diff --git a/arch/x86/kernel/doublefault.c b/arch/x86/kernel/doublefault.c
index 5d3fe8d36e4a..f6dfd9334b67 100644
--- a/arch/x86/kernel/doublefault.c
+++ b/arch/x86/kernel/doublefault.c
@@ -1,6 +1,5 @@
 #include <linux/mm.h>
 #include <linux/sched.h>
-#include <linux/init.h>
 #include <linux/init_task.h>
 #include <linux/fs.h>
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index 51e2988c5728..a2a4f4697889 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -1082,7 +1082,7 @@ ENTRY(ftrace_caller)
        pushl $0        /* Pass NULL as regs pointer */
        movl 4*4(%esp), %eax
        movl 0x4(%ebp), %edx
-        leal function_trace_op, %ecx
+        movl function_trace_op, %ecx
        subl $MCOUNT_INSN_SIZE, %eax
 .globl ftrace_call
@@ -1140,7 +1140,7 @@ ENTRY(ftrace_regs_caller)
        movl 12*4(%esp), %eax   /* Load ip (1st parameter) */
        subl $MCOUNT_INSN_SIZE, %eax    /* Adjust ip */
        movl 0x4(%ebp), %edx    /* Load parent ip (2nd parameter) */
-        leal function_trace_op, %ecx /* Save ftrace_pos in 3rd parameter */
+        movl function_trace_op, %ecx /* Save ftrace_pos in 3rd parameter */
        pushl %esp              /* Save pt_regs as 4th parameter */
 GLOBAL(ftrace_regs_call)
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index e21b0785a85b..1e96c3628bf2 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -88,7 +88,7 @@ END(function_hook)
        MCOUNT_SAVE_FRAME \skip
        /* Load the ftrace_ops into the 3rd parameter */
-        leaq function_trace_op, %rdx
+        movq function_trace_op(%rip), %rdx
        /* Load ip into the first parameter */
        movq RIP(%rsp), %rdi
diff --git a/arch/x86/kernel/hw_breakpoint.c b/arch/x86/kernel/hw_breakpoint.c
index f66ff162dce8..a67b47c31314 100644
--- a/arch/x86/kernel/hw_breakpoint.c
+++ b/arch/x86/kernel/hw_breakpoint.c
@@ -38,7 +38,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/sched.h>
-#include <linux/init.h>
 #include <linux/smp.h>
 #include <asm/hw_breakpoint.h>
diff --git a/arch/x86/kernel/iosf_mbi.c b/arch/x86/kernel/iosf_mbi.c
new file mode 100644
index 000000000000..c3aae6672843
--- /dev/null
+++ b/arch/x86/kernel/iosf_mbi.c
@@ -0,0 +1,226 @@
+/*
+ * IOSF-SB MailBox Interface Driver
+ * Copyright (c) 2013, Intel Corporation.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ *
+ * The IOSF-SB is a fabric bus available on Atom based SOC's that uses a
+ * mailbox interface (MBI) to communicate with mutiple devices. This
+ * driver implements access to this interface for those platforms that can
+ * enumerate the device using PCI.
+ */
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/spinlock.h>
+#include <linux/pci.h>
+#include <asm/iosf_mbi.h>
+static DEFINE_SPINLOCK(iosf_mbi_lock);
+static inline u32 iosf_mbi_form_mcr(u8 op, u8 port, u8 offset)
+{
+        return (op << 24) | (port << 16) | (offset << 8) | MBI_ENABLE;
+}
+static struct pci_dev *mbi_pdev;        /* one mbi device */
+static int iosf_mbi_pci_read_mdr(u32 mcrx, u32 mcr, u32 *mdr)
+{
+        int result;
+        if (!mbi_pdev)
+                return -ENODEV;
+        if (mcrx) {
+                result = pci_write_config_dword(mbi_pdev, MBI_MCRX_OFFSET,
+                                                mcrx);
+                if (result < 0)
+                        goto fail_read;
+        }
+        result = pci_write_config_dword(mbi_pdev, MBI_MCR_OFFSET, mcr);
+        if (result < 0)
+                goto fail_read;
+        result = pci_read_config_dword(mbi_pdev, MBI_MDR_OFFSET, mdr);
+        if (result < 0)
+                goto fail_read;
+        return 0;
+fail_read:
+        dev_err(&mbi_pdev->dev, "PCI config access failed with %d\n", result);
+        return result;
+}
+static int iosf_mbi_pci_write_mdr(u32 mcrx, u32 mcr, u32 mdr)
+{
+        int result;
+        if (!mbi_pdev)
+                return -ENODEV;
+        result = pci_write_config_dword(mbi_pdev, MBI_MDR_OFFSET, mdr);
+        if (result < 0)
+                goto fail_write;
+        if (mcrx) {
+                result = pci_write_config_dword(mbi_pdev, MBI_MCRX_OFFSET,
+                                                mcrx);
+                if (result < 0)
+                        goto fail_write;
+        }
+        result = pci_write_config_dword(mbi_pdev, MBI_MCR_OFFSET, mcr);
+        if (result < 0)
+                goto fail_write;
+        return 0;
+fail_write:
+        dev_err(&mbi_pdev->dev, "PCI config access failed with %d\n", result);
+        return result;
+}
+int iosf_mbi_read(u8 port, u8 opcode, u32 offset, u32 *mdr)
+{
+        u32 mcr, mcrx;
+        unsigned long flags;
+        int ret;
+        /*Access to the GFX unit is handled by GPU code */
+        if (port == BT_MBI_UNIT_GFX) {
+                WARN_ON(1);
+                return -EPERM;
+        }
+        mcr = iosf_mbi_form_mcr(opcode, port, offset & MBI_MASK_LO);
+        mcrx = offset & MBI_MASK_HI;
+        spin_lock_irqsave(&iosf_mbi_lock, flags);
+        ret = iosf_mbi_pci_read_mdr(mcrx, mcr, mdr);
+        spin_unlock_irqrestore(&iosf_mbi_lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(iosf_mbi_read);
+int iosf_mbi_write(u8 port, u8 opcode, u32 offset, u32 mdr)
+{
+        u32 mcr, mcrx;
+        unsigned long flags;
+        int ret;
+        /*Access to the GFX unit is handled by GPU code */
+        if (port == BT_MBI_UNIT_GFX) {
+                WARN_ON(1);
+                return -EPERM;
+        }
+        mcr = iosf_mbi_form_mcr(opcode, port, offset & MBI_MASK_LO);
+        mcrx = offset & MBI_MASK_HI;
+        spin_lock_irqsave(&iosf_mbi_lock, flags);
+        ret = iosf_mbi_pci_write_mdr(mcrx, mcr, mdr);
+        spin_unlock_irqrestore(&iosf_mbi_lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(iosf_mbi_write);
+int iosf_mbi_modify(u8 port, u8 opcode, u32 offset, u32 mdr, u32 mask)
+{
+        u32 mcr, mcrx;
+        u32 value;
+        unsigned long flags;
+        int ret;
+        /*Access to the GFX unit is handled by GPU code */
+        if (port == BT_MBI_UNIT_GFX) {
+                WARN_ON(1);
+                return -EPERM;
+        }
+        mcr = iosf_mbi_form_mcr(opcode, port, offset & MBI_MASK_LO);
+        mcrx = offset & MBI_MASK_HI;
+        spin_lock_irqsave(&iosf_mbi_lock, flags);
+        /* Read current mdr value */
+        ret = iosf_mbi_pci_read_mdr(mcrx, mcr & MBI_RD_MASK, &value);
+        if (ret < 0) {
+                spin_unlock_irqrestore(&iosf_mbi_lock, flags);
+                return ret;
+        }
+        /* Apply mask */
+        value &= ~mask;
+        mdr &= mask;
+        value |= mdr;
+        /* Write back */
+        ret = iosf_mbi_pci_write_mdr(mcrx, mcr | MBI_WR_MASK, value);
+        spin_unlock_irqrestore(&iosf_mbi_lock, flags);
+        return ret;
+}
+EXPORT_SYMBOL(iosf_mbi_modify);
+static int iosf_mbi_probe(struct pci_dev *pdev,
+                          const struct pci_device_id *unused)
+{
+        int ret;
+        ret = pci_enable_device(pdev);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "error: could not enable device\n");
+                return ret;
+        }
+        mbi_pdev = pci_dev_get(pdev);
+        return 0;
+}
+static DEFINE_PCI_DEVICE_TABLE(iosf_mbi_pci_ids) = {
+        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0F00) },
+        { 0, },
+};
+MODULE_DEVICE_TABLE(pci, iosf_mbi_pci_ids);
+static struct pci_driver iosf_mbi_pci_driver = {
+        .name           = "iosf_mbi_pci",
+        .probe          = iosf_mbi_probe,
+        .id_table       = iosf_mbi_pci_ids,
+};
+static int __init iosf_mbi_init(void)
+{
+        return pci_register_driver(&iosf_mbi_pci_driver);
+}
+static void __exit iosf_mbi_exit(void)
+{
+        pci_unregister_driver(&iosf_mbi_pci_driver);
+        if (mbi_pdev) {
+                pci_dev_put(mbi_pdev);
+                mbi_pdev = NULL;
+        }
+}
+module_init(iosf_mbi_init);
+module_exit(iosf_mbi_exit);
+MODULE_AUTHOR("David E. Box <david.e.box@linux.intel.com>");
+MODULE_DESCRIPTION("IOSF Mailbox Interface accessor");
+MODULE_LICENSE("GPL v2");
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 22d0687e7fda..dbb60878b744 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -193,9 +193,13 @@ __visible unsigned int __irq_entry do_IRQ(struct pt_regs *regs)
        if (!handle_irq(irq, regs)) {
                ack_APIC_irq();
-                if (printk_ratelimit())
+                if (irq != VECTOR_RETRIGGERED) {
-                        pr_emerg("%s: %d.%d No irq handler for vector (irq %d)\n",
+                        pr_emerg_ratelimited("%s: %d.%d No irq handler for vector (irq %d)\n",
-                                __func__, smp_processor_id(), vector, irq);
+                                             __func__, smp_processor_id(),
+                                             vector, irq);
+                } else {
+                        __this_cpu_write(vector_irq[vector], VECTOR_UNDEFINED);
+                }
        }
        irq_exit();
@@ -262,6 +266,76 @@ __visible void smp_trace_x86_platform_ipi(struct pt_regs *regs)
 EXPORT_SYMBOL_GPL(vector_used_by_percpu_irq);
 #ifdef CONFIG_HOTPLUG_CPU
+/*
+ * This cpu is going to be removed and its vectors migrated to the remaining
+ * online cpus.  Check to see if there are enough vectors in the remaining cpus.
+ * This function is protected by stop_machine().
+ */
+int check_irq_vectors_for_cpu_disable(void)
+{
+        int irq, cpu;
+        unsigned int this_cpu, vector, this_count, count;
+        struct irq_desc *desc;
+        struct irq_data *data;
+        struct cpumask affinity_new, online_new;
+        this_cpu = smp_processor_id();
+        cpumask_copy(&online_new, cpu_online_mask);
+        cpu_clear(this_cpu, online_new);
+        this_count = 0;
+        for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; vector++) {
+                irq = __this_cpu_read(vector_irq[vector]);
+                if (irq >= 0) {
+                        desc = irq_to_desc(irq);
+                        data = irq_desc_get_irq_data(desc);
+                        cpumask_copy(&affinity_new, data->affinity);
+                        cpu_clear(this_cpu, affinity_new);
+                        /* Do not count inactive or per-cpu irqs. */
+                        if (!irq_has_action(irq) || irqd_is_per_cpu(data))
+                                continue;
+                        /*
+                         * A single irq may be mapped to multiple
+                         * cpu's vector_irq[] (for example IOAPIC cluster
+                         * mode).  In this case we have two
+                         * possibilities:
+                         *
+                         * 1) the resulting affinity mask is empty; that is
+                         * this the down'd cpu is the last cpu in the irq's
+                         * affinity mask, or
+                         *
+                         * 2) the resulting affinity mask is no longer
+                         * a subset of the online cpus but the affinity
+                         * mask is not zero; that is the down'd cpu is the
+                         * last online cpu in a user set affinity mask.
+                         */
+                        if (cpumask_empty(&affinity_new) ||
+                            !cpumask_subset(&affinity_new, &online_new))
+                                this_count++;
+                }
+        }
+        count = 0;
+        for_each_online_cpu(cpu) {
+                if (cpu == this_cpu)
+                        continue;
+                for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS;
+                     vector++) {
+                        if (per_cpu(vector_irq, cpu)[vector] < 0)
+                                count++;
+                }
+        }
+        if (count < this_count) {
+                pr_warn("CPU %d disable failed: CPU has %u vectors assigned and there are only %u available.\n",
+                        this_cpu, this_count, count);
+                return -ERANGE;
+        }
+        return 0;
+}
 /* A cpu has been removed from cpu_online_mask.  Reset irq affinities. */
 void fixup_irqs(void)
 {
@@ -344,7 +418,7 @@ void fixup_irqs(void)
        for (vector = FIRST_EXTERNAL_VECTOR; vector < NR_VECTORS; vector++) {
                unsigned int irr;
-                if (__this_cpu_read(vector_irq[vector]) < 0)
+                if (__this_cpu_read(vector_irq[vector]) <= VECTOR_UNDEFINED)
                        continue;
                irr = apic_read(APIC_IRR + (vector / 32 * 0x10));
@@ -355,11 +429,14 @@ void fixup_irqs(void)
                        data = irq_desc_get_irq_data(desc);
                        chip = irq_data_get_irq_chip(data);
                        raw_spin_lock(&desc->lock);
-                        if (chip->irq_retrigger)
+                        if (chip->irq_retrigger) {
                                chip->irq_retrigger(data);
+                                __this_cpu_write(vector_irq[vector], VECTOR_RETRIGGERED);
+                        }
                        raw_spin_unlock(&desc->lock);
                }
-                __this_cpu_write(vector_irq[vector], -1);
+                if (__this_cpu_read(vector_irq[vector]) != VECTOR_RETRIGGERED)
+                        __this_cpu_write(vector_irq[vector], VECTOR_UNDEFINED);
        }
 }
 #endif
diff --git a/arch/x86/kernel/irqinit.c b/arch/x86/kernel/irqinit.c
index a2a1fbc594ff..7f50156542fb 100644
--- a/arch/x86/kernel/irqinit.c
+++ b/arch/x86/kernel/irqinit.c
@@ -52,7 +52,7 @@ static struct irqaction irq2 = {
 };
 DEFINE_PER_CPU(vector_irq_t, vector_irq) = {
-        [0 ... NR_VECTORS - 1] = -1,
+        [0 ... NR_VECTORS - 1] = VECTOR_UNDEFINED,
 };
 int vector_used_by_percpu_irq(unsigned int vector)
@@ -60,7 +60,7 @@ int vector_used_by_percpu_irq(unsigned int vector)
        int cpu;
        for_each_online_cpu(cpu) {
-                if (per_cpu(vector_irq, cpu)[vector] != -1)
+                if (per_cpu(vector_irq, cpu)[vector] > VECTOR_UNDEFINED)
                        return 1;
        }
diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index 836f8322960e..7ec1d5f8d283 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -39,7 +39,6 @@
 #include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/kgdb.h>
-#include <linux/init.h>
 #include <linux/smp.h>
 #include <linux/nmi.h>
 #include <linux/hw_breakpoint.h>
diff --git a/arch/x86/kernel/ksysfs.c b/arch/x86/kernel/ksysfs.c
new file mode 100644
index 000000000000..c2bedaea11f7
--- /dev/null
+++ b/arch/x86/kernel/ksysfs.c
@@ -0,0 +1,340 @@
+/*
+ * Architecture specific sysfs attributes in /sys/kernel
+ *
+ * Copyright (C) 2007, Intel Corp.
+ *      Huang Ying <ying.huang@intel.com>
+ * Copyright (C) 2013, 2013 Red Hat, Inc.
+ *      Dave Young <dyoung@redhat.com>
+ *
+ * This file is released under the GPLv2
+ */
+#include <linux/kobject.h>
+#include <linux/string.h>
+#include <linux/sysfs.h>
+#include <linux/init.h>
+#include <linux/stat.h>
+#include <linux/slab.h>
+#include <linux/mm.h>
+#include <asm/io.h>
+#include <asm/setup.h>
+static ssize_t version_show(struct kobject *kobj,
+                            struct kobj_attribute *attr, char *buf)
+{
+        return sprintf(buf, "0x%04x\n", boot_params.hdr.version);
+}
+static struct kobj_attribute boot_params_version_attr = __ATTR_RO(version);
+static ssize_t boot_params_data_read(struct file *fp, struct kobject *kobj,
+                                     struct bin_attribute *bin_attr,
+                                     char *buf, loff_t off, size_t count)
+{
+        memcpy(buf, (void *)&boot_params + off, count);
+        return count;
+}
+static struct bin_attribute boot_params_data_attr = {
+        .attr = {
+                .name = "data",
+                .mode = S_IRUGO,
+        },
+        .read = boot_params_data_read,
+        .size = sizeof(boot_params),
+};
+static struct attribute *boot_params_version_attrs[] = {
+        &boot_params_version_attr.attr,
+        NULL,
+};
+static struct bin_attribute *boot_params_data_attrs[] = {
+        &boot_params_data_attr,
+        NULL,
+};
+static struct attribute_group boot_params_attr_group = {
+        .attrs = boot_params_version_attrs,
+        .bin_attrs = boot_params_data_attrs,
+};
+static int kobj_to_setup_data_nr(struct kobject *kobj, int *nr)
+{
+        const char *name;
+        name = kobject_name(kobj);
+        return kstrtoint(name, 10, nr);
+}
+static int get_setup_data_paddr(int nr, u64 *paddr)
+{
+        int i = 0;
+        struct setup_data *data;
+        u64 pa_data = boot_params.hdr.setup_data;
+        while (pa_data) {
+                if (nr == i) {
+                        *paddr = pa_data;
+                        return 0;
+                }
+                data = ioremap_cache(pa_data, sizeof(*data));
+                if (!data)
+                        return -ENOMEM;
+                pa_data = data->next;
+                iounmap(data);
+                i++;
+        }
+        return -EINVAL;
+}
+static int __init get_setup_data_size(int nr, size_t *size)
+{
+        int i = 0;
+        struct setup_data *data;
+        u64 pa_data = boot_params.hdr.setup_data;
+        while (pa_data) {
+                data = ioremap_cache(pa_data, sizeof(*data));
+                if (!data)
+                        return -ENOMEM;
+                if (nr == i) {
+                        *size = data->len;
+                        iounmap(data);
+                        return 0;
+                }
+                pa_data = data->next;
+                iounmap(data);
+                i++;
+        }
+        return -EINVAL;
+}
+static ssize_t type_show(struct kobject *kobj,
+                         struct kobj_attribute *attr, char *buf)
+{
+        int nr, ret;
+        u64 paddr;
+        struct setup_data *data;
+        ret = kobj_to_setup_data_nr(kobj, &nr);
+        if (ret)
+                return ret;
+        ret = get_setup_data_paddr(nr, &paddr);
+        if (ret)
+                return ret;
+        data = ioremap_cache(paddr, sizeof(*data));
+        if (!data)
+                return -ENOMEM;
+        ret = sprintf(buf, "0x%x\n", data->type);
+        iounmap(data);
+        return ret;
+}
+static ssize_t setup_data_data_read(struct file *fp,
+                                    struct kobject *kobj,
+                                    struct bin_attribute *bin_attr,
+                                    char *buf,
+                                    loff_t off, size_t count)
+{
+        int nr, ret = 0;
+        u64 paddr;
+        struct setup_data *data;
+        void *p;
+        ret = kobj_to_setup_data_nr(kobj, &nr);
+        if (ret)
+                return ret;
+        ret = get_setup_data_paddr(nr, &paddr);
+        if (ret)
+                return ret;
+        data = ioremap_cache(paddr, sizeof(*data));
+        if (!data)
+                return -ENOMEM;
+        if (off > data->len) {
+                ret = -EINVAL;
+                goto out;
+        }
+        if (count > data->len - off)
+                count = data->len - off;
+        if (!count)
+                goto out;
+        ret = count;
+        p = ioremap_cache(paddr + sizeof(*data), data->len);
+        if (!p) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        memcpy(buf, p + off, count);
+        iounmap(p);
+out:
+        iounmap(data);
+        return ret;
+}
+static struct kobj_attribute type_attr = __ATTR_RO(type);
+static struct bin_attribute data_attr = {
+        .attr = {
+                .name = "data",
+                .mode = S_IRUGO,
+        },
+        .read = setup_data_data_read,
+};
+static struct attribute *setup_data_type_attrs[] = {
+        &type_attr.attr,
+        NULL,
+};
+static struct bin_attribute *setup_data_data_attrs[] = {
+        &data_attr,
+        NULL,
+};
+static struct attribute_group setup_data_attr_group = {
+        .attrs = setup_data_type_attrs,
+        .bin_attrs = setup_data_data_attrs,
+};
+static int __init create_setup_data_node(struct kobject *parent,
+                                         struct kobject **kobjp, int nr)
+{
+        int ret = 0;
+        size_t size;
+        struct kobject *kobj;
+        char name[16]; /* should be enough for setup_data nodes numbers */
+        snprintf(name, 16, "%d", nr);
+        kobj = kobject_create_and_add(name, parent);
+        if (!kobj)
+                return -ENOMEM;
+        ret = get_setup_data_size(nr, &size);
+        if (ret)
+                goto out_kobj;
+        data_attr.size = size;
+        ret = sysfs_create_group(kobj, &setup_data_attr_group);
+        if (ret)
+                goto out_kobj;
+        *kobjp = kobj;
+        return 0;
+out_kobj:
+        kobject_put(kobj);
+        return ret;
+}
+static void __init cleanup_setup_data_node(struct kobject *kobj)
+{
+        sysfs_remove_group(kobj, &setup_data_attr_group);
+        kobject_put(kobj);
+}
+static int __init get_setup_data_total_num(u64 pa_data, int *nr)
+{
+        int ret = 0;
+        struct setup_data *data;
+        *nr = 0;
+        while (pa_data) {
+                *nr += 1;
+                data = ioremap_cache(pa_data, sizeof(*data));
+                if (!data) {
+                        ret = -ENOMEM;
+                        goto out;
+                }
+                pa_data = data->next;
+                iounmap(data);
+        }
+out:
+        return ret;
+}
+static int __init create_setup_data_nodes(struct kobject *parent)
+{
+        struct kobject *setup_data_kobj, **kobjp;
+        u64 pa_data;
+        int i, j, nr, ret = 0;
+        pa_data = boot_params.hdr.setup_data;
+        if (!pa_data)
+                return 0;
+        setup_data_kobj = kobject_create_and_add("setup_data", parent);
+        if (!setup_data_kobj) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        ret = get_setup_data_total_num(pa_data, &nr);
+        if (ret)
+                goto out_setup_data_kobj;
+        kobjp = kmalloc(sizeof(*kobjp) * nr, GFP_KERNEL);
+        if (!kobjp) {
+                ret = -ENOMEM;
+                goto out_setup_data_kobj;
+        }
+        for (i = 0; i < nr; i++) {
+                ret = create_setup_data_node(setup_data_kobj, kobjp + i, i);
+                if (ret)
+                        goto out_clean_nodes;
+        }
+        kfree(kobjp);
+        return 0;
+out_clean_nodes:
+        for (j = i - 1; j > 0; j--)
+                cleanup_setup_data_node(*(kobjp + j));
+        kfree(kobjp);
+out_setup_data_kobj:
+        kobject_put(setup_data_kobj);
+out:
+        return ret;
+}
+static int __init boot_params_ksysfs_init(void)
+{
+        int ret;
+        struct kobject *boot_params_kobj;
+        boot_params_kobj = kobject_create_and_add("boot_params",
+                                                  kernel_kobj);
+        if (!boot_params_kobj) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        ret = sysfs_create_group(boot_params_kobj, &boot_params_attr_group);
+        if (ret)
+                goto out_boot_params_kobj;
+        ret = create_setup_data_nodes(boot_params_kobj);
+        if (ret)
+                goto out_create_group;
+        return 0;
+out_create_group:
+        sysfs_remove_group(boot_params_kobj, &boot_params_attr_group);
+out_boot_params_kobj:
+        kobject_put(boot_params_kobj);
+out:
+        return ret;
+}
+arch_initcall(boot_params_ksysfs_init);
diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c
index 5b19e4d78b00..1667b1de8d5d 100644
--- a/arch/x86/kernel/machine_kexec_32.c
+++ b/arch/x86/kernel/machine_kexec_32.c
@@ -9,7 +9,6 @@
 #include <linux/mm.h>
 #include <linux/kexec.h>
 #include <linux/delay.h>
-#include <linux/init.h>
 #include <linux/numa.h>
 #include <linux/ftrace.h>
 #include <linux/suspend.h>
diff --git a/arch/x86/kernel/pci-nommu.c b/arch/x86/kernel/pci-nommu.c
index 871be4a84c7d..da15918d1c81 100644
--- a/arch/x86/kernel/pci-nommu.c
+++ b/arch/x86/kernel/pci-nommu.c
@@ -3,7 +3,6 @@
 #include <linux/dma-mapping.h>
 #include <linux/scatterlist.h>
 #include <linux/string.h>
-#include <linux/init.h>
 #include <linux/gfp.h>
 #include <linux/pci.h>
 #include <linux/mm.h>
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 6f1236c29c4b..0de43e98ce08 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -24,7 +24,6 @@
 #include <linux/interrupt.h>
 #include <linux/delay.h>
 #include <linux/reboot.h>
-#include <linux/init.h>
 #include <linux/mc146818rtc.h>
 #include <linux/module.h>
 #include <linux/kallsyms.h>
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index cb233bc9dee3..06853e670354 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -295,6 +295,8 @@ static void __init reserve_brk(void)
        _brk_start = 0;
 }
+u64 relocated_ramdisk;
 #ifdef CONFIG_BLK_DEV_INITRD
 static u64 __init get_ramdisk_image(void)
@@ -321,25 +323,24 @@ static void __init relocate_initrd(void)
        u64 ramdisk_image = get_ramdisk_image();
        u64 ramdisk_size  = get_ramdisk_size();
        u64 area_size     = PAGE_ALIGN(ramdisk_size);
-        u64 ramdisk_here;
        unsigned long slop, clen, mapaddr;
        char *p, *q;
        /* We need to move the initrd down into directly mapped mem */
-        ramdisk_here = memblock_find_in_range(0, PFN_PHYS(max_pfn_mapped),
+        relocated_ramdisk = memblock_find_in_range(0, PFN_PHYS(max_pfn_mapped),
-                                                 area_size, PAGE_SIZE);
+                                                   area_size, PAGE_SIZE);
-        if (!ramdisk_here)
+        if (!relocated_ramdisk)
                panic("Cannot find place for new RAMDISK of size %lld\n",
-                         ramdisk_size);
+                      ramdisk_size);
        /* Note: this includes all the mem currently occupied by
           the initrd, we rely on that fact to keep the data intact. */
-        memblock_reserve(ramdisk_here, area_size);
+        memblock_reserve(relocated_ramdisk, area_size);
-        initrd_start = ramdisk_here + PAGE_OFFSET;
+        initrd_start = relocated_ramdisk + PAGE_OFFSET;
        initrd_end   = initrd_start + ramdisk_size;
        printk(KERN_INFO "Allocated new RAMDISK: [mem %#010llx-%#010llx]\n",
-                         ramdisk_here, ramdisk_here + ramdisk_size - 1);
+               relocated_ramdisk, relocated_ramdisk + ramdisk_size - 1);
        q = (char *)initrd_start;
@@ -363,7 +364,7 @@ static void __init relocate_initrd(void)
        printk(KERN_INFO "Move RAMDISK from [mem %#010llx-%#010llx] to"
                " [mem %#010llx-%#010llx]\n",
                ramdisk_image, ramdisk_image + ramdisk_size - 1,
-                ramdisk_here, ramdisk_here + ramdisk_size - 1);
+                relocated_ramdisk, relocated_ramdisk + ramdisk_size - 1);
 }
 static void __init early_reserve_initrd(void)
@@ -447,6 +448,9 @@ static void __init parse_setup_data(void)
                case SETUP_DTB:
                        add_dtb(pa_data);
                        break;
+                case SETUP_EFI:
+                        parse_efi_setup(pa_data, data_len);
+                        break;
                default:
                        break;
                }
@@ -824,6 +828,20 @@ static void __init trim_low_memory_range(void)
 }
        
 /*
+ * Dump out kernel offset information on panic.
+ */
+static int
+dump_kernel_offset(struct notifier_block *self, unsigned long v, void *p)
+{
+        pr_emerg("Kernel Offset: 0x%lx from 0x%lx "
+                 "(relocation range: 0x%lx-0x%lx)\n",
+                 (unsigned long)&_text - __START_KERNEL, __START_KERNEL,
+                 __START_KERNEL_map, MODULES_VADDR-1);
+        return 0;
+}
+/*
 * Determine if we were loaded by an EFI loader.  If so, then we have also been
 * passed the efi memmap, systab, etc., so we should use these data structures
 * for initialization.  Note, the efi init code path is determined by the
@@ -924,8 +942,6 @@ void __init setup_arch(char **cmdline_p)
        iomem_resource.end = (1ULL << boot_cpu_data.x86_phys_bits) - 1;
        setup_memory_map();
        parse_setup_data();
-        /* update the e820_saved too */
-        e820_reserve_setup_data();
        copy_edd();
@@ -987,6 +1003,8 @@ void __init setup_arch(char **cmdline_p)
                early_dump_pci_devices();
 #endif
+        /* update the e820_saved too */
+        e820_reserve_setup_data();
        finish_e820_parsing();
        if (efi_enabled(EFI_BOOT))
@@ -1248,3 +1266,15 @@ void __init i386_reserve_resources(void)
 }
 #endif /* CONFIG_X86_32 */
+static struct notifier_block kernel_offset_notifier = {
+        .notifier_call = dump_kernel_offset
+};
+static int __init register_kernel_offset_dumper(void)
+{
+        atomic_notifier_chain_register(&panic_notifier_list,
+                                        &kernel_offset_notifier);
+        return 0;
+}
+__initcall(register_kernel_offset_dumper);
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 85dc05a3aa02..a32da804252e 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -1312,6 +1312,12 @@ void cpu_disable_common(void)
 int native_cpu_disable(void)
 {
+        int ret;
+        ret = check_irq_vectors_for_cpu_disable();
+        if (ret)
+                return ret;
        clear_local_APIC();
        cpu_disable_common();
@@ -1417,7 +1423,9 @@ static inline void mwait_play_dead(void)
                 * The WBINVD is insufficient due to the spurious-wakeup
                 * case where we return around the loop.
                 */
+                mb();
                clflush(mwait_ptr);
+                mb();
                __monitor(mwait_ptr, 0, 0);
                mb();
                __mwait(eax, 0);
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index b857ed890b4c..57409f6b8c62 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -211,21 +211,17 @@ dotraplinkage void do_##name(struct pt_regs *regs, long error_code)	\
        exception_exit(prev_state);                                     \
 }
-DO_ERROR_INFO(X86_TRAP_DE, SIGFPE, "divide error", divide_error, FPE_INTDIV,
+DO_ERROR_INFO(X86_TRAP_DE,     SIGFPE,  "divide error",                 divide_error,                FPE_INTDIV, regs->ip )
-                regs->ip)
+DO_ERROR     (X86_TRAP_OF,     SIGSEGV, "overflow",                     overflow                                          )
-DO_ERROR(X86_TRAP_OF, SIGSEGV, "overflow", overflow)
+DO_ERROR     (X86_TRAP_BR,     SIGSEGV, "bounds",                       bounds                                            )
-DO_ERROR(X86_TRAP_BR, SIGSEGV, "bounds", bounds)
+DO_ERROR_INFO(X86_TRAP_UD,     SIGILL,  "invalid opcode",               invalid_op,                  ILL_ILLOPN, regs->ip )
-DO_ERROR_INFO(X86_TRAP_UD, SIGILL, "invalid opcode", invalid_op, ILL_ILLOPN,
+DO_ERROR     (X86_TRAP_OLD_MF, SIGFPE,  "coprocessor segment overrun",  coprocessor_segment_overrun                       )
-                regs->ip)
+DO_ERROR     (X86_TRAP_TS,     SIGSEGV, "invalid TSS",                  invalid_TSS                                       )
-DO_ERROR(X86_TRAP_OLD_MF, SIGFPE, "coprocessor segment overrun",
+DO_ERROR     (X86_TRAP_NP,     SIGBUS,  "segment not present",          segment_not_present                               )
-                coprocessor_segment_overrun)
-DO_ERROR(X86_TRAP_TS, SIGSEGV, "invalid TSS", invalid_TSS)
-DO_ERROR(X86_TRAP_NP, SIGBUS, "segment not present", segment_not_present)
 #ifdef CONFIG_X86_32
-DO_ERROR(X86_TRAP_SS, SIGBUS, "stack segment", stack_segment)
+DO_ERROR     (X86_TRAP_SS,     SIGBUS,  "stack segment",                stack_segment                                     )
 #endif
-DO_ERROR_INFO(X86_TRAP_AC, SIGBUS, "alignment check", alignment_check,
+DO_ERROR_INFO(X86_TRAP_AC,     SIGBUS,  "alignment check",              alignment_check,             BUS_ADRALN, 0        )
-                BUS_ADRALN, 0)
 #ifdef CONFIG_X86_64
 /* Runs on IST stack */
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 930e5d48f560..a3acbac2ee72 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -11,6 +11,7 @@
 #include <linux/clocksource.h>
 #include <linux/percpu.h>
 #include <linux/timex.h>
+#include <linux/static_key.h>
 #include <asm/hpet.h>
 #include <asm/timer.h>
@@ -37,13 +38,244 @@ static int __read_mostly tsc_unstable;
   erroneous rdtsc usage on !cpu_has_tsc processors */
 static int __read_mostly tsc_disabled = -1;
+static struct static_key __use_tsc = STATIC_KEY_INIT;
 int tsc_clocksource_reliable;
+/*
+ * Use a ring-buffer like data structure, where a writer advances the head by
+ * writing a new data entry and a reader advances the tail when it observes a
+ * new entry.
+ *
+ * Writers are made to wait on readers until there's space to write a new
+ * entry.
+ *
+ * This means that we can always use an {offset, mul} pair to compute a ns
+ * value that is 'roughly' in the right direction, even if we're writing a new
+ * {offset, mul} pair during the clock read.
+ *
+ * The down-side is that we can no longer guarantee strict monotonicity anymore
+ * (assuming the TSC was that to begin with), because while we compute the
+ * intersection point of the two clock slopes and make sure the time is
+ * continuous at the point of switching; we can no longer guarantee a reader is
+ * strictly before or after the switch point.
+ *
+ * It does mean a reader no longer needs to disable IRQs in order to avoid
+ * CPU-Freq updates messing with his times, and similarly an NMI reader will
+ * no longer run the risk of hitting half-written state.
+ */
+struct cyc2ns {
+        struct cyc2ns_data data[2];     /*  0 + 2*24 = 48 */
+        struct cyc2ns_data *head;       /* 48 + 8    = 56 */
+        struct cyc2ns_data *tail;       /* 56 + 8    = 64 */
+}; /* exactly fits one cacheline */
+static DEFINE_PER_CPU_ALIGNED(struct cyc2ns, cyc2ns);
+struct cyc2ns_data *cyc2ns_read_begin(void)
+{
+        struct cyc2ns_data *head;
+        preempt_disable();
+        head = this_cpu_read(cyc2ns.head);
+        /*
+         * Ensure we observe the entry when we observe the pointer to it.
+         * matches the wmb from cyc2ns_write_end().
+         */
+        smp_read_barrier_depends();
+        head->__count++;
+        barrier();
+        return head;
+}
+void cyc2ns_read_end(struct cyc2ns_data *head)
+{
+        barrier();
+        /*
+         * If we're the outer most nested read; update the tail pointer
+         * when we're done. This notifies possible pending writers
+         * that we've observed the head pointer and that the other
+         * entry is now free.
+         */
+        if (!--head->__count) {
+                /*
+                 * x86-TSO does not reorder writes with older reads;
+                 * therefore once this write becomes visible to another
+                 * cpu, we must be finished reading the cyc2ns_data.
+                 *
+                 * matches with cyc2ns_write_begin().
+                 */
+                this_cpu_write(cyc2ns.tail, head);
+        }
+        preempt_enable();
+}
+/*
+ * Begin writing a new @data entry for @cpu.
+ *
+ * Assumes some sort of write side lock; currently 'provided' by the assumption
+ * that cpufreq will call its notifiers sequentially.
+ */
+static struct cyc2ns_data *cyc2ns_write_begin(int cpu)
+{
+        struct cyc2ns *c2n = &per_cpu(cyc2ns, cpu);
+        struct cyc2ns_data *data = c2n->data;
+        if (data == c2n->head)
+                data++;
+        /* XXX send an IPI to @cpu in order to guarantee a read? */
+        /*
+         * When we observe the tail write from cyc2ns_read_end(),
+         * the cpu must be done with that entry and its safe
+         * to start writing to it.
+         */
+        while (c2n->tail == data)
+                cpu_relax();
+        return data;
+}
+static void cyc2ns_write_end(int cpu, struct cyc2ns_data *data)
+{
+        struct cyc2ns *c2n = &per_cpu(cyc2ns, cpu);
+        /*
+         * Ensure the @data writes are visible before we publish the
+         * entry. Matches the data-depencency in cyc2ns_read_begin().
+         */
+        smp_wmb();
+        ACCESS_ONCE(c2n->head) = data;
+}
+/*
+ * Accelerators for sched_clock()
+ * convert from cycles(64bits) => nanoseconds (64bits)
+ *  basic equation:
+ *              ns = cycles / (freq / ns_per_sec)
+ *              ns = cycles * (ns_per_sec / freq)
+ *              ns = cycles * (10^9 / (cpu_khz * 10^3))
+ *              ns = cycles * (10^6 / cpu_khz)
+ *
+ *      Then we use scaling math (suggested by george@mvista.com) to get:
+ *              ns = cycles * (10^6 * SC / cpu_khz) / SC
+ *              ns = cycles * cyc2ns_scale / SC
+ *
+ *      And since SC is a constant power of two, we can convert the div
+ *  into a shift.
+ *
+ *  We can use khz divisor instead of mhz to keep a better precision, since
+ *  cyc2ns_scale is limited to 10^6 * 2^10, which fits in 32 bits.
+ *  (mathieu.desnoyers@polymtl.ca)
+ *
+ *                      -johnstul@us.ibm.com "math is hard, lets go shopping!"
+ */
+#define CYC2NS_SCALE_FACTOR 10 /* 2^10, carefully chosen */
+static void cyc2ns_data_init(struct cyc2ns_data *data)
+{
+        data->cyc2ns_mul = 1U << CYC2NS_SCALE_FACTOR;
+        data->cyc2ns_shift = CYC2NS_SCALE_FACTOR;
+        data->cyc2ns_offset = 0;
+        data->__count = 0;
+}
+static void cyc2ns_init(int cpu)
+{
+        struct cyc2ns *c2n = &per_cpu(cyc2ns, cpu);
+        cyc2ns_data_init(&c2n->data[0]);
+        cyc2ns_data_init(&c2n->data[1]);
+        c2n->head = c2n->data;
+        c2n->tail = c2n->data;
+}
+static inline unsigned long long cycles_2_ns(unsigned long long cyc)
+{
+        struct cyc2ns_data *data, *tail;
+        unsigned long long ns;
+        /*
+         * See cyc2ns_read_*() for details; replicated in order to avoid
+         * an extra few instructions that came with the abstraction.
+         * Notable, it allows us to only do the __count and tail update
+         * dance when its actually needed.
+         */
+        preempt_disable();
+        data = this_cpu_read(cyc2ns.head);
+        tail = this_cpu_read(cyc2ns.tail);
+        if (likely(data == tail)) {
+                ns = data->cyc2ns_offset;
+                ns += mul_u64_u32_shr(cyc, data->cyc2ns_mul, CYC2NS_SCALE_FACTOR);
+        } else {
+                data->__count++;
+                barrier();
+                ns = data->cyc2ns_offset;
+                ns += mul_u64_u32_shr(cyc, data->cyc2ns_mul, CYC2NS_SCALE_FACTOR);
+                barrier();
+                if (!--data->__count)
+                        this_cpu_write(cyc2ns.tail, data);
+        }
+        preempt_enable();
+        return ns;
+}
+/* XXX surely we already have this someplace in the kernel?! */
+#define DIV_ROUND(n, d) (((n) + ((d) / 2)) / (d))
+static void set_cyc2ns_scale(unsigned long cpu_khz, int cpu)
+{
+        unsigned long long tsc_now, ns_now;
+        struct cyc2ns_data *data;
+        unsigned long flags;
+        local_irq_save(flags);
+        sched_clock_idle_sleep_event();
+        if (!cpu_khz)
+                goto done;
+        data = cyc2ns_write_begin(cpu);
+        rdtscll(tsc_now);
+        ns_now = cycles_2_ns(tsc_now);
+        /*
+         * Compute a new multiplier as per the above comment and ensure our
+         * time function is continuous; see the comment near struct
+         * cyc2ns_data.
+         */
+        data->cyc2ns_mul = DIV_ROUND(NSEC_PER_MSEC << CYC2NS_SCALE_FACTOR, cpu_khz);
+        data->cyc2ns_shift = CYC2NS_SCALE_FACTOR;
+        data->cyc2ns_offset = ns_now -
+                mul_u64_u32_shr(tsc_now, data->cyc2ns_mul, CYC2NS_SCALE_FACTOR);
+        cyc2ns_write_end(cpu, data);
+done:
+        sched_clock_idle_wakeup_event(0);
+        local_irq_restore(flags);
+}
 /*
 * Scheduler clock - returns current time in nanosec units.
 */
 u64 native_sched_clock(void)
 {
-        u64 this_offset;
+        u64 tsc_now;
        /*
         * Fall back to jiffies if there's no TSC available:
@@ -53,16 +285,16 @@ u64 native_sched_clock(void)
         *   very important for it to be as fast as the platform
         *   can achieve it. )
         */
-        if (unlikely(tsc_disabled)) {
+        if (!static_key_false(&__use_tsc)) {
                /* No locking but a rare wrong value is not a big deal: */
                return (jiffies_64 - INITIAL_JIFFIES) * (1000000000 / HZ);
        }
        /* read the Time Stamp Counter: */
-        rdtscll(this_offset);
+        rdtscll(tsc_now);
        /* return the value in ns */
-        return __cycles_2_ns(this_offset);
+        return cycles_2_ns(tsc_now);
 }
 /* We need to define a real function for sched_clock, to override the
@@ -419,6 +651,16 @@ unsigned long native_calibrate_tsc(void)
        unsigned long flags, latch, ms, fast_calibrate;
        int hpet = is_hpet_enabled(), i, loopmin;
+        /* Calibrate TSC using MSR for Intel Atom SoCs */
+        local_irq_save(flags);
+        i = try_msr_calibrate_tsc(&fast_calibrate);
+        local_irq_restore(flags);
+        if (i >= 0) {
+                if (i == 0)
+                        pr_warn("Fast TSC calibration using MSR failed\n");
+                return fast_calibrate;
+        }
        local_irq_save(flags);
        fast_calibrate = quick_pit_calibrate();
        local_irq_restore(flags);
@@ -589,61 +831,11 @@ int recalibrate_cpu_khz(void)
 EXPORT_SYMBOL(recalibrate_cpu_khz);
-/* Accelerators for sched_clock()
- * convert from cycles(64bits) => nanoseconds (64bits)
- *  basic equation:
- *              ns = cycles / (freq / ns_per_sec)
- *              ns = cycles * (ns_per_sec / freq)
- *              ns = cycles * (10^9 / (cpu_khz * 10^3))
- *              ns = cycles * (10^6 / cpu_khz)
- *
- *      Then we use scaling math (suggested by george@mvista.com) to get:
- *              ns = cycles * (10^6 * SC / cpu_khz) / SC
- *              ns = cycles * cyc2ns_scale / SC
- *
- *      And since SC is a constant power of two, we can convert the div
- *  into a shift.
- *
- *  We can use khz divisor instead of mhz to keep a better precision, since
- *  cyc2ns_scale is limited to 10^6 * 2^10, which fits in 32 bits.
- *  (mathieu.desnoyers@polymtl.ca)
- *
- *                      -johnstul@us.ibm.com "math is hard, lets go shopping!"
- */
-DEFINE_PER_CPU(unsigned long, cyc2ns);
-DEFINE_PER_CPU(unsigned long long, cyc2ns_offset);
-static void set_cyc2ns_scale(unsigned long cpu_khz, int cpu)
-{
-        unsigned long long tsc_now, ns_now, *offset;
-        unsigned long flags, *scale;
-        local_irq_save(flags);
-        sched_clock_idle_sleep_event();
-        scale = &per_cpu(cyc2ns, cpu);
-        offset = &per_cpu(cyc2ns_offset, cpu);
-        rdtscll(tsc_now);
-        ns_now = __cycles_2_ns(tsc_now);
-        if (cpu_khz) {
-                *scale = ((NSEC_PER_MSEC << CYC2NS_SCALE_FACTOR) +
-                                cpu_khz / 2) / cpu_khz;
-                *offset = ns_now - mult_frac(tsc_now, *scale,
-                                             (1UL << CYC2NS_SCALE_FACTOR));
-        }
-        sched_clock_idle_wakeup_event(0);
-        local_irq_restore(flags);
-}
 static unsigned long long cyc2ns_suspend;
 void tsc_save_sched_clock_state(void)
 {
-        if (!sched_clock_stable)
+        if (!sched_clock_stable())
                return;
        cyc2ns_suspend = sched_clock();
@@ -663,16 +855,26 @@ void tsc_restore_sched_clock_state(void)
        unsigned long flags;
        int cpu;
-        if (!sched_clock_stable)
+        if (!sched_clock_stable())
                return;
        local_irq_save(flags);
-        __this_cpu_write(cyc2ns_offset, 0);
+        /*
+         * We're comming out of suspend, there's no concurrency yet; don't
+         * bother being nice about the RCU stuff, just write to both
+         * data fields.
+         */
+        this_cpu_write(cyc2ns.data[0].cyc2ns_offset, 0);
+        this_cpu_write(cyc2ns.data[1].cyc2ns_offset, 0);
        offset = cyc2ns_suspend - sched_clock();
-        for_each_possible_cpu(cpu)
+        for_each_possible_cpu(cpu) {
-                per_cpu(cyc2ns_offset, cpu) = offset;
+                per_cpu(cyc2ns.data[0].cyc2ns_offset, cpu) = offset;
+                per_cpu(cyc2ns.data[1].cyc2ns_offset, cpu) = offset;
+        }
        local_irq_restore(flags);
 }
@@ -795,7 +997,7 @@ void mark_tsc_unstable(char *reason)
 {
        if (!tsc_unstable) {
                tsc_unstable = 1;
-                sched_clock_stable = 0;
+                clear_sched_clock_stable();
                disable_sched_clock_irqtime();
                pr_info("Marking TSC unstable due to %s\n", reason);
                /* Change only the rating, when not registered */
@@ -995,14 +1197,18 @@ void __init tsc_init(void)
         * speed as the bootup CPU. (cpufreq notifiers will fix this
         * up if their speed diverges)
         */
-        for_each_possible_cpu(cpu)
+        for_each_possible_cpu(cpu) {
+                cyc2ns_init(cpu);
                set_cyc2ns_scale(cpu_khz, cpu);
+        }
        if (tsc_disabled > 0)
                return;
        /* now allow native_sched_clock() to use rdtsc */
        tsc_disabled = 0;
+        static_key_slow_inc(&__use_tsc);
        if (!no_sched_irq_time)
                enable_sched_clock_irqtime();
diff --git a/arch/x86/kernel/tsc_msr.c b/arch/x86/kernel/tsc_msr.c
new file mode 100644
index 000000000000..8b5434f4389f
--- /dev/null
+++ b/arch/x86/kernel/tsc_msr.c
@@ -0,0 +1,127 @@
+/*
+ * tsc_msr.c - MSR based TSC calibration on Intel Atom SoC platforms.
+ *
+ * TSC in Intel Atom SoC runs at a constant rate which can be figured
+ * by this formula:
+ * <maximum core-clock to bus-clock ratio> * <maximum resolved frequency>
+ * See Intel 64 and IA-32 System Programming Guid section 16.12 and 30.11.5
+ * for details.
+ * Especially some Intel Atom SoCs don't have PIT(i8254) or HPET, so MSR
+ * based calibration is the only option.
+ *
+ *
+ * Copyright (C) 2013 Intel Corporation
+ * Author: Bin Gao <bin.gao@intel.com>
+ *
+ * This file is released under the GPLv2.
+ */
+#include <linux/kernel.h>
+#include <asm/processor.h>
+#include <asm/setup.h>
+#include <asm/apic.h>
+#include <asm/param.h>
+/* CPU reference clock frequency: in KHz */
+#define FREQ_83         83200
+#define FREQ_100        99840
+#define FREQ_133        133200
+#define FREQ_166        166400
+#define MAX_NUM_FREQS   8
+/*
+ * According to Intel 64 and IA-32 System Programming Guide,
+ * if MSR_PERF_STAT[31] is set, the maximum resolved bus ratio can be
+ * read in MSR_PLATFORM_ID[12:8], otherwise in MSR_PERF_STAT[44:40].
+ * Unfortunately some Intel Atom SoCs aren't quite compliant to this,
+ * so we need manually differentiate SoC families. This is what the
+ * field msr_plat does.
+ */
+struct freq_desc {
+        u8 x86_family;  /* CPU family */
+        u8 x86_model;   /* model */
+        u8 msr_plat;    /* 1: use MSR_PLATFORM_INFO, 0: MSR_IA32_PERF_STATUS */
+        u32 freqs[MAX_NUM_FREQS];
+};
+static struct freq_desc freq_desc_tables[] = {
+        /* PNW */
+        { 6, 0x27, 0, { 0, 0, 0, 0, 0, FREQ_100, 0, FREQ_83 } },
+        /* CLV+ */
+        { 6, 0x35, 0, { 0, FREQ_133, 0, 0, 0, FREQ_100, 0, FREQ_83 } },
+        /* TNG */
+        { 6, 0x4a, 1, { 0, FREQ_100, FREQ_133, 0, 0, 0, 0, 0 } },
+        /* VLV2 */
+        { 6, 0x37, 1, { 0, FREQ_100, FREQ_133, FREQ_166, 0, 0, 0, 0 } },
+        /* ANN */
+        { 6, 0x5a, 1, { FREQ_83, FREQ_100, FREQ_133, FREQ_100, 0, 0, 0, 0 } },
+};
+static int match_cpu(u8 family, u8 model)
+{
+        int i;
+        for (i = 0; i < ARRAY_SIZE(freq_desc_tables); i++) {
+                if ((family == freq_desc_tables[i].x86_family) &&
+                        (model == freq_desc_tables[i].x86_model))
+                        return i;
+        }
+        return -1;
+}
+/* Map CPU reference clock freq ID(0-7) to CPU reference clock freq(KHz) */
+#define id_to_freq(cpu_index, freq_id) \
+        (freq_desc_tables[cpu_index].freqs[freq_id])
+/*
+ * Do MSR calibration only for known/supported CPUs.
+ * Return values:
+ * -1: CPU is unknown/unsupported for MSR based calibration
+ *  0: CPU is known/supported, but calibration failed
+ *  1: CPU is known/supported, and calibration succeeded
+ */
+int try_msr_calibrate_tsc(unsigned long *fast_calibrate)
+{
+        int cpu_index;
+        u32 lo, hi, ratio, freq_id, freq;
+        cpu_index = match_cpu(boot_cpu_data.x86, boot_cpu_data.x86_model);
+        if (cpu_index < 0)
+                return -1;
+        *fast_calibrate = 0;
+        if (freq_desc_tables[cpu_index].msr_plat) {
+                rdmsr(MSR_PLATFORM_INFO, lo, hi);
+                ratio = (lo >> 8) & 0x1f;
+        } else {
+                rdmsr(MSR_IA32_PERF_STATUS, lo, hi);
+                ratio = (hi >> 8) & 0x1f;
+        }
+        pr_info("Maximum core-clock to bus-clock ratio: 0x%x\n", ratio);
+        if (!ratio)
+                return 0;
+        /* Get FSB FREQ ID */
+        rdmsr(MSR_FSB_FREQ, lo, hi);
+        freq_id = lo & 0x7;
+        freq = id_to_freq(cpu_index, freq_id);
+        pr_info("Resolved frequency ID: %u, frequency: %u KHz\n",
+                                freq_id, freq);
+        if (!freq)
+                return 0;
+        /* TSC frequency = maximum resolved freq * maximum resolved bus ratio */
+        *fast_calibrate = freq * ratio;
+        pr_info("TSC runs at %lu KHz\n", *fast_calibrate);
+#ifdef CONFIG_X86_LOCAL_APIC
+        lapic_timer_frequency = (freq * 1000) / HZ;
+        pr_info("lapic_timer_frequency = %d\n", lapic_timer_frequency);
+#endif
+        return 1;
+}
diff --git a/arch/x86/kernel/tsc_sync.c b/arch/x86/kernel/tsc_sync.c
index adfdf56a3714..26488487bc61 100644
--- a/arch/x86/kernel/tsc_sync.c
+++ b/arch/x86/kernel/tsc_sync.c
@@ -16,7 +16,6 @@
 */
 #include <linux/spinlock.h>
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/smp.h>
 #include <linux/nmi.h>
 #include <asm/tsc.h>
diff --git a/arch/x86/kernel/xsave.c b/arch/x86/kernel/xsave.c
index 422fd8223470..a4b451c6addf 100644
--- a/arch/x86/kernel/xsave.c
+++ b/arch/x86/kernel/xsave.c
@@ -562,6 +562,16 @@ static void __init xstate_enable_boot_cpu(void)
        if (cpu_has_xsaveopt && eagerfpu != DISABLE)
                eagerfpu = ENABLE;
+        if (pcntxt_mask & XSTATE_EAGER) {
+                if (eagerfpu == DISABLE) {
+                        pr_err("eagerfpu not present, disabling some xstate features: 0x%llx\n",
+                                        pcntxt_mask & XSTATE_EAGER);
+                        pcntxt_mask &= ~XSTATE_EAGER;
+                } else {
+                        eagerfpu = ENABLE;
+                }
+        }
        pr_info("enabled xstate_bv 0x%llx, cntxt size 0x%x\n",
                pcntxt_mask, xstate_size);
 }
diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
index dec48bfaddb8..775702f649ca 100644
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -1350,8 +1350,12 @@ void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value)
                return;
        }
+        if (!kvm_vcpu_is_bsp(apic->vcpu))
+                value &= ~MSR_IA32_APICBASE_BSP;
+        vcpu->arch.apic_base = value;
        /* update jump label if enable bit changes */
-        if ((vcpu->arch.apic_base ^ value) & MSR_IA32_APICBASE_ENABLE) {
+        if ((old_value ^ value) & MSR_IA32_APICBASE_ENABLE) {
                if (value & MSR_IA32_APICBASE_ENABLE)
                        static_key_slow_dec_deferred(&apic_hw_disabled);
                else
@@ -1359,10 +1363,6 @@ void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value)
                recalculate_apic_map(vcpu->kvm);
        }
-        if (!kvm_vcpu_is_bsp(apic->vcpu))
-                value &= ~MSR_IA32_APICBASE_BSP;
-        vcpu->arch.apic_base = value;
        if ((old_value ^ value) & X2APIC_ENABLE) {
                if (value & X2APIC_ENABLE) {
                        u32 id = kvm_apic_id(apic);
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index b2fe1c252f35..da7837e1349d 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -8283,8 +8283,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
        vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
        kvm_set_cr4(vcpu, vmcs12->host_cr4);
-        if (nested_cpu_has_ept(vmcs12))
+        nested_ept_uninit_mmu_context(vcpu);
-                nested_ept_uninit_mmu_context(vcpu);
        kvm_set_cr3(vcpu, vmcs12->host_cr3);
        kvm_mmu_reset_context(vcpu);
diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S
index a30ca15be21c..dee945d55594 100644
--- a/arch/x86/lib/copy_user_64.S
+++ b/arch/x86/lib/copy_user_64.S
@@ -186,7 +186,7 @@ ENTRY(copy_user_generic_unrolled)
 30:     shll $6,%ecx
        addl %ecx,%edx
        jmp 60f
-40:     lea (%rdx,%rcx,8),%rdx
+40:     leal (%rdx,%rcx,8),%edx
        jmp 60f
 50:     movl %ecx,%edx
 60:     jmp copy_user_handle_tail /* ecx is zerorest also */
@@ -236,8 +236,6 @@ ENDPROC(copy_user_generic_unrolled)
 ENTRY(copy_user_generic_string)
        CFI_STARTPROC
        ASM_STAC
-        andl %edx,%edx
-        jz 4f
        cmpl $8,%edx
        jb 2f           /* less than 8 bytes, go to byte copy loop */
        ALIGN_DESTINATION
@@ -249,12 +247,12 @@ ENTRY(copy_user_generic_string)
 2:      movl %edx,%ecx
 3:      rep
        movsb
-4:      xorl %eax,%eax
+        xorl %eax,%eax
        ASM_CLAC
        ret
        .section .fixup,"ax"
-11:     lea (%rdx,%rcx,8),%rcx
+11:     leal (%rdx,%rcx,8),%ecx
 12:     movl %ecx,%edx          /* ecx is zerorest also */
        jmp copy_user_handle_tail
        .previous
@@ -279,12 +277,10 @@ ENDPROC(copy_user_generic_string)
 ENTRY(copy_user_enhanced_fast_string)
        CFI_STARTPROC
        ASM_STAC
-        andl %edx,%edx
-        jz 2f
        movl %edx,%ecx
 1:      rep
        movsb
-2:      xorl %eax,%eax
+        xorl %eax,%eax
        ASM_CLAC
        ret
diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c
index 7c3bee636e2f..39d6a3db0b96 100644
--- a/arch/x86/lib/delay.c
+++ b/arch/x86/lib/delay.c
@@ -16,7 +16,6 @@
 #include <linux/timex.h>
 #include <linux/preempt.h>
 #include <linux/delay.h>
-#include <linux/init.h>
 #include <asm/processor.h>
 #include <asm/delay.h>
diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
index 533a85e3a07e..1a2be7c6895d 100644
--- a/arch/x86/lib/x86-opcode-map.txt
+++ b/arch/x86/lib/x86-opcode-map.txt
@@ -346,8 +346,8 @@ AVXcode: 1
 17: vmovhps Mq,Vq (v1) | vmovhpd Mq,Vq (66),(v1)
 18: Grp16 (1A)
 19:
-1a:
+1a: BNDCL Ev,Gv | BNDCU Ev,Gv | BNDMOV Gv,Ev | BNDLDX Gv,Ev,Gv
-1b:
+1b: BNDCN Ev,Gv | BNDMOV Ev,Gv | BNDMK Gv,Ev | BNDSTX Ev,GV,Gv
 1c:
 1d:
 1e:
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 9ff85bb8dd69..9d591c895803 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -641,6 +641,20 @@ no_context(struct pt_regs *regs, unsigned long error_code,
        /* Are we prepared to handle this kernel fault? */
        if (fixup_exception(regs)) {
+                /*
+                 * Any interrupt that takes a fault gets the fixup. This makes
+                 * the below recursive fault logic only apply to a faults from
+                 * task context.
+                 */
+                if (in_interrupt())
+                        return;
+                /*
+                 * Per the above we're !in_interrupt(), aka. task context.
+                 *
+                 * In this case we need to make sure we're not recursively
+                 * faulting through the emulate_vsyscall() logic.
+                 */
                if (current_thread_info()->sig_on_uaccess_error && signal) {
                        tsk->thread.trap_nr = X86_TRAP_PF;
                        tsk->thread.error_code = error_code | PF_USER;
@@ -649,6 +663,10 @@ no_context(struct pt_regs *regs, unsigned long error_code,
                        /* XXX: hwpoison faults will set the wrong code. */
                        force_sig_info_fault(signal, si_code, address, tsk, 0);
                }
+                /*
+                 * Barring that, we can do the fixup and be happy.
+                 */
                return;
        }
diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c
index 9d980d88b747..8c9f647ff9e1 100644
--- a/arch/x86/mm/hugetlbpage.c
+++ b/arch/x86/mm/hugetlbpage.c
@@ -87,9 +87,7 @@ int pmd_huge_support(void)
 }
 #endif
-/* x86_64 also uses this file */
+#ifdef CONFIG_HUGETLB_PAGE
-#ifdef HAVE_ARCH_HUGETLB_UNMAPPED_AREA
 static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
                unsigned long addr, unsigned long len,
                unsigned long pgoff, unsigned long flags)
@@ -99,7 +97,7 @@ static unsigned long hugetlb_get_unmapped_area_bottomup(struct file *file,
        info.flags = 0;
        info.length = len;
-        info.low_limit = TASK_UNMAPPED_BASE;
+        info.low_limit = current->mm->mmap_legacy_base;
        info.high_limit = TASK_SIZE;
        info.align_mask = PAGE_MASK & ~huge_page_mask(h);
        info.align_offset = 0;
@@ -172,8 +170,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr,
                return hugetlb_get_unmapped_area_topdown(file, addr, len,
                                pgoff, flags);
 }
+#endif /* CONFIG_HUGETLB_PAGE */
-#endif /*HAVE_ARCH_HUGETLB_UNMAPPED_AREA*/
 #ifdef CONFIG_X86_64
 static __init int setup_hugepagesz(char *opt)
diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
index 4287f1ffba7e..5bdc5430597c 100644
--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -806,6 +806,9 @@ void __init mem_init(void)
        BUILD_BUG_ON(VMALLOC_START                      >= VMALLOC_END);
 #undef high_memory
 #undef __FIXADDR_TOP
+#ifdef CONFIG_RANDOMIZE_BASE
+        BUILD_BUG_ON(CONFIG_RANDOMIZE_BASE_MAX_OFFSET > KERNEL_IMAGE_SIZE);
+#endif
 #ifdef CONFIG_HIGHMEM
        BUG_ON(PKMAP_BASE + LAST_PKMAP*PAGE_SIZE        > FIXADDR_START);
diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c
index e5d5e2ce9f77..637ab34ed632 100644
--- a/arch/x86/mm/kmmio.c
+++ b/arch/x86/mm/kmmio.c
@@ -11,7 +11,6 @@
 #include <linux/rculist.h>
 #include <linux/spinlock.h>
 #include <linux/hash.h>
-#include <linux/init.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/uaccess.h>
diff --git a/arch/x86/mm/numa.c b/arch/x86/mm/numa.c
index 24aec58d6afd..c85da7bb6b60 100644
--- a/arch/x86/mm/numa.c
+++ b/arch/x86/mm/numa.c
@@ -211,9 +211,13 @@ static void __init setup_node_data(int nid, u64 start, u64 end)
         */
        nd_pa = memblock_alloc_nid(nd_size, SMP_CACHE_BYTES, nid);
        if (!nd_pa) {
-                pr_err("Cannot find %zu bytes in node %d\n",
+                nd_pa = __memblock_alloc_base(nd_size, SMP_CACHE_BYTES,
-                       nd_size, nid);
+                                              MEMBLOCK_ALLOC_ACCESSIBLE);
-                return;
+                if (!nd_pa) {
+                        pr_err("Cannot find %zu bytes in node %d\n",
+                               nd_size, nid);
+                        return;
+                }
        }
        nd = __va(nd_pa);
diff --git a/arch/x86/mm/pageattr-test.c b/arch/x86/mm/pageattr-test.c
index d0b1773d9d2e..461bc8289024 100644
--- a/arch/x86/mm/pageattr-test.c
+++ b/arch/x86/mm/pageattr-test.c
@@ -8,7 +8,6 @@
 #include <linux/kthread.h>
 #include <linux/random.h>
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/mm.h>
 #include <asm/cacheflush.h>
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index bb32480c2d71..b3b19f46c016 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -30,6 +30,7 @@
 */
 struct cpa_data {
        unsigned long   *vaddr;
+        pgd_t           *pgd;
        pgprot_t        mask_set;
        pgprot_t        mask_clr;
        int             numpages;
@@ -322,17 +323,9 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address,
        return prot;
 }
-/*
+static pte_t *__lookup_address_in_pgd(pgd_t *pgd, unsigned long address,
- * Lookup the page table entry for a virtual address. Return a pointer
+                                      unsigned int *level)
- * to the entry and the level of the mapping.
- *
- * Note: We return pud and pmd either when the entry is marked large
- * or when the present bit is not set. Otherwise we would return a
- * pointer to a nonexisting mapping.
- */
-pte_t *lookup_address(unsigned long address, unsigned int *level)
 {
-        pgd_t *pgd = pgd_offset_k(address);
        pud_t *pud;
        pmd_t *pmd;
@@ -361,8 +354,31 @@ pte_t *lookup_address(unsigned long address, unsigned int *level)
        return pte_offset_kernel(pmd, address);
 }
+/*
+ * Lookup the page table entry for a virtual address. Return a pointer
+ * to the entry and the level of the mapping.
+ *
+ * Note: We return pud and pmd either when the entry is marked large
+ * or when the present bit is not set. Otherwise we would return a
+ * pointer to a nonexisting mapping.
+ */
+pte_t *lookup_address(unsigned long address, unsigned int *level)
+{
+        return __lookup_address_in_pgd(pgd_offset_k(address), address, level);
+}
 EXPORT_SYMBOL_GPL(lookup_address);
+static pte_t *_lookup_address_cpa(struct cpa_data *cpa, unsigned long address,
+                                  unsigned int *level)
+{
+        if (cpa->pgd)
+                return __lookup_address_in_pgd(cpa->pgd + pgd_index(address),
+                                               address, level);
+        return lookup_address(address, level);
+}
 /*
 * This is necessary because __pa() does not work on some
 * kinds of memory, like vmalloc() or the alloc_remap()
@@ -437,7 +453,7 @@ try_preserve_large_page(pte_t *kpte, unsigned long address,
         * Check for races, another CPU might have split this page
         * up already:
         */
-        tmp = lookup_address(address, &level);
+        tmp = _lookup_address_cpa(cpa, address, &level);
        if (tmp != kpte)
                goto out_unlock;
@@ -543,7 +559,8 @@ out_unlock:
 }
 static int
-__split_large_page(pte_t *kpte, unsigned long address, struct page *base)
+__split_large_page(struct cpa_data *cpa, pte_t *kpte, unsigned long address,
+                   struct page *base)
 {
        pte_t *pbase = (pte_t *)page_address(base);
        unsigned long pfn, pfninc = 1;
@@ -556,7 +573,7 @@ __split_large_page(pte_t *kpte, unsigned long address, struct page *base)
         * Check for races, another CPU might have split this page
         * up for us already:
         */
-        tmp = lookup_address(address, &level);
+        tmp = _lookup_address_cpa(cpa, address, &level);
        if (tmp != kpte) {
                spin_unlock(&pgd_lock);
                return 1;
@@ -632,7 +649,8 @@ __split_large_page(pte_t *kpte, unsigned long address, struct page *base)
        return 0;
 }
-static int split_large_page(pte_t *kpte, unsigned long address)
+static int split_large_page(struct cpa_data *cpa, pte_t *kpte,
+                            unsigned long address)
 {
        struct page *base;
@@ -644,15 +662,390 @@ static int split_large_page(pte_t *kpte, unsigned long address)
        if (!base)
                return -ENOMEM;
-        if (__split_large_page(kpte, address, base))
+        if (__split_large_page(cpa, kpte, address, base))
                __free_page(base);
        return 0;
 }
+static bool try_to_free_pte_page(pte_t *pte)
+{
+        int i;
+        for (i = 0; i < PTRS_PER_PTE; i++)
+                if (!pte_none(pte[i]))
+                        return false;
+        free_page((unsigned long)pte);
+        return true;
+}
+static bool try_to_free_pmd_page(pmd_t *pmd)
+{
+        int i;
+        for (i = 0; i < PTRS_PER_PMD; i++)
+                if (!pmd_none(pmd[i]))
+                        return false;
+        free_page((unsigned long)pmd);
+        return true;
+}
+static bool unmap_pte_range(pmd_t *pmd, unsigned long start, unsigned long end)
+{
+        pte_t *pte = pte_offset_kernel(pmd, start);
+        while (start < end) {
+                set_pte(pte, __pte(0));
+                start += PAGE_SIZE;
+                pte++;
+        }
+        if (try_to_free_pte_page((pte_t *)pmd_page_vaddr(*pmd))) {
+                pmd_clear(pmd);
+                return true;
+        }
+        return false;
+}
+static void __unmap_pmd_range(pud_t *pud, pmd_t *pmd,
+                              unsigned long start, unsigned long end)
+{
+        if (unmap_pte_range(pmd, start, end))
+                if (try_to_free_pmd_page((pmd_t *)pud_page_vaddr(*pud)))
+                        pud_clear(pud);
+}
+static void unmap_pmd_range(pud_t *pud, unsigned long start, unsigned long end)
+{
+        pmd_t *pmd = pmd_offset(pud, start);
+        /*
+         * Not on a 2MB page boundary?
+         */
+        if (start & (PMD_SIZE - 1)) {
+                unsigned long next_page = (start + PMD_SIZE) & PMD_MASK;
+                unsigned long pre_end = min_t(unsigned long, end, next_page);
+                __unmap_pmd_range(pud, pmd, start, pre_end);
+                start = pre_end;
+                pmd++;
+        }
+        /*
+         * Try to unmap in 2M chunks.
+         */
+        while (end - start >= PMD_SIZE) {
+                if (pmd_large(*pmd))
+                        pmd_clear(pmd);
+                else
+                        __unmap_pmd_range(pud, pmd, start, start + PMD_SIZE);
+                start += PMD_SIZE;
+                pmd++;
+        }
+        /*
+         * 4K leftovers?
+         */
+        if (start < end)
+                return __unmap_pmd_range(pud, pmd, start, end);
+        /*
+         * Try again to free the PMD page if haven't succeeded above.
+         */
+        if (!pud_none(*pud))
+                if (try_to_free_pmd_page((pmd_t *)pud_page_vaddr(*pud)))
+                        pud_clear(pud);
+}
+static void unmap_pud_range(pgd_t *pgd, unsigned long start, unsigned long end)
+{
+        pud_t *pud = pud_offset(pgd, start);
+        /*
+         * Not on a GB page boundary?
+         */
+        if (start & (PUD_SIZE - 1)) {
+                unsigned long next_page = (start + PUD_SIZE) & PUD_MASK;
+                unsigned long pre_end   = min_t(unsigned long, end, next_page);
+                unmap_pmd_range(pud, start, pre_end);
+                start = pre_end;
+                pud++;
+        }
+        /*
+         * Try to unmap in 1G chunks?
+         */
+        while (end - start >= PUD_SIZE) {
+                if (pud_large(*pud))
+                        pud_clear(pud);
+                else
+                        unmap_pmd_range(pud, start, start + PUD_SIZE);
+                start += PUD_SIZE;
+                pud++;
+        }
+        /*
+         * 2M leftovers?
+         */
+        if (start < end)
+                unmap_pmd_range(pud, start, end);
+        /*
+         * No need to try to free the PUD page because we'll free it in
+         * populate_pgd's error path
+         */
+}
+static int alloc_pte_page(pmd_t *pmd)
+{
+        pte_t *pte = (pte_t *)get_zeroed_page(GFP_KERNEL | __GFP_NOTRACK);
+        if (!pte)
+                return -1;
+        set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
+        return 0;
+}
+static int alloc_pmd_page(pud_t *pud)
+{
+        pmd_t *pmd = (pmd_t *)get_zeroed_page(GFP_KERNEL | __GFP_NOTRACK);
+        if (!pmd)
+                return -1;
+        set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE));
+        return 0;
+}
+static void populate_pte(struct cpa_data *cpa,
+                         unsigned long start, unsigned long end,
+                         unsigned num_pages, pmd_t *pmd, pgprot_t pgprot)
+{
+        pte_t *pte;
+        pte = pte_offset_kernel(pmd, start);
+        while (num_pages-- && start < end) {
+                /* deal with the NX bit */
+                if (!(pgprot_val(pgprot) & _PAGE_NX))
+                        cpa->pfn &= ~_PAGE_NX;
+                set_pte(pte, pfn_pte(cpa->pfn >> PAGE_SHIFT, pgprot));
+                start    += PAGE_SIZE;
+                cpa->pfn += PAGE_SIZE;
+                pte++;
+        }
+}
+static int populate_pmd(struct cpa_data *cpa,
+                        unsigned long start, unsigned long end,
+                        unsigned num_pages, pud_t *pud, pgprot_t pgprot)
+{
+        unsigned int cur_pages = 0;
+        pmd_t *pmd;
+        /*
+         * Not on a 2M boundary?
+         */
+        if (start & (PMD_SIZE - 1)) {
+                unsigned long pre_end = start + (num_pages << PAGE_SHIFT);
+                unsigned long next_page = (start + PMD_SIZE) & PMD_MASK;
+                pre_end   = min_t(unsigned long, pre_end, next_page);
+                cur_pages = (pre_end - start) >> PAGE_SHIFT;
+                cur_pages = min_t(unsigned int, num_pages, cur_pages);
+                /*
+                 * Need a PTE page?
+                 */
+                pmd = pmd_offset(pud, start);
+                if (pmd_none(*pmd))
+                        if (alloc_pte_page(pmd))
+                                return -1;
+                populate_pte(cpa, start, pre_end, cur_pages, pmd, pgprot);
+                start = pre_end;
+        }
+        /*
+         * We mapped them all?
+         */
+        if (num_pages == cur_pages)
+                return cur_pages;
+        while (end - start >= PMD_SIZE) {
+                /*
+                 * We cannot use a 1G page so allocate a PMD page if needed.
+                 */
+                if (pud_none(*pud))
+                        if (alloc_pmd_page(pud))
+                                return -1;
+                pmd = pmd_offset(pud, start);
+                set_pmd(pmd, __pmd(cpa->pfn | _PAGE_PSE | massage_pgprot(pgprot)));
+                start     += PMD_SIZE;
+                cpa->pfn  += PMD_SIZE;
+                cur_pages += PMD_SIZE >> PAGE_SHIFT;
+        }
+        /*
+         * Map trailing 4K pages.
+         */
+        if (start < end) {
+                pmd = pmd_offset(pud, start);
+                if (pmd_none(*pmd))
+                        if (alloc_pte_page(pmd))
+                                return -1;
+                populate_pte(cpa, start, end, num_pages - cur_pages,
+                             pmd, pgprot);
+        }
+        return num_pages;
+}
+static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd,
+                        pgprot_t pgprot)
+{
+        pud_t *pud;
+        unsigned long end;
+        int cur_pages = 0;
+        end = start + (cpa->numpages << PAGE_SHIFT);
+        /*
+         * Not on a Gb page boundary? => map everything up to it with
+         * smaller pages.
+         */
+        if (start & (PUD_SIZE - 1)) {
+                unsigned long pre_end;
+                unsigned long next_page = (start + PUD_SIZE) & PUD_MASK;
+                pre_end   = min_t(unsigned long, end, next_page);
+                cur_pages = (pre_end - start) >> PAGE_SHIFT;
+                cur_pages = min_t(int, (int)cpa->numpages, cur_pages);
+                pud = pud_offset(pgd, start);
+                /*
+                 * Need a PMD page?
+                 */
+                if (pud_none(*pud))
+                        if (alloc_pmd_page(pud))
+                                return -1;
+                cur_pages = populate_pmd(cpa, start, pre_end, cur_pages,
+                                         pud, pgprot);
+                if (cur_pages < 0)
+                        return cur_pages;
+                start = pre_end;
+        }
+        /* We mapped them all? */
+        if (cpa->numpages == cur_pages)
+                return cur_pages;
+        pud = pud_offset(pgd, start);
+        /*
+         * Map everything starting from the Gb boundary, possibly with 1G pages
+         */
+        while (end - start >= PUD_SIZE) {
+                set_pud(pud, __pud(cpa->pfn | _PAGE_PSE | massage_pgprot(pgprot)));
+                start     += PUD_SIZE;
+                cpa->pfn  += PUD_SIZE;
+                cur_pages += PUD_SIZE >> PAGE_SHIFT;
+                pud++;
+        }
+        /* Map trailing leftover */
+        if (start < end) {
+                int tmp;
+                pud = pud_offset(pgd, start);
+                if (pud_none(*pud))
+                        if (alloc_pmd_page(pud))
+                                return -1;
+                tmp = populate_pmd(cpa, start, end, cpa->numpages - cur_pages,
+                                   pud, pgprot);
+                if (tmp < 0)
+                        return cur_pages;
+                cur_pages += tmp;
+        }
+        return cur_pages;
+}
+/*
+ * Restrictions for kernel page table do not necessarily apply when mapping in
+ * an alternate PGD.
+ */
+static int populate_pgd(struct cpa_data *cpa, unsigned long addr)
+{
+        pgprot_t pgprot = __pgprot(_KERNPG_TABLE);
+        bool allocd_pgd = false;
+        pgd_t *pgd_entry;
+        pud_t *pud = NULL;      /* shut up gcc */
+        int ret;
+        pgd_entry = cpa->pgd + pgd_index(addr);
+        /*
+         * Allocate a PUD page and hand it down for mapping.
+         */
+        if (pgd_none(*pgd_entry)) {
+                pud = (pud_t *)get_zeroed_page(GFP_KERNEL | __GFP_NOTRACK);
+                if (!pud)
+                        return -1;
+                set_pgd(pgd_entry, __pgd(__pa(pud) | _KERNPG_TABLE));
+                allocd_pgd = true;
+        }
+        pgprot_val(pgprot) &= ~pgprot_val(cpa->mask_clr);
+        pgprot_val(pgprot) |=  pgprot_val(cpa->mask_set);
+        ret = populate_pud(cpa, addr, pgd_entry, pgprot);
+        if (ret < 0) {
+                unmap_pud_range(pgd_entry, addr,
+                                addr + (cpa->numpages << PAGE_SHIFT));
+                if (allocd_pgd) {
+                        /*
+                         * If I allocated this PUD page, I can just as well
+                         * free it in this error path.
+                         */
+                        pgd_clear(pgd_entry);
+                        free_page((unsigned long)pud);
+                }
+                return ret;
+        }
+        cpa->numpages = ret;
+        return 0;
+}
 static int __cpa_process_fault(struct cpa_data *cpa, unsigned long vaddr,
                               int primary)
 {
+        if (cpa->pgd)
+                return populate_pgd(cpa, vaddr);
        /*
         * Ignore all non primary paths.
         */
@@ -697,7 +1090,7 @@ static int __change_page_attr(struct cpa_data *cpa, int primary)
        else
                address = *cpa->vaddr;
 repeat:
-        kpte = lookup_address(address, &level);
+        kpte = _lookup_address_cpa(cpa, address, &level);
        if (!kpte)
                return __cpa_process_fault(cpa, address, primary);
@@ -761,7 +1154,7 @@ repeat:
        /*
         * We have to split the large page:
         */
-        err = split_large_page(kpte, address);
+        err = split_large_page(cpa, kpte, address);
        if (!err) {
                /*
                 * Do a global flush tlb after splitting the large page
@@ -910,6 +1303,8 @@ static int change_page_attr_set_clr(unsigned long *addr, int numpages,
        int ret, cache, checkalias;
        unsigned long baddr = 0;
+        memset(&cpa, 0, sizeof(cpa));
        /*
         * Check, if we are requested to change a not supported
         * feature:
@@ -1356,6 +1751,7 @@ static int __set_pages_p(struct page *page, int numpages)
 {
        unsigned long tempaddr = (unsigned long) page_address(page);
        struct cpa_data cpa = { .vaddr = &tempaddr,
+                                .pgd = NULL,
                                .numpages = numpages,
                                .mask_set = __pgprot(_PAGE_PRESENT | _PAGE_RW),
                                .mask_clr = __pgprot(0),
@@ -1374,6 +1770,7 @@ static int __set_pages_np(struct page *page, int numpages)
 {
        unsigned long tempaddr = (unsigned long) page_address(page);
        struct cpa_data cpa = { .vaddr = &tempaddr,
+                                .pgd = NULL,
                                .numpages = numpages,
                                .mask_set = __pgprot(0),
                                .mask_clr = __pgprot(_PAGE_PRESENT | _PAGE_RW),
@@ -1434,6 +1831,36 @@ bool kernel_page_present(struct page *page)
 #endif /* CONFIG_DEBUG_PAGEALLOC */
+int kernel_map_pages_in_pgd(pgd_t *pgd, u64 pfn, unsigned long address,
+                            unsigned numpages, unsigned long page_flags)
+{
+        int retval = -EINVAL;
+        struct cpa_data cpa = {
+                .vaddr = &address,
+                .pfn = pfn,
+                .pgd = pgd,
+                .numpages = numpages,
+                .mask_set = __pgprot(0),
+                .mask_clr = __pgprot(0),
+                .flags = 0,
+        };
+        if (!(__supported_pte_mask & _PAGE_NX))
+                goto out;
+        if (!(page_flags & _PAGE_NX))
+                cpa.mask_clr = __pgprot(_PAGE_NX);
+        cpa.mask_set = __pgprot(_PAGE_PRESENT | page_flags);
+        retval = __change_page_attr_set_clr(&cpa, 0);
+        __flush_tlb_all();
+out:
+        return retval;
+}
 /*
 * The testcases use internal knowledge of the implementation that shouldn't
 * be exposed to the rest of the kernel. Include these directly here.
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index 26328e800869..4ed75dd81d05 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -359,15 +359,21 @@ void bpf_jit_compile(struct sk_filter *fp)
                                EMIT2(0x89, 0xd0);      /* mov %edx,%eax */
                                break;
                        case BPF_S_ALU_MOD_K: /* A %= K; */
+                                if (K == 1) {
+                                        CLEAR_A();
+                                        break;
+                                }
                                EMIT2(0x31, 0xd2);      /* xor %edx,%edx */
                                EMIT1(0xb9);EMIT(K, 4); /* mov imm32,%ecx */
                                EMIT2(0xf7, 0xf1);      /* div %ecx */
                                EMIT2(0x89, 0xd0);      /* mov %edx,%eax */
                                break;
-                        case BPF_S_ALU_DIV_K: /* A = reciprocal_divide(A, K); */
+                        case BPF_S_ALU_DIV_K: /* A /= K */
-                                EMIT3(0x48, 0x69, 0xc0); /* imul imm32,%rax,%rax */
+                                if (K == 1)
-                                EMIT(K, 4);
+                                        break;
-                                EMIT4(0x48, 0xc1, 0xe8, 0x20); /* shr $0x20,%rax */
+                                EMIT2(0x31, 0xd2);      /* xor %edx,%edx */
+                                EMIT1(0xb9);EMIT(K, 4); /* mov imm32,%ecx */
+                                EMIT2(0xf7, 0xf1);      /* div %ecx */
                                break;
                        case BPF_S_ALU_AND_X:
                                seen |= SEEN_XREG;
diff --git a/arch/x86/pci/fixup.c b/arch/x86/pci/fixup.c
index b046e070e088..bca9e85daaa5 100644
--- a/arch/x86/pci/fixup.c
+++ b/arch/x86/pci/fixup.c
@@ -5,7 +5,6 @@
 #include <linux/delay.h>
 #include <linux/dmi.h>
 #include <linux/pci.h>
-#include <linux/init.h>
 #include <linux/vgaarb.h>
 #include <asm/pci_x86.h>
diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
index 51384ca727ad..84b9d672843d 100644
--- a/arch/x86/pci/intel_mid_pci.c
+++ b/arch/x86/pci/intel_mid_pci.c
@@ -31,6 +31,7 @@
 #include <asm/pci_x86.h>
 #include <asm/hw_irq.h>
 #include <asm/io_apic.h>
+#include <asm/intel-mid.h>
 #define PCIE_CAP_OFFSET 0x100
@@ -219,7 +220,10 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)
        irq_attr.ioapic = mp_find_ioapic(dev->irq);
        irq_attr.ioapic_pin = dev->irq;
        irq_attr.trigger = 1; /* level */
-        irq_attr.polarity = 1; /* active low */
+        if (intel_mid_identify_cpu() == INTEL_MID_CPU_CHIP_TANGIER)
+                irq_attr.polarity = 0; /* active high */
+        else
+                irq_attr.polarity = 1; /* active low */
        io_apic_set_pci_routing(&dev->dev, dev->irq, &irq_attr);
        return 0;
diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
index cceb813044ef..d62ec87a2b26 100644
--- a/arch/x86/platform/efi/efi.c
+++ b/arch/x86/platform/efi/efi.c
@@ -12,6 +12,8 @@
 *      Bibo Mao <bibo.mao@intel.com>
 *      Chandramouli Narayanan <mouli@linux.intel.com>
 *      Huang Ying <ying.huang@intel.com>
+ * Copyright (C) 2013 SuSE Labs
+ *      Borislav Petkov <bp@suse.de> - runtime services VA mapping
 *
 * Copied from efi_32.c to eliminate the duplicated code between EFI
 * 32/64 support code. --ying 2007-10-26
@@ -51,7 +53,7 @@
 #include <asm/x86_init.h>
 #include <asm/rtc.h>
-#define EFI_DEBUG       1
+#define EFI_DEBUG
 #define EFI_MIN_RESERVE 5120
@@ -74,6 +76,8 @@ static __initdata efi_config_table_type_t arch_tables[] = {
        {NULL_GUID, NULL, NULL},
 };
+u64 efi_setup;          /* efi setup_data physical address */
 /*
 * Returns 1 if 'facility' is enabled, 0 otherwise.
 */
@@ -110,7 +114,6 @@ static int __init setup_storage_paranoia(char *arg)
 }
 early_param("efi_no_storage_paranoia", setup_storage_paranoia);
 static efi_status_t virt_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc)
 {
        unsigned long flags;
@@ -398,9 +401,9 @@ int __init efi_memblock_x86_reserve_range(void)
        return 0;
 }
-#if EFI_DEBUG
 static void __init print_efi_memmap(void)
 {
+#ifdef EFI_DEBUG
        efi_memory_desc_t *md;
        void *p;
        int i;
@@ -415,8 +418,8 @@ static void __init print_efi_memmap(void)
                        md->phys_addr + (md->num_pages << EFI_PAGE_SHIFT),
                        (md->num_pages >> (20 - EFI_PAGE_SHIFT)));
        }
-}
 #endif  /*  EFI_DEBUG  */
+}
 void __init efi_reserve_boot_services(void)
 {
@@ -436,7 +439,7 @@ void __init efi_reserve_boot_services(void)
                 * - Not within any part of the kernel
                 * - Not the bios reserved area
                */
-                if ((start+size >= __pa_symbol(_text)
+                if ((start + size > __pa_symbol(_text)
                                && start <= __pa_symbol(_end)) ||
                        !e820_all_mapped(start, start+size, E820_RAM) ||
                        memblock_is_region_reserved(start, size)) {
@@ -489,18 +492,27 @@ static int __init efi_systab_init(void *phys)
 {
        if (efi_enabled(EFI_64BIT)) {
                efi_system_table_64_t *systab64;
+                struct efi_setup_data *data = NULL;
                u64 tmp = 0;
+                if (efi_setup) {
+                        data = early_memremap(efi_setup, sizeof(*data));
+                        if (!data)
+                                return -ENOMEM;
+                }
                systab64 = early_ioremap((unsigned long)phys,
                                         sizeof(*systab64));
                if (systab64 == NULL) {
                        pr_err("Couldn't map the system table!\n");
+                        if (data)
+                                early_iounmap(data, sizeof(*data));
                        return -ENOMEM;
                }
                efi_systab.hdr = systab64->hdr;
-                efi_systab.fw_vendor = systab64->fw_vendor;
+                efi_systab.fw_vendor = data ? (unsigned long)data->fw_vendor :
-                tmp |= systab64->fw_vendor;
+                                              systab64->fw_vendor;
+                tmp |= data ? data->fw_vendor : systab64->fw_vendor;
                efi_systab.fw_revision = systab64->fw_revision;
                efi_systab.con_in_handle = systab64->con_in_handle;
                tmp |= systab64->con_in_handle;
@@ -514,15 +526,20 @@ static int __init efi_systab_init(void *phys)
                tmp |= systab64->stderr_handle;
                efi_systab.stderr = systab64->stderr;
                tmp |= systab64->stderr;
-                efi_systab.runtime = (void *)(unsigned long)systab64->runtime;
+                efi_systab.runtime = data ?
-                tmp |= systab64->runtime;
+                                     (void *)(unsigned long)data->runtime :
+                                     (void *)(unsigned long)systab64->runtime;
+                tmp |= data ? data->runtime : systab64->runtime;
                efi_systab.boottime = (void *)(unsigned long)systab64->boottime;
                tmp |= systab64->boottime;
                efi_systab.nr_tables = systab64->nr_tables;
-                efi_systab.tables = systab64->tables;
+                efi_systab.tables = data ? (unsigned long)data->tables :
-                tmp |= systab64->tables;
+                                           systab64->tables;
+                tmp |= data ? data->tables : systab64->tables;
                early_iounmap(systab64, sizeof(*systab64));
+                if (data)
+                        early_iounmap(data, sizeof(*data));
 #ifdef CONFIG_X86_32
                if (tmp >> 32) {
                        pr_err("EFI data located above 4GB, disabling EFI.\n");
@@ -626,6 +643,62 @@ static int __init efi_memmap_init(void)
        return 0;
 }
+/*
+ * A number of config table entries get remapped to virtual addresses
+ * after entering EFI virtual mode. However, the kexec kernel requires
+ * their physical addresses therefore we pass them via setup_data and
+ * correct those entries to their respective physical addresses here.
+ *
+ * Currently only handles smbios which is necessary for some firmware
+ * implementation.
+ */
+static int __init efi_reuse_config(u64 tables, int nr_tables)
+{
+        int i, sz, ret = 0;
+        void *p, *tablep;
+        struct efi_setup_data *data;
+        if (!efi_setup)
+                return 0;
+        if (!efi_enabled(EFI_64BIT))
+                return 0;
+        data = early_memremap(efi_setup, sizeof(*data));
+        if (!data) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        if (!data->smbios)
+                goto out_memremap;
+        sz = sizeof(efi_config_table_64_t);
+        p = tablep = early_memremap(tables, nr_tables * sz);
+        if (!p) {
+                pr_err("Could not map Configuration table!\n");
+                ret = -ENOMEM;
+                goto out_memremap;
+        }
+        for (i = 0; i < efi.systab->nr_tables; i++) {
+                efi_guid_t guid;
+                guid = ((efi_config_table_64_t *)p)->guid;
+                if (!efi_guidcmp(guid, SMBIOS_TABLE_GUID))
+                        ((efi_config_table_64_t *)p)->table = data->smbios;
+                p += sz;
+        }
+        early_iounmap(tablep, nr_tables * sz);
+out_memremap:
+        early_iounmap(data, sizeof(*data));
+out:
+        return ret;
+}
 void __init efi_init(void)
 {
        efi_char16_t *c16;
@@ -651,6 +724,10 @@ void __init efi_init(void)
        set_bit(EFI_SYSTEM_TABLES, &x86_efi_facility);
+        efi.config_table = (unsigned long)efi.systab->tables;
+        efi.fw_vendor    = (unsigned long)efi.systab->fw_vendor;
+        efi.runtime      = (unsigned long)efi.systab->runtime;
        /*
         * Show what we know for posterity
         */
@@ -667,6 +744,9 @@ void __init efi_init(void)
                efi.systab->hdr.revision >> 16,
                efi.systab->hdr.revision & 0xffff, vendor);
+        if (efi_reuse_config(efi.systab->tables, efi.systab->nr_tables))
+                return;
        if (efi_config_init(arch_tables))
                return;
@@ -684,15 +764,12 @@ void __init efi_init(void)
                        return;
                set_bit(EFI_RUNTIME_SERVICES, &x86_efi_facility);
        }
        if (efi_memmap_init())
                return;
        set_bit(EFI_MEMMAP, &x86_efi_facility);
-#if EFI_DEBUG
        print_efi_memmap();
-#endif
 }
 void __init efi_late_init(void)
@@ -741,36 +818,38 @@ void efi_memory_uc(u64 addr, unsigned long size)
        set_memory_uc(addr, npages);
 }
-/*
+void __init old_map_region(efi_memory_desc_t *md)
- * This function will switch the EFI runtime services to virtual mode.
- * Essentially, look through the EFI memmap and map every region that
- * has the runtime attribute bit set in its memory descriptor and update
- * that memory descriptor with the virtual address obtained from ioremap().
- * This enables the runtime services to be called without having to
- * thunk back into physical mode for every invocation.
- */
-void __init efi_enter_virtual_mode(void)
 {
-        efi_memory_desc_t *md, *prev_md = NULL;
+        u64 start_pfn, end_pfn, end;
-        efi_status_t status;
        unsigned long size;
-        u64 end, systab, start_pfn, end_pfn;
+        void *va;
-        void *p, *va, *new_memmap = NULL;
-        int count = 0;
-        efi.systab = NULL;
+        start_pfn = PFN_DOWN(md->phys_addr);
+        size      = md->num_pages << PAGE_SHIFT;
+        end       = md->phys_addr + size;
+        end_pfn   = PFN_UP(end);
-        /*
+        if (pfn_range_is_mapped(start_pfn, end_pfn)) {
-         * We don't do virtual mode, since we don't do runtime services, on
+                va = __va(md->phys_addr);
-         * non-native EFI
-         */
-        if (!efi_is_native()) {
+                if (!(md->attribute & EFI_MEMORY_WB))
-                efi_unmap_memmap();
+                        efi_memory_uc((u64)(unsigned long)va, size);
-                return;
+        } else
-        }
+                va = efi_ioremap(md->phys_addr, size,
+                                 md->type, md->attribute);
+        md->virt_addr = (u64) (unsigned long) va;
+        if (!va)
+                pr_err("ioremap of 0x%llX failed!\n",
+                       (unsigned long long)md->phys_addr);
+}
+/* Merge contiguous regions of the same type and attribute */
+static void __init efi_merge_regions(void)
+{
+        void *p;
+        efi_memory_desc_t *md, *prev_md = NULL;
-        /* Merge contiguous regions of the same type and attribute */
        for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
                u64 prev_size;
                md = p;
@@ -796,6 +875,77 @@ void __init efi_enter_virtual_mode(void)
                }
                prev_md = md;
        }
+}
+static void __init get_systab_virt_addr(efi_memory_desc_t *md)
+{
+        unsigned long size;
+        u64 end, systab;
+        size = md->num_pages << EFI_PAGE_SHIFT;
+        end = md->phys_addr + size;
+        systab = (u64)(unsigned long)efi_phys.systab;
+        if (md->phys_addr <= systab && systab < end) {
+                systab += md->virt_addr - md->phys_addr;
+                efi.systab = (efi_system_table_t *)(unsigned long)systab;
+        }
+}
+static int __init save_runtime_map(void)
+{
+        efi_memory_desc_t *md;
+        void *tmp, *p, *q = NULL;
+        int count = 0;
+        for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+                md = p;
+                if (!(md->attribute & EFI_MEMORY_RUNTIME) ||
+                    (md->type == EFI_BOOT_SERVICES_CODE) ||
+                    (md->type == EFI_BOOT_SERVICES_DATA))
+                        continue;
+                tmp = krealloc(q, (count + 1) * memmap.desc_size, GFP_KERNEL);
+                if (!tmp)
+                        goto out;
+                q = tmp;
+                memcpy(q + count * memmap.desc_size, md, memmap.desc_size);
+                count++;
+        }
+        efi_runtime_map_setup(q, count, memmap.desc_size);
+        return 0;
+out:
+        kfree(q);
+        return -ENOMEM;
+}
+/*
+ * Map efi regions which were passed via setup_data. The virt_addr is a fixed
+ * addr which was used in first kernel of a kexec boot.
+ */
+static void __init efi_map_regions_fixed(void)
+{
+        void *p;
+        efi_memory_desc_t *md;
+        for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
+                md = p;
+                efi_map_region_fixed(md); /* FIXME: add error handling */
+                get_systab_virt_addr(md);
+        }
+}
+/*
+ * Map efi memory ranges for runtime serivce and update new_memmap with virtual
+ * addresses.
+ */
+static void * __init efi_map_regions(int *count)
+{
+        efi_memory_desc_t *md;
+        void *p, *tmp, *new_memmap = NULL;
        for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
                md = p;
@@ -807,53 +957,95 @@ void __init efi_enter_virtual_mode(void)
                                continue;
                }
-                size = md->num_pages << EFI_PAGE_SHIFT;
+                efi_map_region(md);
-                end = md->phys_addr + size;
+                get_systab_virt_addr(md);
-                start_pfn = PFN_DOWN(md->phys_addr);
+                tmp = krealloc(new_memmap, (*count + 1) * memmap.desc_size,
-                end_pfn = PFN_UP(end);
+                               GFP_KERNEL);
-                if (pfn_range_is_mapped(start_pfn, end_pfn)) {
+                if (!tmp)
-                        va = __va(md->phys_addr);
+                        goto out;
+                new_memmap = tmp;
+                memcpy(new_memmap + (*count * memmap.desc_size), md,
+                       memmap.desc_size);
+                (*count)++;
+        }
-                        if (!(md->attribute & EFI_MEMORY_WB))
+        return new_memmap;
-                                efi_memory_uc((u64)(unsigned long)va, size);
+out:
-                } else
+        kfree(new_memmap);
-                        va = efi_ioremap(md->phys_addr, size,
+        return NULL;
-                                         md->type, md->attribute);
+}
+/*
+ * This function will switch the EFI runtime services to virtual mode.
+ * Essentially, we look through the EFI memmap and map every region that
+ * has the runtime attribute bit set in its memory descriptor into the
+ * ->trampoline_pgd page table using a top-down VA allocation scheme.
+ *
+ * The old method which used to update that memory descriptor with the
+ * virtual address obtained from ioremap() is still supported when the
+ * kernel is booted with efi=old_map on its command line. Same old
+ * method enabled the runtime services to be called without having to
+ * thunk back into physical mode for every invocation.
+ *
+ * The new method does a pagetable switch in a preemption-safe manner
+ * so that we're in a different address space when calling a runtime
+ * function. For function arguments passing we do copy the PGDs of the
+ * kernel page table into ->trampoline_pgd prior to each call.
+ *
+ * Specially for kexec boot, efi runtime maps in previous kernel should
+ * be passed in via setup_data. In that case runtime ranges will be mapped
+ * to the same virtual addresses as the first kernel.
+ */
+void __init efi_enter_virtual_mode(void)
+{
+        efi_status_t status;
+        void *new_memmap = NULL;
+        int err, count = 0;
-                md->virt_addr = (u64) (unsigned long) va;
+        efi.systab = NULL;
-                if (!va) {
+        /*
-                        pr_err("ioremap of 0x%llX failed!\n",
+         * We don't do virtual mode, since we don't do runtime services, on
-                               (unsigned long long)md->phys_addr);
+         * non-native EFI
-                        continue;
+         */
-                }
+        if (!efi_is_native()) {
+                efi_unmap_memmap();
+                return;
+        }
-                systab = (u64) (unsigned long) efi_phys.systab;
+        if (efi_setup) {
-                if (md->phys_addr <= systab && systab < end) {
+                efi_map_regions_fixed();
-                        systab += md->virt_addr - md->phys_addr;
+        } else {
-                        efi.systab = (efi_system_table_t *) (unsigned long) systab;
+                efi_merge_regions();
+                new_memmap = efi_map_regions(&count);
+                if (!new_memmap) {
+                        pr_err("Error reallocating memory, EFI runtime non-functional!\n");
+                        return;
                }
-                new_memmap = krealloc(new_memmap,
-                                      (count + 1) * memmap.desc_size,
-                                      GFP_KERNEL);
-                memcpy(new_memmap + (count * memmap.desc_size), md,
-                       memmap.desc_size);
-                count++;
        }
+        err = save_runtime_map();
+        if (err)
+                pr_err("Error saving runtime map, efi runtime on kexec non-functional!!\n");
        BUG_ON(!efi.systab);
-        status = phys_efi_set_virtual_address_map(
+        efi_setup_page_tables();
-                memmap.desc_size * count,
+        efi_sync_low_kernel_mappings();
-                memmap.desc_size,
-                memmap.desc_version,
-                (efi_memory_desc_t *)__pa(new_memmap));
-        if (status != EFI_SUCCESS) {
+        if (!efi_setup) {
-                pr_alert("Unable to switch EFI into virtual mode "
+                status = phys_efi_set_virtual_address_map(
-                         "(status=%lx)!\n", status);
+                        memmap.desc_size * count,
-                panic("EFI call to SetVirtualAddressMap() failed!");
+                        memmap.desc_size,
+                        memmap.desc_version,
+                        (efi_memory_desc_t *)__pa(new_memmap));
+                if (status != EFI_SUCCESS) {
+                        pr_alert("Unable to switch EFI into virtual mode (status=%lx)!\n",
+                                 status);
+                        panic("EFI call to SetVirtualAddressMap() failed!");
+                }
        }
        /*
@@ -876,7 +1068,8 @@ void __init efi_enter_virtual_mode(void)
        efi.query_variable_info = virt_efi_query_variable_info;
        efi.update_capsule = virt_efi_update_capsule;
        efi.query_capsule_caps = virt_efi_query_capsule_caps;
-        if (__supported_pte_mask & _PAGE_NX)
+        if (efi_enabled(EFI_OLD_MEMMAP) && (__supported_pte_mask & _PAGE_NX))
                runtime_code_page_mkexec();
        kfree(new_memmap);
@@ -1006,3 +1199,15 @@ efi_status_t efi_query_variable_store(u32 attributes, unsigned long size)
        return EFI_SUCCESS;
 }
 EXPORT_SYMBOL_GPL(efi_query_variable_store);
+static int __init parse_efi_cmdline(char *str)
+{
+        if (*str == '=')
+                str++;
+        if (!strncmp(str, "old_map", 7))
+                set_bit(EFI_OLD_MEMMAP, &x86_efi_facility);
+        return 0;
+}
+early_param("efi", parse_efi_cmdline);
diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c
index 40e446941dd7..249b183cf417 100644
--- a/arch/x86/platform/efi/efi_32.c
+++ b/arch/x86/platform/efi/efi_32.c
@@ -37,9 +37,19 @@
 * claim EFI runtime service handler exclusively and to duplicate a memory in
 * low memory space say 0 - 3G.
 */
 static unsigned long efi_rt_eflags;
+void efi_sync_low_kernel_mappings(void) {}
+void efi_setup_page_tables(void) {}
+void __init efi_map_region(efi_memory_desc_t *md)
+{
+        old_map_region(md);
+}
+void __init efi_map_region_fixed(efi_memory_desc_t *md) {}
+void __init parse_efi_setup(u64 phys_addr, u32 data_len) {}
 void efi_call_phys_prelog(void)
 {
        struct desc_ptr gdt_descr;
diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c
index 39a0e7f1f0a3..6284f158a47d 100644
--- a/arch/x86/platform/efi/efi_64.c
+++ b/arch/x86/platform/efi/efi_64.c
@@ -38,10 +38,28 @@
 #include <asm/efi.h>
 #include <asm/cacheflush.h>
 #include <asm/fixmap.h>
+#include <asm/realmode.h>
 static pgd_t *save_pgd __initdata;
 static unsigned long efi_flags __initdata;
+/*
+ * We allocate runtime services regions bottom-up, starting from -4G, i.e.
+ * 0xffff_ffff_0000_0000 and limit EFI VA mapping space to 64G.
+ */
+static u64 efi_va       = -4 * (1UL << 30);
+#define EFI_VA_END      (-68 * (1UL << 30))
+/*
+ * Scratch space used for switching the pagetable in the EFI stub
+ */
+struct efi_scratch {
+        u64 r15;
+        u64 prev_cr3;
+        pgd_t *efi_pgt;
+        bool use_pgd;
+};
 static void __init early_code_mapping_set_exec(int executable)
 {
        efi_memory_desc_t *md;
@@ -65,6 +83,9 @@ void __init efi_call_phys_prelog(void)
        int pgd;
        int n_pgds;
+        if (!efi_enabled(EFI_OLD_MEMMAP))
+                return;
        early_code_mapping_set_exec(1);
        local_irq_save(efi_flags);
@@ -86,6 +107,10 @@ void __init efi_call_phys_epilog(void)
         */
        int pgd;
        int n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT) , PGDIR_SIZE);
+        if (!efi_enabled(EFI_OLD_MEMMAP))
+                return;
        for (pgd = 0; pgd < n_pgds; pgd++)
                set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]);
        kfree(save_pgd);
@@ -94,6 +119,96 @@ void __init efi_call_phys_epilog(void)
        early_code_mapping_set_exec(0);
 }
+/*
+ * Add low kernel mappings for passing arguments to EFI functions.
+ */
+void efi_sync_low_kernel_mappings(void)
+{
+        unsigned num_pgds;
+        pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd);
+        if (efi_enabled(EFI_OLD_MEMMAP))
+                return;
+        num_pgds = pgd_index(MODULES_END - 1) - pgd_index(PAGE_OFFSET);
+        memcpy(pgd + pgd_index(PAGE_OFFSET),
+                init_mm.pgd + pgd_index(PAGE_OFFSET),
+                sizeof(pgd_t) * num_pgds);
+}
+void efi_setup_page_tables(void)
+{
+        efi_scratch.efi_pgt = (pgd_t *)(unsigned long)real_mode_header->trampoline_pgd;
+        if (!efi_enabled(EFI_OLD_MEMMAP))
+                efi_scratch.use_pgd = true;
+}
+static void __init __map_region(efi_memory_desc_t *md, u64 va)
+{
+        pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd);
+        unsigned long pf = 0;
+        if (!(md->attribute & EFI_MEMORY_WB))
+                pf |= _PAGE_PCD;
+        if (kernel_map_pages_in_pgd(pgd, md->phys_addr, va, md->num_pages, pf))
+                pr_warn("Error mapping PA 0x%llx -> VA 0x%llx!\n",
+                           md->phys_addr, va);
+}
+void __init efi_map_region(efi_memory_desc_t *md)
+{
+        unsigned long size = md->num_pages << PAGE_SHIFT;
+        u64 pa = md->phys_addr;
+        if (efi_enabled(EFI_OLD_MEMMAP))
+                return old_map_region(md);
+        /*
+         * Make sure the 1:1 mappings are present as a catch-all for b0rked
+         * firmware which doesn't update all internal pointers after switching
+         * to virtual mode and would otherwise crap on us.
+         */
+        __map_region(md, md->phys_addr);
+        efi_va -= size;
+        /* Is PA 2M-aligned? */
+        if (!(pa & (PMD_SIZE - 1))) {
+                efi_va &= PMD_MASK;
+        } else {
+                u64 pa_offset = pa & (PMD_SIZE - 1);
+                u64 prev_va = efi_va;
+                /* get us the same offset within this 2M page */
+                efi_va = (efi_va & PMD_MASK) + pa_offset;
+                if (efi_va > prev_va)
+                        efi_va -= PMD_SIZE;
+        }
+        if (efi_va < EFI_VA_END) {
+                pr_warn(FW_WARN "VA address range overflow!\n");
+                return;
+        }
+        /* Do the VA map */
+        __map_region(md, efi_va);
+        md->virt_addr = efi_va;
+}
+/*
+ * kexec kernel will use efi_map_region_fixed to map efi runtime memory ranges.
+ * md->virt_addr is the original virtual address which had been mapped in kexec
+ * 1st kernel.
+ */
+void __init efi_map_region_fixed(efi_memory_desc_t *md)
+{
+        __map_region(md, md->virt_addr);
+}
 void __iomem *__init efi_ioremap(unsigned long phys_addr, unsigned long size,
                                 u32 type, u64 attribute)
 {
@@ -113,3 +228,8 @@ void __iomem *__init efi_ioremap(unsigned long phys_addr, unsigned long size,
        return (void __iomem *)__va(phys_addr);
 }
+void __init parse_efi_setup(u64 phys_addr, u32 data_len)
+{
+        efi_setup = phys_addr + sizeof(struct setup_data);
+}
diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S
index 4c07ccab8146..88073b140298 100644
--- a/arch/x86/platform/efi/efi_stub_64.S
+++ b/arch/x86/platform/efi/efi_stub_64.S
@@ -34,10 +34,47 @@
        mov %rsi, %cr0;                 \
        mov (%rsp), %rsp
+        /* stolen from gcc */
+        .macro FLUSH_TLB_ALL
+        movq %r15, efi_scratch(%rip)
+        movq %r14, efi_scratch+8(%rip)
+        movq %cr4, %r15
+        movq %r15, %r14
+        andb $0x7f, %r14b
+        movq %r14, %cr4
+        movq %r15, %cr4
+        movq efi_scratch+8(%rip), %r14
+        movq efi_scratch(%rip), %r15
+        .endm
+        .macro SWITCH_PGT
+        cmpb $0, efi_scratch+24(%rip)
+        je 1f
+        movq %r15, efi_scratch(%rip)            # r15
+        # save previous CR3
+        movq %cr3, %r15
+        movq %r15, efi_scratch+8(%rip)          # prev_cr3
+        movq efi_scratch+16(%rip), %r15         # EFI pgt
+        movq %r15, %cr3
+        1:
+        .endm
+        .macro RESTORE_PGT
+        cmpb $0, efi_scratch+24(%rip)
+        je 2f
+        movq efi_scratch+8(%rip), %r15
+        movq %r15, %cr3
+        movq efi_scratch(%rip), %r15
+        FLUSH_TLB_ALL
+        2:
+        .endm
 ENTRY(efi_call0)
        SAVE_XMM
        subq $32, %rsp
+        SWITCH_PGT
        call *%rdi
+        RESTORE_PGT
        addq $32, %rsp
        RESTORE_XMM
        ret
@@ -47,7 +84,9 @@ ENTRY(efi_call1)
        SAVE_XMM
        subq $32, %rsp
        mov  %rsi, %rcx
+        SWITCH_PGT
        call *%rdi
+        RESTORE_PGT
        addq $32, %rsp
        RESTORE_XMM
        ret
@@ -57,7 +96,9 @@ ENTRY(efi_call2)
        SAVE_XMM
        subq $32, %rsp
        mov  %rsi, %rcx
+        SWITCH_PGT
        call *%rdi
+        RESTORE_PGT
        addq $32, %rsp
        RESTORE_XMM
        ret
@@ -68,7 +109,9 @@ ENTRY(efi_call3)
        subq $32, %rsp
        mov  %rcx, %r8
        mov  %rsi, %rcx
+        SWITCH_PGT
        call *%rdi
+        RESTORE_PGT
        addq $32, %rsp
        RESTORE_XMM
        ret
@@ -80,7 +123,9 @@ ENTRY(efi_call4)
        mov %r8, %r9
        mov %rcx, %r8
        mov %rsi, %rcx
+        SWITCH_PGT
        call *%rdi
+        RESTORE_PGT
        addq $32, %rsp
        RESTORE_XMM
        ret
@@ -93,7 +138,9 @@ ENTRY(efi_call5)
        mov %r8, %r9
        mov %rcx, %r8
        mov %rsi, %rcx
+        SWITCH_PGT
        call *%rdi
+        RESTORE_PGT
        addq $48, %rsp
        RESTORE_XMM
        ret
@@ -109,8 +156,15 @@ ENTRY(efi_call6)
        mov %r8, %r9
        mov %rcx, %r8
        mov %rsi, %rcx
+        SWITCH_PGT
        call *%rdi
+        RESTORE_PGT
        addq $48, %rsp
        RESTORE_XMM
        ret
 ENDPROC(efi_call6)
+        .data
+ENTRY(efi_scratch)
+        .fill 3,8,0
+        .byte 0
diff --git a/arch/x86/platform/intel-mid/Makefile b/arch/x86/platform/intel-mid/Makefile
index 01cc29ea5ff7..0a8ee703b9fa 100644
--- a/arch/x86/platform/intel-mid/Makefile
+++ b/arch/x86/platform/intel-mid/Makefile
@@ -1,6 +1,6 @@
-obj-$(CONFIG_X86_INTEL_MID) += intel-mid.o
+obj-$(CONFIG_X86_INTEL_MID) += intel-mid.o intel_mid_vrtc.o mfld.o mrfl.o
-obj-$(CONFIG_X86_INTEL_MID) += intel_mid_vrtc.o
 obj-$(CONFIG_EARLY_PRINTK_INTEL_MID) += early_printk_intel_mid.o
 # SFI specific code
 ifdef CONFIG_X86_INTEL_MID
 obj-$(CONFIG_SFI) += sfi.o device_libs/
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_emc1403.c b/arch/x86/platform/intel-mid/device_libs/platform_emc1403.c
index 0d942c1d26d5..69a783689d21 100644
--- a/arch/x86/platform/intel-mid/device_libs/platform_emc1403.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_emc1403.c
@@ -22,7 +22,9 @@ static void __init *emc1403_platform_data(void *info)
        int intr = get_gpio_by_name("thermal_int");
        int intr2nd = get_gpio_by_name("thermal_alert");
-        if (intr == -1 || intr2nd == -1)
+        if (intr < 0)
+                return NULL;
+        if (intr2nd < 0)
                return NULL;
        i2c_info->irq = intr + INTEL_MID_IRQ_OFFSET;
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_gpio_keys.c b/arch/x86/platform/intel-mid/device_libs/platform_gpio_keys.c
index a013a4834bbe..dccae6b0413f 100644
--- a/arch/x86/platform/intel-mid/device_libs/platform_gpio_keys.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_gpio_keys.c
@@ -66,7 +66,7 @@ static int __init pb_keys_init(void)
                gb[i].gpio = get_gpio_by_name(gb[i].desc);
                pr_debug("info[%2d]: name = %s, gpio = %d\n", i, gb[i].desc,
                                        gb[i].gpio);
-                if (gb[i].gpio == -1)
+                if (gb[i].gpio < 0)
                        continue;
                if (i != good)
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_lis331.c b/arch/x86/platform/intel-mid/device_libs/platform_lis331.c
index 15278c11f714..54226de7541a 100644
--- a/arch/x86/platform/intel-mid/device_libs/platform_lis331.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_lis331.c
@@ -21,7 +21,9 @@ static void __init *lis331dl_platform_data(void *info)
        int intr = get_gpio_by_name("accel_int");
        int intr2nd = get_gpio_by_name("accel_2");
-        if (intr == -1 || intr2nd == -1)
+        if (intr < 0)
+                return NULL;
+        if (intr2nd < 0)
                return NULL;
        i2c_info->irq = intr + INTEL_MID_IRQ_OFFSET;
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_max7315.c b/arch/x86/platform/intel-mid/device_libs/platform_max7315.c
index 94ade10024ae..2c8acbc1e9ad 100644
--- a/arch/x86/platform/intel-mid/device_libs/platform_max7315.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_max7315.c
@@ -48,7 +48,7 @@ static void __init *max7315_platform_data(void *info)
        gpio_base = get_gpio_by_name(base_pin_name);
        intr = get_gpio_by_name(intr_pin_name);
-        if (gpio_base == -1)
+        if (gpio_base < 0)
                return NULL;
        max7315->gpio_base = gpio_base;
        if (intr != -1) {
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_mpu3050.c b/arch/x86/platform/intel-mid/device_libs/platform_mpu3050.c
index dd28d63c84fb..cfe9a47a1e87 100644
--- a/arch/x86/platform/intel-mid/device_libs/platform_mpu3050.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_mpu3050.c
@@ -19,7 +19,7 @@ static void *mpu3050_platform_data(void *info)
        struct i2c_board_info *i2c_info = info;
        int intr = get_gpio_by_name("mpu3050_int");
-        if (intr == -1)
+        if (intr < 0)
                return NULL;
        i2c_info->irq = intr + INTEL_MID_IRQ_OFFSET;
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_pmic_gpio.c b/arch/x86/platform/intel-mid/device_libs/platform_pmic_gpio.c
index d87182a09263..65c2a9a19db4 100644
--- a/arch/x86/platform/intel-mid/device_libs/platform_pmic_gpio.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_pmic_gpio.c
@@ -26,7 +26,7 @@ static void __init *pmic_gpio_platform_data(void *info)
        static struct intel_pmic_gpio_platform_data pmic_gpio_pdata;
        int gpio_base = get_gpio_by_name("pmic_gpio_base");
-        if (gpio_base == -1)
+        if (gpio_base < 0)
                gpio_base = 64;
        pmic_gpio_pdata.gpio_base = gpio_base;
        pmic_gpio_pdata.irq_base = gpio_base + INTEL_MID_IRQ_OFFSET;
diff --git a/arch/x86/platform/intel-mid/device_libs/platform_tca6416.c b/arch/x86/platform/intel-mid/device_libs/platform_tca6416.c
index 22881c9a6737..33be0b3be6e1 100644
--- a/arch/x86/platform/intel-mid/device_libs/platform_tca6416.c
+++ b/arch/x86/platform/intel-mid/device_libs/platform_tca6416.c
@@ -34,10 +34,10 @@ static void *tca6416_platform_data(void *info)
        gpio_base = get_gpio_by_name(base_pin_name);
        intr = get_gpio_by_name(intr_pin_name);
-        if (gpio_base == -1)
+        if (gpio_base < 0)
                return NULL;
        tca6416.gpio_base = gpio_base;
-        if (intr != -1) {
+        if (intr >= 0) {
                i2c_info->irq = intr + INTEL_MID_IRQ_OFFSET;
                tca6416.irq_base = gpio_base + INTEL_MID_IRQ_OFFSET;
        } else {
diff --git a/arch/x86/platform/intel-mid/early_printk_intel_mid.c b/arch/x86/platform/intel-mid/early_printk_intel_mid.c
index 4f702f554f6e..e0bd082a80e0 100644
--- a/arch/x86/platform/intel-mid/early_printk_intel_mid.c
+++ b/arch/x86/platform/intel-mid/early_printk_intel_mid.c
@@ -22,7 +22,6 @@
 #include <linux/console.h>
 #include <linux/kernel.h>
 #include <linux/delay.h>
-#include <linux/init.h>
 #include <linux/io.h>
 #include <asm/fixmap.h>
diff --git a/arch/x86/platform/intel-mid/intel-mid.c b/arch/x86/platform/intel-mid/intel-mid.c
index f90e290f689f..1bbedc4b0f88 100644
--- a/arch/x86/platform/intel-mid/intel-mid.c
+++ b/arch/x86/platform/intel-mid/intel-mid.c
@@ -35,6 +35,8 @@
 #include <asm/apb_timer.h>
 #include <asm/reboot.h>
+#include "intel_mid_weak_decls.h"
 /*
 * the clockevent devices on Moorestown/Medfield can be APBT or LAPIC clock,
 * cmdline option x86_intel_mid_timer can be used to override the configuration
@@ -58,12 +60,16 @@
 enum intel_mid_timer_options intel_mid_timer_options;
+/* intel_mid_ops to store sub arch ops */
+struct intel_mid_ops *intel_mid_ops;
+/* getter function for sub arch ops*/
+static void *(*get_intel_mid_ops[])(void) = INTEL_MID_OPS_INIT;
 enum intel_mid_cpu_type __intel_mid_cpu_chip;
 EXPORT_SYMBOL_GPL(__intel_mid_cpu_chip);
 static void intel_mid_power_off(void)
 {
-}
+};
 static void intel_mid_reboot(void)
 {
@@ -72,32 +78,6 @@ static void intel_mid_reboot(void)
 static unsigned long __init intel_mid_calibrate_tsc(void)
 {
-        unsigned long fast_calibrate;
-        u32 lo, hi, ratio, fsb;
-        rdmsr(MSR_IA32_PERF_STATUS, lo, hi);
-        pr_debug("IA32 perf status is 0x%x, 0x%0x\n", lo, hi);
-        ratio = (hi >> 8) & 0x1f;
-        pr_debug("ratio is %d\n", ratio);
-        if (!ratio) {
-                pr_err("read a zero ratio, should be incorrect!\n");
-                pr_err("force tsc ratio to 16 ...\n");
-                ratio = 16;
-        }
-        rdmsr(MSR_FSB_FREQ, lo, hi);
-        if ((lo & 0x7) == 0x7)
-                fsb = PENWELL_FSB_FREQ_83SKU;
-        else
-                fsb = PENWELL_FSB_FREQ_100SKU;
-        fast_calibrate = ratio * fsb;
-        pr_debug("read penwell tsc %lu khz\n", fast_calibrate);
-        lapic_timer_frequency = fsb * 1000 / HZ;
-        /* mark tsc clocksource as reliable */
-        set_cpu_cap(&boot_cpu_data, X86_FEATURE_TSC_RELIABLE);
-        if (fast_calibrate)
-                return fast_calibrate;
        return 0;
 }
@@ -125,13 +105,37 @@ static void __init intel_mid_time_init(void)
 static void intel_mid_arch_setup(void)
 {
-        if (boot_cpu_data.x86 == 6 && boot_cpu_data.x86_model == 0x27)
+        if (boot_cpu_data.x86 != 6) {
-                __intel_mid_cpu_chip = INTEL_MID_CPU_CHIP_PENWELL;
-        else {
                pr_err("Unknown Intel MID CPU (%d:%d), default to Penwell\n",
                        boot_cpu_data.x86, boot_cpu_data.x86_model);
                __intel_mid_cpu_chip = INTEL_MID_CPU_CHIP_PENWELL;
+                goto out;
        }
+        switch (boot_cpu_data.x86_model) {
+        case 0x35:
+                __intel_mid_cpu_chip = INTEL_MID_CPU_CHIP_CLOVERVIEW;
+                break;
+        case 0x3C:
+        case 0x4A:
+                __intel_mid_cpu_chip = INTEL_MID_CPU_CHIP_TANGIER;
+                break;
+        case 0x27:
+        default:
+                __intel_mid_cpu_chip = INTEL_MID_CPU_CHIP_PENWELL;
+                break;
+        }
+        if (__intel_mid_cpu_chip < MAX_CPU_OPS(get_intel_mid_ops))
+                intel_mid_ops = get_intel_mid_ops[__intel_mid_cpu_chip]();
+        else {
+                intel_mid_ops = get_intel_mid_ops[INTEL_MID_CPU_CHIP_PENWELL]();
+                pr_info("ARCH: Uknown SoC, assuming PENWELL!\n");
+        }
+out:
+        if (intel_mid_ops->arch_setup)
+                intel_mid_ops->arch_setup();
 }
 /* MID systems don't have i8042 controller */
diff --git a/arch/x86/platform/intel-mid/intel_mid_weak_decls.h b/arch/x86/platform/intel-mid/intel_mid_weak_decls.h
new file mode 100644
index 000000000000..a537ffc16299
--- /dev/null
+++ b/arch/x86/platform/intel-mid/intel_mid_weak_decls.h
@@ -0,0 +1,19 @@
+/*
+ * intel_mid_weak_decls.h: Weak declarations of intel-mid.c
+ *
+ * (C) Copyright 2013 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2
+ * of the License.
+ */
+/* __attribute__((weak)) makes these declarations overridable */
+/* For every CPU addition a new get_<cpuname>_ops interface needs
+ * to be added.
+ */
+extern void * __cpuinit get_penwell_ops(void) __attribute__((weak));
+extern void * __cpuinit get_cloverview_ops(void) __attribute__((weak));
+extern void * __init get_tangier_ops(void) __attribute__((weak));
diff --git a/arch/x86/platform/intel-mid/mfld.c b/arch/x86/platform/intel-mid/mfld.c
new file mode 100644
index 000000000000..4f7884eebc14
--- /dev/null
+++ b/arch/x86/platform/intel-mid/mfld.c
@@ -0,0 +1,75 @@
+/*
+ * mfld.c: Intel Medfield platform setup code
+ *
+ * (C) Copyright 2013 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2
+ * of the License.
+ */
+#include <linux/init.h>
+#include <asm/apic.h>
+#include <asm/intel-mid.h>
+#include <asm/intel_mid_vrtc.h>
+#include "intel_mid_weak_decls.h"
+static void penwell_arch_setup(void);
+/* penwell arch ops */
+static struct intel_mid_ops penwell_ops = {
+        .arch_setup = penwell_arch_setup,
+};
+static void mfld_power_off(void)
+{
+}
+static unsigned long __init mfld_calibrate_tsc(void)
+{
+        unsigned long fast_calibrate;
+        u32 lo, hi, ratio, fsb;
+        rdmsr(MSR_IA32_PERF_STATUS, lo, hi);
+        pr_debug("IA32 perf status is 0x%x, 0x%0x\n", lo, hi);
+        ratio = (hi >> 8) & 0x1f;
+        pr_debug("ratio is %d\n", ratio);
+        if (!ratio) {
+                pr_err("read a zero ratio, should be incorrect!\n");
+                pr_err("force tsc ratio to 16 ...\n");
+                ratio = 16;
+        }
+        rdmsr(MSR_FSB_FREQ, lo, hi);
+        if ((lo & 0x7) == 0x7)
+                fsb = FSB_FREQ_83SKU;
+        else
+                fsb = FSB_FREQ_100SKU;
+        fast_calibrate = ratio * fsb;
+        pr_debug("read penwell tsc %lu khz\n", fast_calibrate);
+        lapic_timer_frequency = fsb * 1000 / HZ;
+        /* mark tsc clocksource as reliable */
+        set_cpu_cap(&boot_cpu_data, X86_FEATURE_TSC_RELIABLE);
+        if (fast_calibrate)
+                return fast_calibrate;
+        return 0;
+}
+static void __init penwell_arch_setup()
+{
+        x86_platform.calibrate_tsc = mfld_calibrate_tsc;
+        pm_power_off = mfld_power_off;
+}
+void * __cpuinit get_penwell_ops()
+{
+        return &penwell_ops;
+}
+void * __cpuinit get_cloverview_ops()
+{
+        return &penwell_ops;
+}
diff --git a/arch/x86/platform/intel-mid/mrfl.c b/arch/x86/platform/intel-mid/mrfl.c
new file mode 100644
index 000000000000..09d10159e7b7
--- /dev/null
+++ b/arch/x86/platform/intel-mid/mrfl.c
@@ -0,0 +1,103 @@
+/*
+ * mrfl.c: Intel Merrifield platform specific setup code
+ *
+ * (C) Copyright 2013 Intel Corporation
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; version 2
+ * of the License.
+ */
+#include <linux/init.h>
+#include <asm/apic.h>
+#include <asm/intel-mid.h>
+#include "intel_mid_weak_decls.h"
+static unsigned long __init tangier_calibrate_tsc(void)
+{
+        unsigned long fast_calibrate;
+        u32 lo, hi, ratio, fsb, bus_freq;
+        /* *********************** */
+        /* Compute TSC:Ratio * FSB */
+        /* *********************** */
+        /* Compute Ratio */
+        rdmsr(MSR_PLATFORM_INFO, lo, hi);
+        pr_debug("IA32 PLATFORM_INFO is 0x%x : %x\n", hi, lo);
+        ratio = (lo >> 8) & 0xFF;
+        pr_debug("ratio is %d\n", ratio);
+        if (!ratio) {
+                pr_err("Read a zero ratio, force tsc ratio to 4 ...\n");
+                ratio = 4;
+        }
+        /* Compute FSB */
+        rdmsr(MSR_FSB_FREQ, lo, hi);
+        pr_debug("Actual FSB frequency detected by SOC 0x%x : %x\n",
+                        hi, lo);
+        bus_freq = lo & 0x7;
+        pr_debug("bus_freq = 0x%x\n", bus_freq);
+        if (bus_freq == 0)
+                fsb = FSB_FREQ_100SKU;
+        else if (bus_freq == 1)
+                fsb = FSB_FREQ_100SKU;
+        else if (bus_freq == 2)
+                fsb = FSB_FREQ_133SKU;
+        else if (bus_freq == 3)
+                fsb = FSB_FREQ_167SKU;
+        else if (bus_freq == 4)
+                fsb = FSB_FREQ_83SKU;
+        else if (bus_freq == 5)
+                fsb = FSB_FREQ_400SKU;
+        else if (bus_freq == 6)
+                fsb = FSB_FREQ_267SKU;
+        else if (bus_freq == 7)
+                fsb = FSB_FREQ_333SKU;
+        else {
+                BUG();
+                pr_err("Invalid bus_freq! Setting to minimal value!\n");
+                fsb = FSB_FREQ_100SKU;
+        }
+        /* TSC = FSB Freq * Resolved HFM Ratio */
+        fast_calibrate = ratio * fsb;
+        pr_debug("calculate tangier tsc %lu KHz\n", fast_calibrate);
+        /* ************************************ */
+        /* Calculate Local APIC Timer Frequency */
+        /* ************************************ */
+        lapic_timer_frequency = (fsb * 1000) / HZ;
+        pr_debug("Setting lapic_timer_frequency = %d\n",
+                        lapic_timer_frequency);
+        /* mark tsc clocksource as reliable */
+        set_cpu_cap(&boot_cpu_data, X86_FEATURE_TSC_RELIABLE);
+        if (fast_calibrate)
+                return fast_calibrate;
+        return 0;
+}
+static void __init tangier_arch_setup(void)
+{
+        x86_platform.calibrate_tsc = tangier_calibrate_tsc;
+}
+/* tangier arch ops */
+static struct intel_mid_ops tangier_ops = {
+        .arch_setup = tangier_arch_setup,
+};
+void * __cpuinit get_tangier_ops()
+{
+        return &tangier_ops;
+}
diff --git a/arch/x86/platform/intel-mid/sfi.c b/arch/x86/platform/intel-mid/sfi.c
index c84c1ca396bf..994c40bd7cb7 100644
--- a/arch/x86/platform/intel-mid/sfi.c
+++ b/arch/x86/platform/intel-mid/sfi.c
@@ -224,7 +224,7 @@ int get_gpio_by_name(const char *name)
                if (!strncmp(name, pentry->pin_name, SFI_NAME_LEN))
                        return pentry->pin_no;
        }
-        return -1;
+        return -EINVAL;
 }
 void __init intel_scu_device_register(struct platform_device *pdev)
@@ -250,7 +250,7 @@ static void __init intel_scu_spi_device_register(struct spi_board_info *sdev)
                        sdev->modalias);
                return;
        }
-        memcpy(new_dev, sdev, sizeof(*sdev));
+        *new_dev = *sdev;
        spi_devs[spi_next_dev++] = new_dev;
 }
@@ -271,7 +271,7 @@ static void __init intel_scu_i2c_device_register(int bus,
                        idev->type);
                return;
        }
-        memcpy(new_dev, idev, sizeof(*idev));
+        *new_dev = *idev;
        i2c_bus[i2c_next_dev] = bus;
        i2c_devs[i2c_next_dev++] = new_dev;
@@ -337,6 +337,8 @@ static void __init sfi_handle_ipc_dev(struct sfi_device_table_entry *pentry,
        pr_debug("IPC bus, name = %16.16s, irq = 0x%2x\n",
                pentry->name, pentry->irq);
        pdata = intel_mid_sfi_get_pdata(dev, pentry);
+        if (IS_ERR(pdata))
+                return;
        pdev = platform_device_alloc(pentry->name, 0);
        if (pdev == NULL) {
@@ -370,6 +372,8 @@ static void __init sfi_handle_spi_dev(struct sfi_device_table_entry *pentry,
                spi_info.chip_select);
        pdata = intel_mid_sfi_get_pdata(dev, &spi_info);
+        if (IS_ERR(pdata))
+                return;
        spi_info.platform_data = pdata;
        if (dev->delay)
@@ -395,6 +399,8 @@ static void __init sfi_handle_i2c_dev(struct sfi_device_table_entry *pentry,
                i2c_info.addr);
        pdata = intel_mid_sfi_get_pdata(dev, &i2c_info);
        i2c_info.platform_data = pdata;
+        if (IS_ERR(pdata))
+                return;
        if (dev->delay)
                intel_scu_i2c_device_register(pentry->host_num, &i2c_info);
@@ -443,13 +449,35 @@ static int __init sfi_parse_devs(struct sfi_table_header *table)
                         * so we have to enable them one by one here
                         */
                        ioapic = mp_find_ioapic(irq);
-                        irq_attr.ioapic = ioapic;
+                        if (ioapic >= 0) {
-                        irq_attr.ioapic_pin = irq;
+                                irq_attr.ioapic = ioapic;
-                        irq_attr.trigger = 1;
+                                irq_attr.ioapic_pin = irq;
-                        irq_attr.polarity = 1;
+                                irq_attr.trigger = 1;
-                        io_apic_set_pci_routing(NULL, irq, &irq_attr);
+                                if (intel_mid_identify_cpu() ==
-                } else
+                                                INTEL_MID_CPU_CHIP_TANGIER) {
+                                        if (!strncmp(pentry->name,
+                                                        "r69001-ts-i2c", 13))
+                                                /* active low */
+                                                irq_attr.polarity = 1;
+                                        else if (!strncmp(pentry->name,
+                                                        "synaptics_3202", 14))
+                                                /* active low */
+                                                irq_attr.polarity = 1;
+                                        else if (irq == 41)
+                                                /* fast_int_1 */
+                                                irq_attr.polarity = 1;
+                                        else
+                                                /* active high */
+                                                irq_attr.polarity = 0;
+                                } else {
+                                        /* PNW and CLV go with active low */
+                                        irq_attr.polarity = 1;
+                                }
+                                io_apic_set_pci_routing(NULL, irq, &irq_attr);
+                        }
+                } else {
                        irq = 0; /* No irq */
+                }
                dev = get_device_id(pentry->type, pentry->name);
diff --git a/arch/x86/platform/iris/iris.c b/arch/x86/platform/iris/iris.c
index e6cb80f620af..4d171e8640ef 100644
--- a/arch/x86/platform/iris/iris.c
+++ b/arch/x86/platform/iris/iris.c
@@ -27,7 +27,6 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/delay.h>
-#include <linux/init.h>
 #include <linux/pm.h>
 #include <asm/io.h>
diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c
index efe4d7220397..dfe605ac1bcd 100644
--- a/arch/x86/platform/uv/tlb_uv.c
+++ b/arch/x86/platform/uv/tlb_uv.c
@@ -433,15 +433,49 @@ static void reset_with_ipi(struct pnmask *distribution, struct bau_control *bcp)
        return;
 }
-static inline unsigned long cycles_2_us(unsigned long long cyc)
+/*
+ * Not to be confused with cycles_2_ns() from tsc.c; this gives a relative
+ * number, not an absolute. It converts a duration in cycles to a duration in
+ * ns.
+ */
+static inline unsigned long long cycles_2_ns(unsigned long long cyc)
 {
+        struct cyc2ns_data *data = cyc2ns_read_begin();
        unsigned long long ns;
-        unsigned long us;
-        int cpu = smp_processor_id();
-        ns =  (cyc * per_cpu(cyc2ns, cpu)) >> CYC2NS_SCALE_FACTOR;
+        ns = mul_u64_u32_shr(cyc, data->cyc2ns_mul, data->cyc2ns_shift);
-        us = ns / 1000;
-        return us;
+        cyc2ns_read_end(data);
+        return ns;
+}
+/*
+ * The reverse of the above; converts a duration in ns to a duration in cycles.
+ */ 
+static inline unsigned long long ns_2_cycles(unsigned long long ns)
+{
+        struct cyc2ns_data *data = cyc2ns_read_begin();
+        unsigned long long cyc;
+        cyc = (ns << data->cyc2ns_shift) / data->cyc2ns_mul;
+        cyc2ns_read_end(data);
+        return cyc;
+}
+static inline unsigned long cycles_2_us(unsigned long long cyc)
+{
+        return cycles_2_ns(cyc) / NSEC_PER_USEC;
+}
+static inline cycles_t sec_2_cycles(unsigned long sec)
+{
+        return ns_2_cycles(sec * NSEC_PER_SEC);
+}
+static inline unsigned long long usec_2_cycles(unsigned long usec)
+{
+        return ns_2_cycles(usec * NSEC_PER_USEC);
 }
 /*
@@ -668,16 +702,6 @@ static int wait_completion(struct bau_desc *bau_desc,
                                                                bcp, try);
 }
-static inline cycles_t sec_2_cycles(unsigned long sec)
-{
-        unsigned long ns;
-        cycles_t cyc;
-        ns = sec * 1000000000;
-        cyc = (ns << CYC2NS_SCALE_FACTOR)/(per_cpu(cyc2ns, smp_processor_id()));
-        return cyc;
-}
 /*
 * Our retries are blocked by all destination sw ack resources being
 * in use, and a timeout is pending. In that case hardware immediately
@@ -1327,16 +1351,6 @@ static void ptc_seq_stop(struct seq_file *file, void *data)
 {
 }
-static inline unsigned long long usec_2_cycles(unsigned long microsec)
-{
-        unsigned long ns;
-        unsigned long long cyc;
-        ns = microsec * 1000;
-        cyc = (ns << CYC2NS_SCALE_FACTOR)/(per_cpu(cyc2ns, smp_processor_id()));
-        return cyc;
-}
 /*
 * Display the statistics thru /proc/sgi_uv/ptc_statistics
 * 'data' points to the cpu number
diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c
index a44f457e70a1..bad628a620c4 100644
--- a/arch/x86/realmode/init.c
+++ b/arch/x86/realmode/init.c
@@ -29,12 +29,10 @@ void __init reserve_real_mode(void)
 void __init setup_real_mode(void)
 {
        u16 real_mode_seg;
-        u32 *rel;
+        const u32 *rel;
        u32 count;
-        u32 *ptr;
-        u16 *seg;
-        int i;
        unsigned char *base;
+        unsigned long phys_base;
        struct trampoline_header *trampoline_header;
        size_t size = PAGE_ALIGN(real_mode_blob_end - real_mode_blob);
 #ifdef CONFIG_X86_64
@@ -46,23 +44,23 @@ void __init setup_real_mode(void)
        memcpy(base, real_mode_blob, size);
-        real_mode_seg = __pa(base) >> 4;
+        phys_base = __pa(base);
+        real_mode_seg = phys_base >> 4;
        rel = (u32 *) real_mode_relocs;
        /* 16-bit segment relocations. */
-        count = rel[0];
+        count = *rel++;
-        rel = &rel[1];
+        while (count--) {
-        for (i = 0; i < count; i++) {
+                u16 *seg = (u16 *) (base + *rel++);
-                seg = (u16 *) (base + rel[i]);
                *seg = real_mode_seg;
        }
        /* 32-bit linear relocations. */
-        count = rel[i];
+        count = *rel++;
-        rel =  &rel[i + 1];
+        while (count--) {
-        for (i = 0; i < count; i++) {
+                u32 *ptr = (u32 *) (base + *rel++);
-                ptr = (u32 *) (base + rel[i]);
+                *ptr += phys_base;
-                *ptr += __pa(base);
        }
        /* Must be perfomed *after* relocation. */
diff --git a/arch/x86/realmode/rm/reboot.S b/arch/x86/realmode/rm/reboot.S
index f932ea61d1c8..d66c607bdc58 100644
--- a/arch/x86/realmode/rm/reboot.S
+++ b/arch/x86/realmode/rm/reboot.S
@@ -1,5 +1,4 @@
 #include <linux/linkage.h>
-#include <linux/init.h>
 #include <asm/segment.h>
 #include <asm/page_types.h>
 #include <asm/processor-flags.h>
diff --git a/arch/x86/realmode/rm/trampoline_32.S b/arch/x86/realmode/rm/trampoline_32.S
index c1b2791183e7..48ddd76bc4c3 100644
--- a/arch/x86/realmode/rm/trampoline_32.S
+++ b/arch/x86/realmode/rm/trampoline_32.S
@@ -20,7 +20,6 @@
 */
 #include <linux/linkage.h>
-#include <linux/init.h>
 #include <asm/segment.h>
 #include <asm/page_types.h>
 #include "realmode.h"
diff --git a/arch/x86/realmode/rm/trampoline_64.S b/arch/x86/realmode/rm/trampoline_64.S
index bb360dc39d21..dac7b20d2f9d 100644
--- a/arch/x86/realmode/rm/trampoline_64.S
+++ b/arch/x86/realmode/rm/trampoline_64.S
@@ -25,7 +25,6 @@
 */
 #include <linux/linkage.h>
-#include <linux/init.h>
 #include <asm/pgtable_types.h>
 #include <asm/page_types.h>
 #include <asm/msr.h>
diff --git a/arch/x86/syscalls/syscall_32.tbl b/arch/x86/syscalls/syscall_32.tbl
index aabfb8380a1c..96bc506ac6de 100644
--- a/arch/x86/syscalls/syscall_32.tbl
+++ b/arch/x86/syscalls/syscall_32.tbl
@@ -357,3 +357,5 @@
 348     i386    process_vm_writev       sys_process_vm_writev           compat_sys_process_vm_writev
 349     i386    kcmp                    sys_kcmp
 350     i386    finit_module            sys_finit_module
+351     i386    sched_setattr           sys_sched_setattr
+352     i386    sched_getattr           sys_sched_getattr
diff --git a/arch/x86/syscalls/syscall_64.tbl b/arch/x86/syscalls/syscall_64.tbl
index 38ae65dfd14f..a12bddc7ccea 100644
--- a/arch/x86/syscalls/syscall_64.tbl
+++ b/arch/x86/syscalls/syscall_64.tbl
@@ -320,6 +320,8 @@
 311     64      process_vm_writev       sys_process_vm_writev
 312     common  kcmp                    sys_kcmp
 313     common  finit_module            sys_finit_module
+314     common  sched_setattr           sys_sched_setattr
+315     common  sched_getattr           sys_sched_getattr
 #
 # x32-specific system call numbers start at 512 to avoid cache impact
diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
index f7bab68a4b83..11f9285a2ff6 100644
--- a/arch/x86/tools/relocs.c
+++ b/arch/x86/tools/relocs.c
@@ -722,15 +722,25 @@ static void percpu_init(void)
 /*
 * Check to see if a symbol lies in the .data..percpu section.
- * For some as yet not understood reason the "__init_begin"
+ *
- * symbol which immediately preceeds the .data..percpu section
+ * The linker incorrectly associates some symbols with the
- * also shows up as it it were part of it so we do an explict
+ * .data..percpu section so we also need to check the symbol
- * check for that symbol name and ignore it.
+ * name to make sure that we classify the symbol correctly.
+ *
+ * The GNU linker incorrectly associates:
+ *      __init_begin
+ *      __per_cpu_load
+ *
+ * The "gold" linker incorrectly associates:
+ *      init_per_cpu__irq_stack_union
+ *      init_per_cpu__gdt_page
 */
 static int is_percpu_sym(ElfW(Sym) *sym, const char *symname)
 {
        return (sym->st_shndx == per_cpu_shndx) &&
-                strcmp(symname, "__init_begin");
+                strcmp(symname, "__init_begin") &&
+                strcmp(symname, "__per_cpu_load") &&
+                strncmp(symname, "init_per_cpu_", 13);
 }
diff --git a/arch/x86/vdso/vclock_gettime.c b/arch/x86/vdso/vclock_gettime.c
index 2ada505067cc..eb5d7a56f8d4 100644
--- a/arch/x86/vdso/vclock_gettime.c
+++ b/arch/x86/vdso/vclock_gettime.c
@@ -178,7 +178,7 @@ notrace static int __always_inline do_realtime(struct timespec *ts)
        ts->tv_nsec = 0;
        do {
-                seq = read_seqcount_begin_no_lockdep(&gtod->seq);
+                seq = raw_read_seqcount_begin(&gtod->seq);
                mode = gtod->clock.vclock_mode;
                ts->tv_sec = gtod->wall_time_sec;
                ns = gtod->wall_time_snsec;
@@ -198,7 +198,7 @@ notrace static int do_monotonic(struct timespec *ts)
        ts->tv_nsec = 0;
        do {
-                seq = read_seqcount_begin_no_lockdep(&gtod->seq);
+                seq = raw_read_seqcount_begin(&gtod->seq);
                mode = gtod->clock.vclock_mode;
                ts->tv_sec = gtod->monotonic_time_sec;
                ns = gtod->monotonic_time_snsec;
@@ -214,7 +214,7 @@ notrace static int do_realtime_coarse(struct timespec *ts)
 {
        unsigned long seq;
        do {
-                seq = read_seqcount_begin_no_lockdep(&gtod->seq);
+                seq = raw_read_seqcount_begin(&gtod->seq);
                ts->tv_sec = gtod->wall_time_coarse.tv_sec;
                ts->tv_nsec = gtod->wall_time_coarse.tv_nsec;
        } while (unlikely(read_seqcount_retry(&gtod->seq, seq)));
@@ -225,7 +225,7 @@ notrace static int do_monotonic_coarse(struct timespec *ts)
 {
        unsigned long seq;
        do {
-                seq = read_seqcount_begin_no_lockdep(&gtod->seq);
+                seq = raw_read_seqcount_begin(&gtod->seq);
                ts->tv_sec = gtod->monotonic_time_coarse.tv_sec;
                ts->tv_nsec = gtod->monotonic_time_coarse.tv_nsec;
        } while (unlikely(read_seqcount_retry(&gtod->seq, seq)));
diff --git a/arch/x86/vdso/vdso.S b/arch/x86/vdso/vdso.S
index 01f5e3b4613c..1e13eb8c9656 100644
--- a/arch/x86/vdso/vdso.S
+++ b/arch/x86/vdso/vdso.S
@@ -1,6 +1,5 @@
 #include <asm/page_types.h>
 #include <linux/linkage.h>
-#include <linux/init.h>
 __PAGE_ALIGNED_DATA
diff --git a/arch/x86/vdso/vdsox32.S b/arch/x86/vdso/vdsox32.S
index d6b9a7f42a8a..295f1c7543d8 100644
--- a/arch/x86/vdso/vdsox32.S
+++ b/arch/x86/vdso/vdsox32.S
@@ -1,6 +1,5 @@
 #include <asm/page_types.h>
 #include <linux/linkage.h>
-#include <linux/init.h>
 __PAGE_ALIGNED_DATA
diff --git a/arch/xtensa/include/asm/barrier.h b/arch/xtensa/include/asm/barrier.h
index ef021677d536..e1ee6b51dfc5 100644
--- a/arch/xtensa/include/asm/barrier.h
+++ b/arch/xtensa/include/asm/barrier.h
@@ -9,21 +9,14 @@
 #ifndef _XTENSA_SYSTEM_H
 #define _XTENSA_SYSTEM_H
-#define smp_read_barrier_depends() do { } while(0)
-#define read_barrier_depends() do { } while(0)
 #define mb()  ({ __asm__ __volatile__("memw" : : : "memory"); })
 #define rmb() barrier()
 #define wmb() mb()
 #ifdef CONFIG_SMP
 #error smp_* not defined
-#else
-#define smp_mb()        barrier()
-#define smp_rmb()       barrier()
-#define smp_wmb()       barrier()
 #endif
-#define set_mb(var, value)      do { var = value; mb(); } while (0)
+#include <asm-generic/barrier.h>
 #endif /* _XTENSA_SYSTEM_H */
diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index ba6cf8e9aa0a..b91ce75bd35d 100644
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -335,9 +335,22 @@ static struct kobj_type blk_mq_hw_ktype = {
 void blk_mq_unregister_disk(struct gendisk *disk)
 {
        struct request_queue *q = disk->queue;
+        struct blk_mq_hw_ctx *hctx;
+        struct blk_mq_ctx *ctx;
+        int i, j;
+        queue_for_each_hw_ctx(q, hctx, i) {
+                hctx_for_each_ctx(hctx, ctx, j) {
+                        kobject_del(&ctx->kobj);
+                        kobject_put(&ctx->kobj);
+                }
+                kobject_del(&hctx->kobj);
+                kobject_put(&hctx->kobj);
+        }
        kobject_uevent(&q->mq_kobj, KOBJ_REMOVE);
        kobject_del(&q->mq_kobj);
+        kobject_put(&q->mq_kobj);
        kobject_put(&disk_to_dev(disk)->kobj);
 }
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index 5d9248526d78..4770de5707b9 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -348,7 +348,6 @@ source "drivers/acpi/apei/Kconfig"
 config ACPI_EXTLOG
        tristate "Extended Error Log support"
        depends on X86_MCE && X86_LOCAL_APIC
-        select EFI
        select UEFI_CPER
        default n
        help
diff --git a/drivers/acpi/ac.c b/drivers/acpi/ac.c
index 8711e3797165..3c2e4aa529c4 100644
--- a/drivers/acpi/ac.c
+++ b/drivers/acpi/ac.c
@@ -207,7 +207,7 @@ static int acpi_ac_probe(struct platform_device *pdev)
                goto end;
        result = acpi_install_notify_handler(ACPI_HANDLE(&pdev->dev),
-                        ACPI_DEVICE_NOTIFY, acpi_ac_notify_handler, ac);
+                        ACPI_ALL_NOTIFY, acpi_ac_notify_handler, ac);
        if (result) {
                power_supply_unregister(&ac->charger);
                goto end;
@@ -255,7 +255,7 @@ static int acpi_ac_remove(struct platform_device *pdev)
                return -EINVAL;
        acpi_remove_notify_handler(ACPI_HANDLE(&pdev->dev),
-                        ACPI_DEVICE_NOTIFY, acpi_ac_notify_handler);
+                        ACPI_ALL_NOTIFY, acpi_ac_notify_handler);
        ac = platform_get_drvdata(pdev);
        if (ac->charger.dev)
diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c
index a6869e110ce5..5d33c5415405 100644
--- a/drivers/acpi/acpi_extlog.c
+++ b/drivers/acpi/acpi_extlog.c
@@ -12,6 +12,7 @@
 #include <acpi/acpi_bus.h>
 #include <linux/cper.h>
 #include <linux/ratelimit.h>
+#include <linux/edac.h>
 #include <asm/cpu.h>
 #include <asm/mce.h>
@@ -43,6 +44,8 @@ struct extlog_l1_head {
        u8  rev1[12];
 };
+static int old_edac_report_status;
 static u8 extlog_dsm_uuid[] = "663E35AF-CC10-41A4-88EA-5470AF055295";
 /* L1 table related physical address */
@@ -150,7 +153,7 @@ static int extlog_print(struct notifier_block *nb, unsigned long val,
        rc = print_extlog_rcd(NULL, (struct acpi_generic_status *)elog_buf, cpu);
-        return NOTIFY_DONE;
+        return NOTIFY_STOP;
 }
 static int extlog_get_dsm(acpi_handle handle, int rev, int func, u64 *ret)
@@ -231,8 +234,12 @@ static int __init extlog_init(void)
        u64 cap;
        int rc;
-        rc = -ENODEV;
+        if (get_edac_report_status() == EDAC_REPORTING_FORCE) {
+                pr_warn("Not loading eMCA, error reporting force-enabled through EDAC.\n");
+                return -EPERM;
+        }
+        rc = -ENODEV;
        rdmsrl(MSR_IA32_MCG_CAP, cap);
        if (!(cap & MCG_ELOG_P))
                return rc;
@@ -287,6 +294,12 @@ static int __init extlog_init(void)
        if (elog_buf == NULL)
                goto err_release_elog;
+        /*
+         * eMCA event report method has higher priority than EDAC method,
+         * unless EDAC event report method is mandatory.
+         */
+        old_edac_report_status = get_edac_report_status();
+        set_edac_report_status(EDAC_REPORTING_DISABLED);
        mce_register_decode_chain(&extlog_mce_dec);
        /* enable OS to be involved to take over management from BIOS */
        ((struct extlog_l1_head *)extlog_l1_addr)->flags |= FLAG_OS_OPTIN;
@@ -308,6 +321,7 @@ err:
 static void __exit extlog_exit(void)
 {
+        set_edac_report_status(old_edac_report_status);
        mce_unregister_decode_chain(&extlog_mce_dec);
        ((struct extlog_l1_head *)extlog_l1_addr)->flags &= ~FLAG_OS_OPTIN;
        if (extlog_l1_addr)
diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
index fc6008fbce35..509452a62f96 100644
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -193,10 +193,7 @@ static int power_saving_thread(void *data)
                                        CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu);
                        stop_critical_timings();
-                        __monitor((void *)&current_thread_info()->flags, 0, 0);
+                        mwait_idle_with_hints(power_saving_mwait_eax, 1);
-                        smp_mb();
-                        if (!need_resched())
-                                __mwait(power_saving_mwait_eax, 1);
                        start_critical_timings();
                        if (lapic_marked_unstable)
diff --git a/drivers/acpi/apei/Kconfig b/drivers/acpi/apei/Kconfig
index 786294bb682c..3650b2183227 100644
--- a/drivers/acpi/apei/Kconfig
+++ b/drivers/acpi/apei/Kconfig
@@ -2,7 +2,6 @@ config ACPI_APEI
        bool "ACPI Platform Error Interface (APEI)"
        select MISC_FILESYSTEMS
        select PSTORE
-        select EFI
        select UEFI_CPER
        depends on X86
        help
diff --git a/drivers/acpi/apei/apei-base.c b/drivers/acpi/apei/apei-base.c
index 6d2c49b86b7f..e55584a072c6 100644
--- a/drivers/acpi/apei/apei-base.c
+++ b/drivers/acpi/apei/apei-base.c
@@ -41,6 +41,7 @@
 #include <linux/rculist.h>
 #include <linux/interrupt.h>
 #include <linux/debugfs.h>
+#include <asm/unaligned.h>
 #include "apei-internal.h"
@@ -567,8 +568,7 @@ static int apei_check_gar(struct acpi_generic_address *reg, u64 *paddr,
        bit_offset = reg->bit_offset;
        access_size_code = reg->access_width;
        space_id = reg->space_id;
-        /* Handle possible alignment issues */
+        *paddr = get_unaligned(&reg->address);
-        memcpy(paddr, &reg->address, sizeof(*paddr));
        if (!*paddr) {
                pr_warning(FW_BUG APEI_PFX
                           "Invalid physical address in GAR [0x%llx/%u/%u/%u/%u]\n",
diff --git a/drivers/acpi/apei/einj.c b/drivers/acpi/apei/einj.c
index fb57d03e698b..7dcc8a824aae 100644
--- a/drivers/acpi/apei/einj.c
+++ b/drivers/acpi/apei/einj.c
@@ -34,6 +34,7 @@
 #include <linux/delay.h>
 #include <linux/mm.h>
 #include <acpi/acpi.h>
+#include <asm/unaligned.h>
 #include "apei-internal.h"
@@ -216,7 +217,7 @@ static void check_vendor_extension(u64 paddr,
 static void *einj_get_parameter_address(void)
 {
        int i;
-        u64 paddrv4 = 0, paddrv5 = 0;
+        u64 pa_v4 = 0, pa_v5 = 0;
        struct acpi_whea_header *entry;
        entry = EINJ_TAB_ENTRY(einj_tab);
@@ -225,30 +226,28 @@ static void *einj_get_parameter_address(void)
                    entry->instruction == ACPI_EINJ_WRITE_REGISTER &&
                    entry->register_region.space_id ==
                    ACPI_ADR_SPACE_SYSTEM_MEMORY)
-                        memcpy(&paddrv4, &entry->register_region.address,
+                        pa_v4 = get_unaligned(&entry->register_region.address);
-                               sizeof(paddrv4));
                if (entry->action == ACPI_EINJ_SET_ERROR_TYPE_WITH_ADDRESS &&
                    entry->instruction == ACPI_EINJ_WRITE_REGISTER &&
                    entry->register_region.space_id ==
                    ACPI_ADR_SPACE_SYSTEM_MEMORY)
-                        memcpy(&paddrv5, &entry->register_region.address,
+                        pa_v5 = get_unaligned(&entry->register_region.address);
-                               sizeof(paddrv5));
                entry++;
        }
-        if (paddrv5) {
+        if (pa_v5) {
                struct set_error_type_with_address *v5param;
-                v5param = acpi_os_map_memory(paddrv5, sizeof(*v5param));
+                v5param = acpi_os_map_memory(pa_v5, sizeof(*v5param));
                if (v5param) {
                        acpi5 = 1;
-                        check_vendor_extension(paddrv5, v5param);
+                        check_vendor_extension(pa_v5, v5param);
                        return v5param;
                }
        }
-        if (param_extension && paddrv4) {
+        if (param_extension && pa_v4) {
                struct einj_parameter *v4param;
-                v4param = acpi_os_map_memory(paddrv4, sizeof(*v4param));
+                v4param = acpi_os_map_memory(pa_v4, sizeof(*v4param));
                if (!v4param)
                        return NULL;
                if (v4param->reserved1 || v4param->reserved2) {
@@ -416,7 +415,8 @@ out:
        return rc;
 }
-static int __einj_error_inject(u32 type, u64 param1, u64 param2)
+static int __einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2,
+                               u64 param3, u64 param4)
 {
        struct apei_exec_context ctx;
        u64 val, trigger_paddr, timeout = FIRMWARE_TIMEOUT;
@@ -446,6 +446,12 @@ static int __einj_error_inject(u32 type, u64 param1, u64 param2)
                                break;
                        }
                        v5param->flags = vendor_flags;
+                } else if (flags) {
+                                v5param->flags = flags;
+                                v5param->memory_address = param1;
+                                v5param->memory_address_range = param2;
+                                v5param->apicid = param3;
+                                v5param->pcie_sbdf = param4;
                } else {
                        switch (type) {
                        case ACPI_EINJ_PROCESSOR_CORRECTABLE:
@@ -514,11 +520,17 @@ static int __einj_error_inject(u32 type, u64 param1, u64 param2)
 }
 /* Inject the specified hardware error */
-static int einj_error_inject(u32 type, u64 param1, u64 param2)
+static int einj_error_inject(u32 type, u32 flags, u64 param1, u64 param2,
+                             u64 param3, u64 param4)
 {
        int rc;
        unsigned long pfn;
+        /* If user manually set "flags", make sure it is legal */
+        if (flags && (flags &
+                ~(SETWA_FLAGS_APICID|SETWA_FLAGS_MEM|SETWA_FLAGS_PCIE_SBDF)))
+                return -EINVAL;
        /*
         * We need extra sanity checks for memory errors.
         * Other types leap directly to injection.
@@ -532,7 +544,7 @@ static int einj_error_inject(u32 type, u64 param1, u64 param2)
        if (type & ACPI5_VENDOR_BIT) {
                if (vendor_flags != SETWA_FLAGS_MEM)
                        goto inject;
-        } else if (!(type & MEM_ERROR_MASK))
+        } else if (!(type & MEM_ERROR_MASK) && !(flags & SETWA_FLAGS_MEM))
                goto inject;
        /*
@@ -546,15 +558,18 @@ static int einj_error_inject(u32 type, u64 param1, u64 param2)
 inject:
        mutex_lock(&einj_mutex);
-        rc = __einj_error_inject(type, param1, param2);
+        rc = __einj_error_inject(type, flags, param1, param2, param3, param4);
        mutex_unlock(&einj_mutex);
        return rc;
 }
 static u32 error_type;
+static u32 error_flags;
 static u64 error_param1;
 static u64 error_param2;
+static u64 error_param3;
+static u64 error_param4;
 static struct dentry *einj_debug_dir;
 static int available_error_type_show(struct seq_file *m, void *v)
@@ -648,7 +663,8 @@ static int error_inject_set(void *data, u64 val)
        if (!error_type)
                return -EINVAL;
-        return einj_error_inject(error_type, error_param1, error_param2);
+        return einj_error_inject(error_type, error_flags, error_param1, error_param2,
+                error_param3, error_param4);
 }
 DEFINE_SIMPLE_ATTRIBUTE(error_inject_fops, NULL,
@@ -729,6 +745,10 @@ static int __init einj_init(void)
        rc = -ENOMEM;
        einj_param = einj_get_parameter_address();
        if ((param_extension || acpi5) && einj_param) {
+                fentry = debugfs_create_x32("flags", S_IRUSR | S_IWUSR,
+                                            einj_debug_dir, &error_flags);
+                if (!fentry)
+                        goto err_unmap;
                fentry = debugfs_create_x64("param1", S_IRUSR | S_IWUSR,
                                            einj_debug_dir, &error_param1);
                if (!fentry)
@@ -737,6 +757,14 @@ static int __init einj_init(void)
                                            einj_debug_dir, &error_param2);
                if (!fentry)
                        goto err_unmap;
+                fentry = debugfs_create_x64("param3", S_IRUSR | S_IWUSR,
+                                            einj_debug_dir, &error_param3);
+                if (!fentry)
+                        goto err_unmap;
+                fentry = debugfs_create_x64("param4", S_IRUSR | S_IWUSR,
+                                            einj_debug_dir, &error_param4);
+                if (!fentry)
+                        goto err_unmap;
                fentry = debugfs_create_x32("notrigger", S_IRUSR | S_IWUSR,
                                            einj_debug_dir, &notrigger);
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index cb1d557fc22c..ed65e9c4b5b0 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -611,7 +611,7 @@ static void __erst_record_id_cache_compact(void)
                if (entries[i] == APEI_ERST_INVALID_RECORD_ID)
                        continue;
                if (wpos != i)
-                        memcpy(&entries[wpos], &entries[i], sizeof(entries[i]));
+                        entries[wpos] = entries[i];
                wpos++;
        }
        erst_record_id_cache.len = wpos;
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index a30bc313787b..46766ef7ef5d 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -413,27 +413,31 @@ static void ghes_handle_memory_failure(struct acpi_generic_data *gdata, int sev)
 {
 #ifdef CONFIG_ACPI_APEI_MEMORY_FAILURE
        unsigned long pfn;
+        int flags = -1;
        int sec_sev = ghes_severity(gdata->error_severity);
        struct cper_sec_mem_err *mem_err;
        mem_err = (struct cper_sec_mem_err *)(gdata + 1);
-        if (sec_sev == GHES_SEV_CORRECTED &&
+        if (!(mem_err->validation_bits & CPER_MEM_VALID_PA))
-            (gdata->flags & CPER_SEC_ERROR_THRESHOLD_EXCEEDED) &&
+                return;
-            (mem_err->validation_bits & CPER_MEM_VALID_PA)) {
-                pfn = mem_err->physical_addr >> PAGE_SHIFT;
+        pfn = mem_err->physical_addr >> PAGE_SHIFT;
-                if (pfn_valid(pfn))
+        if (!pfn_valid(pfn)) {
-                        memory_failure_queue(pfn, 0, MF_SOFT_OFFLINE);
+                pr_warn_ratelimited(FW_WARN GHES_PFX
-                else if (printk_ratelimit())
+                "Invalid address in generic error data: %#llx\n",
-                        pr_warn(FW_WARN GHES_PFX
+                mem_err->physical_addr);
-                        "Invalid address in generic error data: %#llx\n",
+                return;
-                        mem_err->physical_addr);
-        }
-        if (sev == GHES_SEV_RECOVERABLE &&
-            sec_sev == GHES_SEV_RECOVERABLE &&
-            mem_err->validation_bits & CPER_MEM_VALID_PA) {
-                pfn = mem_err->physical_addr >> PAGE_SHIFT;
-                memory_failure_queue(pfn, 0, 0);
        }
+        /* iff following two events can be handled properly by now */
+        if (sec_sev == GHES_SEV_CORRECTED &&
+            (gdata->flags & CPER_SEC_ERROR_THRESHOLD_EXCEEDED))
+                flags = MF_SOFT_OFFLINE;
+        if (sev == GHES_SEV_RECOVERABLE && sec_sev == GHES_SEV_RECOVERABLE)
+                flags = 0;
+        if (flags != -1)
+                memory_failure_queue(pfn, 0, flags);
 #endif
 }
@@ -453,8 +457,7 @@ static void ghes_do_proc(struct ghes *ghes,
                        ghes_edac_report_mem_error(ghes, sev, mem_err);
 #ifdef CONFIG_X86_MCE
-                        apei_mce_report_mem_error(sev == GHES_SEV_CORRECTED,
+                        apei_mce_report_mem_error(sev, mem_err);
-                                                  mem_err);
 #endif
                        ghes_handle_memory_failure(gdata, sev);
                }
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index fbf1aceda8b8..5876a49dfd38 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -62,6 +62,7 @@ MODULE_AUTHOR("Alexey Starikovskiy <astarikovskiy@suse.de>");
 MODULE_DESCRIPTION("ACPI Battery Driver");
 MODULE_LICENSE("GPL");
+static int battery_bix_broken_package;
 static unsigned int cache_time = 1000;
 module_param(cache_time, uint, 0644);
 MODULE_PARM_DESC(cache_time, "cache time in milliseconds");
@@ -416,7 +417,12 @@ static int acpi_battery_get_info(struct acpi_battery *battery)
                ACPI_EXCEPTION((AE_INFO, status, "Evaluating %s", name));
                return -ENODEV;
        }
-        if (test_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags))
+        if (battery_bix_broken_package)
+                result = extract_package(battery, buffer.pointer,
+                                extended_info_offsets + 1,
+                                ARRAY_SIZE(extended_info_offsets) - 1);
+        else if (test_bit(ACPI_BATTERY_XINFO_PRESENT, &battery->flags))
                result = extract_package(battery, buffer.pointer,
                                extended_info_offsets,
                                ARRAY_SIZE(extended_info_offsets));
@@ -754,6 +760,17 @@ static int battery_notify(struct notifier_block *nb,
        return 0;
 }
+static struct dmi_system_id bat_dmi_table[] = {
+        {
+                .ident = "NEC LZ750/LS",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "NEC"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "PC-LZ750LS"),
+                },
+        },
+        {},
+};
 static int acpi_battery_add(struct acpi_device *device)
 {
        int result = 0;
@@ -846,6 +863,9 @@ static void __init acpi_battery_init_async(void *unused, async_cookie_t cookie)
 {
        if (acpi_disabled)
                return;
+        if (dmi_check_system(bat_dmi_table))
+                battery_bix_broken_package = 1;
        acpi_bus_register_driver(&acpi_battery_driver);
 }
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index bba9b72e25f8..0710004055c8 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -156,6 +156,16 @@ int acpi_bus_get_private_data(acpi_handle handle, void **data)
 }
 EXPORT_SYMBOL(acpi_bus_get_private_data);
+void acpi_bus_no_hotplug(acpi_handle handle)
+{
+        struct acpi_device *adev = NULL;
+        acpi_bus_get_device(handle, &adev);
+        if (adev)
+                adev->flags.no_hotplug = true;
+}
+EXPORT_SYMBOL_GPL(acpi_bus_no_hotplug);
 static void acpi_print_osc_error(acpi_handle handle,
        struct acpi_osc_context *context, char *error)
 {
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 644516d9bde6..f90c56c8379e 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -727,11 +727,6 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
        if (unlikely(!pr))
                return -EINVAL;
-        if (cx->entry_method == ACPI_CSTATE_FFH) {
-                if (current_set_polling_and_test())
-                        return -EINVAL;
-        }
        lapic_timer_state_broadcast(pr, cx, 1);
        acpi_idle_do_entry(cx);
@@ -785,11 +780,6 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
        if (unlikely(!pr))
                return -EINVAL;
-        if (cx->entry_method == ACPI_CSTATE_FFH) {
-                if (current_set_polling_and_test())
-                        return -EINVAL;
-        }
        /*
         * Must be done before busmaster disable as we might need to
         * access HPET !
@@ -841,11 +831,6 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
                }
        }
-        if (cx->entry_method == ACPI_CSTATE_FFH) {
-                if (current_set_polling_and_test())
-                        return -EINVAL;
-        }
        acpi_unlazy_tlb(smp_processor_id());
        /* Tell the scheduler that we are going deep-idle: */
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 14f1e9506338..e3a92a6da39a 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -427,6 +427,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
          .driver_data = board_ahci_yes_fbs },                  /* 88se9128 */
        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9125),
          .driver_data = board_ahci_yes_fbs },                  /* 88se9125 */
+        { PCI_DEVICE_SUB(PCI_VENDOR_ID_MARVELL_EXT, 0x9178,
+                         PCI_VENDOR_ID_MARVELL_EXT, 0x9170),
+          .driver_data = board_ahci_yes_fbs },                  /* 88se9170 */
        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x917a),
          .driver_data = board_ahci_yes_fbs },                  /* 88se9172 */
        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9172),
@@ -1238,15 +1241,6 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (rc)
                return rc;
-        /* AHCI controllers often implement SFF compatible interface.
-         * Grab all PCI BARs just in case.
-         */
-        rc = pcim_iomap_regions_request_all(pdev, 1 << ahci_pci_bar, DRV_NAME);
-        if (rc == -EBUSY)
-                pcim_pin_device(pdev);
-        if (rc)
-                return rc;
        if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
            (pdev->device == 0x2652 || pdev->device == 0x2653)) {
                u8 map;
@@ -1263,6 +1257,15 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                }
        }
+        /* AHCI controllers often implement SFF compatible interface.
+         * Grab all PCI BARs just in case.
+         */
+        rc = pcim_iomap_regions_request_all(pdev, 1 << ahci_pci_bar, DRV_NAME);
+        if (rc == -EBUSY)
+                pcim_pin_device(pdev);
+        if (rc)
+                return rc;
        hpriv = devm_kzalloc(dev, sizeof(*hpriv), GFP_KERNEL);
        if (!hpriv)
                return -ENOMEM;
diff --git a/drivers/ata/ahci_imx.c b/drivers/ata/ahci_imx.c
index ae2d73fe321e..3e23e9941dad 100644
--- a/drivers/ata/ahci_imx.c
+++ b/drivers/ata/ahci_imx.c
@@ -113,7 +113,7 @@ static int imx6q_sata_init(struct device *dev, void __iomem *mmio)
        /*
         * set PHY Paremeters, two steps to configure the GPR13,
         * one write for rest of parameters, mask of first write
-         * is 0x07fffffd, and the other one write for setting
+         * is 0x07ffffff, and the other one write for setting
         * the mpll_clk_en.
         */
        regmap_update_bits(imxpriv->gpr, 0x34, IMX6Q_GPR13_SATA_RX_EQ_VAL_MASK
@@ -124,6 +124,7 @@ static int imx6q_sata_init(struct device *dev, void __iomem *mmio)
                        | IMX6Q_GPR13_SATA_TX_ATTEN_MASK
                        | IMX6Q_GPR13_SATA_TX_BOOST_MASK
                        | IMX6Q_GPR13_SATA_TX_LVL_MASK
+                        | IMX6Q_GPR13_SATA_MPLL_CLK_EN
                        | IMX6Q_GPR13_SATA_TX_EDGE_RATE
                        , IMX6Q_GPR13_SATA_RX_EQ_VAL_3_0_DB
                        | IMX6Q_GPR13_SATA_RX_LOS_LVL_SATA2M
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 75b93678bbcd..1393a5890ed5 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2149,9 +2149,16 @@ static int ata_dev_config_ncq(struct ata_device *dev,
                                    "failed to get NCQ Send/Recv Log Emask 0x%x\n",
                                    err_mask);
                } else {
+                        u8 *cmds = dev->ncq_send_recv_cmds;
                        dev->flags |= ATA_DFLAG_NCQ_SEND_RECV;
-                        memcpy(dev->ncq_send_recv_cmds, ap->sector_buf,
+                        memcpy(cmds, ap->sector_buf, ATA_LOG_NCQ_SEND_RECV_SIZE);
-                                ATA_LOG_NCQ_SEND_RECV_SIZE);
+                        if (dev->horkage & ATA_HORKAGE_NO_NCQ_TRIM) {
+                                ata_dev_dbg(dev, "disabling queued TRIM support\n");
+                                cmds[ATA_LOG_NCQ_SEND_RECV_DSM_OFFSET] &=
+                                        ~ATA_LOG_NCQ_SEND_RECV_DSM_TRIM;
+                        }
                }
        }
@@ -4156,6 +4163,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "ST3320[68]13AS",     "SD1[5-9]",     ATA_HORKAGE_NONCQ |
                                                ATA_HORKAGE_FIRMWARE_WARN },
+        /* Seagate Momentus SpinPoint M8 seem to have FPMDA_AA issues */
+        { "ST1000LM024 HN-M101MBB", "2AR10001", ATA_HORKAGE_BROKEN_FPDMA_AA },
        /* Blacklist entries taken from Silicon Image 3124/3132
           Windows driver .inf file - also several Linux problem reports */
        { "HTS541060G9SA00",    "MB3OC60D",     ATA_HORKAGE_NONCQ, },
@@ -4202,6 +4212,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "PIONEER DVD-RW  DVR-212D",   NULL,   ATA_HORKAGE_NOSETXFER },
        { "PIONEER DVD-RW  DVR-216D",   NULL,   ATA_HORKAGE_NOSETXFER },
+        /* devices that don't properly handle queued TRIM commands */
+        { "Micron_M500*",               NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
+        { "Crucial_CT???M500SSD1",      NULL,   ATA_HORKAGE_NO_NCQ_TRIM, },
        /* End Marker */
        { }
 };
@@ -6519,6 +6533,7 @@ static int __init ata_parse_force_one(char **cur,
                { "norst",      .lflags         = ATA_LFLAG_NO_HRST | ATA_LFLAG_NO_SRST },
                { "rstonce",    .lflags         = ATA_LFLAG_RST_ONCE },
                { "atapi_dmadir", .horkage_on   = ATA_HORKAGE_ATAPI_DMADIR },
+                { "disable",    .horkage_on     = ATA_HORKAGE_DISABLE },
        };
        char *start = *cur, *p = *cur;
        char *id, *val, *endp;
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index ab58556d347c..377eb889f555 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -3872,6 +3872,27 @@ void ata_scsi_hotplug(struct work_struct *work)
                return;
        }
+        /*
+         * XXX - UGLY HACK
+         *
+         * The block layer suspend/resume path is fundamentally broken due
+         * to freezable kthreads and workqueue and may deadlock if a block
+         * device gets removed while resume is in progress.  I don't know
+         * what the solution is short of removing freezable kthreads and
+         * workqueues altogether.
+         *
+         * The following is an ugly hack to avoid kicking off device
+         * removal while freezer is active.  This is a joke but does avoid
+         * this particular deadlock scenario.
+         *
+         * https://bugzilla.kernel.org/show_bug.cgi?id=62801
+         * http://marc.info/?l=linux-kernel&m=138695698516487
+         */
+#ifdef CONFIG_FREEZER
+        while (pm_freezing)
+                msleep(10);
+#endif
        DPRINTK("ENTER\n");
        mutex_lock(&ap->scsi_scan_mutex);
diff --git a/drivers/ata/sata_sis.c b/drivers/ata/sata_sis.c
index fe3ca0989b14..1ad2f62d34b9 100644
--- a/drivers/ata/sata_sis.c
+++ b/drivers/ata/sata_sis.c
@@ -83,6 +83,10 @@ static struct pci_driver sis_pci_driver = {
        .id_table               = sis_pci_tbl,
        .probe                  = sis_init_one,
        .remove                 = ata_pci_remove_one,
+#ifdef CONFIG_PM
+        .suspend                = ata_pci_device_suspend,
+        .resume                 = ata_pci_device_resume,
+#endif
 };
 static struct scsi_host_template sis_sht = {
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index f370fc13aea5..83a598ebb65a 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -1,4 +1,5 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/sched.h>
 #include <linux/fs.h>
@@ -65,7 +66,7 @@ enum {
        NULL_Q_MQ               = 2,
 };
-static int submit_queues = 1;
+static int submit_queues;
 module_param(submit_queues, int, S_IRUGO);
 MODULE_PARM_DESC(submit_queues, "Number of submission queues");
@@ -101,9 +102,9 @@ static int hw_queue_depth = 64;
 module_param(hw_queue_depth, int, S_IRUGO);
 MODULE_PARM_DESC(hw_queue_depth, "Queue depth for each hardware queue. Default: 64");
-static bool use_per_node_hctx = true;
+static bool use_per_node_hctx = false;
 module_param(use_per_node_hctx, bool, S_IRUGO);
-MODULE_PARM_DESC(use_per_node_hctx, "Use per-node allocation for hardware context queues. Default: true");
+MODULE_PARM_DESC(use_per_node_hctx, "Use per-node allocation for hardware context queues. Default: false");
 static void put_tag(struct nullb_queue *nq, unsigned int tag)
 {
@@ -346,8 +347,37 @@ static int null_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *rq)
 static struct blk_mq_hw_ctx *null_alloc_hctx(struct blk_mq_reg *reg, unsigned int hctx_index)
 {
-        return kzalloc_node(sizeof(struct blk_mq_hw_ctx), GFP_KERNEL,
+        int b_size = DIV_ROUND_UP(reg->nr_hw_queues, nr_online_nodes);
-                                hctx_index);
+        int tip = (reg->nr_hw_queues % nr_online_nodes);
+        int node = 0, i, n;
+        /*
+         * Split submit queues evenly wrt to the number of nodes. If uneven,
+         * fill the first buckets with one extra, until the rest is filled with
+         * no extra.
+         */
+        for (i = 0, n = 1; i < hctx_index; i++, n++) {
+                if (n % b_size == 0) {
+                        n = 0;
+                        node++;
+                        tip--;
+                        if (!tip)
+                                b_size = reg->nr_hw_queues / nr_online_nodes;
+                }
+        }
+        /*
+         * A node might not be online, therefore map the relative node id to the
+         * real node id.
+         */
+        for_each_online_node(n) {
+                if (!node)
+                        break;
+                node--;
+        }
+        return kzalloc_node(sizeof(struct blk_mq_hw_ctx), GFP_KERNEL, n);
 }
 static void null_free_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_index)
@@ -355,16 +385,24 @@ static void null_free_hctx(struct blk_mq_hw_ctx *hctx, unsigned int hctx_index)
        kfree(hctx);
 }
+static void null_init_queue(struct nullb *nullb, struct nullb_queue *nq)
+{
+        BUG_ON(!nullb);
+        BUG_ON(!nq);
+        init_waitqueue_head(&nq->wait);
+        nq->queue_depth = nullb->queue_depth;
+}
 static int null_init_hctx(struct blk_mq_hw_ctx *hctx, void *data,
                          unsigned int index)
 {
        struct nullb *nullb = data;
        struct nullb_queue *nq = &nullb->queues[index];
-        init_waitqueue_head(&nq->wait);
-        nq->queue_depth = nullb->queue_depth;
-        nullb->nr_queues++;
        hctx->driver_data = nq;
+        null_init_queue(nullb, nq);
+        nullb->nr_queues++;
        return 0;
 }
@@ -387,10 +425,7 @@ static void null_del_dev(struct nullb *nullb)
        list_del_init(&nullb->list);
        del_gendisk(nullb->disk);
-        if (queue_mode == NULL_Q_MQ)
+        blk_cleanup_queue(nullb->q);
-                blk_mq_free_queue(nullb->q);
-        else
-                blk_cleanup_queue(nullb->q);
        put_disk(nullb->disk);
        kfree(nullb);
 }
@@ -417,13 +452,13 @@ static int setup_commands(struct nullb_queue *nq)
        nq->cmds = kzalloc(nq->queue_depth * sizeof(*cmd), GFP_KERNEL);
        if (!nq->cmds)
-                return 1;
+                return -ENOMEM;
        tag_size = ALIGN(nq->queue_depth, BITS_PER_LONG) / BITS_PER_LONG;
        nq->tag_map = kzalloc(tag_size * sizeof(unsigned long), GFP_KERNEL);
        if (!nq->tag_map) {
                kfree(nq->cmds);
-                return 1;
+                return -ENOMEM;
        }
        for (i = 0; i < nq->queue_depth; i++) {
@@ -454,33 +489,37 @@ static void cleanup_queues(struct nullb *nullb)
 static int setup_queues(struct nullb *nullb)
 {
-        struct nullb_queue *nq;
+        nullb->queues = kzalloc(submit_queues * sizeof(struct nullb_queue),
-        int i;
+                                                                GFP_KERNEL);
-        nullb->queues = kzalloc(submit_queues * sizeof(*nq), GFP_KERNEL);
        if (!nullb->queues)
-                return 1;
+                return -ENOMEM;
        nullb->nr_queues = 0;
        nullb->queue_depth = hw_queue_depth;
-        if (queue_mode == NULL_Q_MQ)
+        return 0;
-                return 0;
+}
+static int init_driver_queues(struct nullb *nullb)
+{
+        struct nullb_queue *nq;
+        int i, ret = 0;
        for (i = 0; i < submit_queues; i++) {
                nq = &nullb->queues[i];
-                init_waitqueue_head(&nq->wait);
-                nq->queue_depth = hw_queue_depth;
+                null_init_queue(nullb, nq);
-                if (setup_commands(nq))
-                        break;
+                ret = setup_commands(nq);
+                if (ret)
+                        goto err_queue;
                nullb->nr_queues++;
        }
-        if (i == submit_queues)
+        return 0;
-                return 0;
+err_queue:
        cleanup_queues(nullb);
-        return 1;
+        return ret;
 }
 static int null_add_dev(void)
@@ -518,11 +557,13 @@ static int null_add_dev(void)
        } else if (queue_mode == NULL_Q_BIO) {
                nullb->q = blk_alloc_queue_node(GFP_KERNEL, home_node);
                blk_queue_make_request(nullb->q, null_queue_bio);
+                init_driver_queues(nullb);
        } else {
                nullb->q = blk_init_queue_node(null_request_fn, &nullb->lock, home_node);
                blk_queue_prep_rq(nullb->q, null_rq_prep_fn);
                if (nullb->q)
                        blk_queue_softirq_done(nullb->q, null_softirq_done_fn);
+                init_driver_queues(nullb);
        }
        if (!nullb->q)
@@ -534,10 +575,7 @@ static int null_add_dev(void)
        disk = nullb->disk = alloc_disk_node(1, home_node);
        if (!disk) {
 queue_fail:
-                if (queue_mode == NULL_Q_MQ)
+                blk_cleanup_queue(nullb->q);
-                        blk_mq_free_queue(nullb->q);
-                else
-                        blk_cleanup_queue(nullb->q);
                cleanup_queues(nullb);
 err:
                kfree(nullb);
@@ -579,7 +617,13 @@ static int __init null_init(void)
        }
 #endif
-        if (submit_queues > nr_cpu_ids)
+        if (queue_mode == NULL_Q_MQ && use_per_node_hctx) {
+                if (submit_queues < nr_online_nodes) {
+                        pr_warn("null_blk: submit_queues param is set to %u.",
+                                                        nr_online_nodes);
+                        submit_queues = nr_online_nodes;
+                }
+        } else if (submit_queues > nr_cpu_ids)
                submit_queues = nr_cpu_ids;
        else if (!submit_queues)
                submit_queues = 1;
diff --git a/drivers/block/skd_main.c b/drivers/block/skd_main.c
index 9199c93be926..eb6e1e0e8db2 100644
--- a/drivers/block/skd_main.c
+++ b/drivers/block/skd_main.c
@@ -5269,7 +5269,7 @@ const char *skd_skdev_state_to_str(enum skd_drvr_state state)
        }
 }
-const char *skd_skmsg_state_to_str(enum skd_fit_msg_state state)
+static const char *skd_skmsg_state_to_str(enum skd_fit_msg_state state)
 {
        switch (state) {
        case SKD_MSG_STATE_IDLE:
@@ -5281,7 +5281,7 @@ const char *skd_skmsg_state_to_str(enum skd_fit_msg_state state)
        }
 }
-const char *skd_skreq_state_to_str(enum skd_req_state state)
+static const char *skd_skreq_state_to_str(enum skd_req_state state)
 {
        switch (state) {
        case SKD_REQ_STATE_IDLE:
diff --git a/drivers/block/z2ram.c b/drivers/block/z2ram.c
index 5a95baf4b104..27de5046708a 100644
--- a/drivers/block/z2ram.c
+++ b/drivers/block/z2ram.c
@@ -43,9 +43,6 @@
 #include <linux/zorro.h>
-extern int m68k_realnum_memory;
-extern struct mem_info m68k_memory[NUM_MEMINFO];
 #define Z2MINOR_COMBINED      (0)
 #define Z2MINOR_Z2ONLY        (1)
 #define Z2MINOR_CHIPONLY      (2)
@@ -116,8 +113,8 @@ get_z2ram( void )
        if ( test_bit( i, zorro_unused_z2ram ) )
        {
            z2_count++;
-            z2ram_map[ z2ram_size++ ] = 
+            z2ram_map[z2ram_size++] = (unsigned long)ZTWO_VADDR(Z2RAM_START) +
-                ZTWO_VADDR( Z2RAM_START ) + ( i << Z2RAM_CHUNKSHIFT );
+                                      (i << Z2RAM_CHUNKSHIFT);
            clear_bit( i, zorro_unused_z2ram );
        }
    }
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 6bfc1bb318f6..dceb85f8d9a8 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -87,6 +87,7 @@ static const struct usb_device_id ath3k_table[] = {
        { USB_DEVICE(0x0CF3, 0xE004) },
        { USB_DEVICE(0x0CF3, 0xE005) },
        { USB_DEVICE(0x0930, 0x0219) },
+        { USB_DEVICE(0x0930, 0x0220) },
        { USB_DEVICE(0x0489, 0xe057) },
        { USB_DEVICE(0x13d3, 0x3393) },
        { USB_DEVICE(0x0489, 0xe04e) },
@@ -129,6 +130,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = {
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index c0ff34f2d2df..3980fd18f6ea 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -154,6 +154,7 @@ static const struct usb_device_id blacklist_table[] = {
        { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0cf3, 0xe005), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
        { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index d79d692d05b8..896413b59aae 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -735,7 +735,7 @@ static struct pci_device_id agp_amd64_pci_table[] = {
 MODULE_DEVICE_TABLE(pci, agp_amd64_pci_table);
-static DEFINE_PCI_DEVICE_TABLE(agp_amd64_pci_promisc_table) = {
+static const struct pci_device_id agp_amd64_pci_promisc_table[] = {
        { PCI_DEVICE_CLASS(0, 0) },
        { }
 };
diff --git a/drivers/char/i8k.c b/drivers/char/i8k.c
index e6939e13e338..e210f858d3cb 100644
--- a/drivers/char/i8k.c
+++ b/drivers/char/i8k.c
@@ -1,12 +1,11 @@
 /*
 * i8k.c -- Linux driver for accessing the SMM BIOS on Dell laptops.
- *          See http://www.debian.org/~dz/i8k/ for more information
- *          and for latest version of this driver.
 *
 * Copyright (C) 2001  Massimo Dal Zotto <dz@debian.org>
 *
 * Hwmon integration:
 * Copyright (C) 2011  Jean Delvare <khali@linux-fr.org>
+ * Copyright (C) 2013  Guenter Roeck <linux@roeck-us.net>
 *
 * This program is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -19,6 +18,8 @@
 * General Public License for more details.
 */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/init.h>
@@ -29,13 +30,12 @@
 #include <linux/mutex.h>
 #include <linux/hwmon.h>
 #include <linux/hwmon-sysfs.h>
-#include <asm/uaccess.h>
+#include <linux/uaccess.h>
-#include <asm/io.h>
+#include <linux/io.h>
+#include <linux/sched.h>
 #include <linux/i8k.h>
-#define I8K_VERSION             "1.14 21/02/2005"
 #define I8K_SMM_FN_STATUS       0x0025
 #define I8K_SMM_POWER_STATUS    0x0069
 #define I8K_SMM_SET_FAN         0x01a3
@@ -44,7 +44,6 @@
 #define I8K_SMM_GET_TEMP        0x10a3
 #define I8K_SMM_GET_DELL_SIG1   0xfea3
 #define I8K_SMM_GET_DELL_SIG2   0xffa3
-#define I8K_SMM_BIOS_VERSION    0x00a6
 #define I8K_FAN_MULT            30
 #define I8K_MAX_TEMP            127
@@ -64,6 +63,15 @@
 static DEFINE_MUTEX(i8k_mutex);
 static char bios_version[4];
 static struct device *i8k_hwmon_dev;
+static u32 i8k_hwmon_flags;
+static int i8k_fan_mult;
+#define I8K_HWMON_HAVE_TEMP1    (1 << 0)
+#define I8K_HWMON_HAVE_TEMP2    (1 << 1)
+#define I8K_HWMON_HAVE_TEMP3    (1 << 2)
+#define I8K_HWMON_HAVE_TEMP4    (1 << 3)
+#define I8K_HWMON_HAVE_FAN1     (1 << 4)
+#define I8K_HWMON_HAVE_FAN2     (1 << 5)
 MODULE_AUTHOR("Massimo Dal Zotto (dz@debian.org)");
 MODULE_DESCRIPTION("Driver for accessing SMM BIOS on Dell laptops");
@@ -103,11 +111,11 @@ static const struct file_operations i8k_fops = {
 struct smm_regs {
        unsigned int eax;
-        unsigned int ebx __attribute__ ((packed));
+        unsigned int ebx __packed;
-        unsigned int ecx __attribute__ ((packed));
+        unsigned int ecx __packed;
-        unsigned int edx __attribute__ ((packed));
+        unsigned int edx __packed;
-        unsigned int esi __attribute__ ((packed));
+        unsigned int esi __packed;
-        unsigned int edi __attribute__ ((packed));
+        unsigned int edi __packed;
 };
 static inline const char *i8k_get_dmi_data(int field)
@@ -124,6 +132,17 @@ static int i8k_smm(struct smm_regs *regs)
 {
        int rc;
        int eax = regs->eax;
+        cpumask_var_t old_mask;
+        /* SMM requires CPU 0 */
+        if (!alloc_cpumask_var(&old_mask, GFP_KERNEL))
+                return -ENOMEM;
+        cpumask_copy(old_mask, &current->cpus_allowed);
+        set_cpus_allowed_ptr(current, cpumask_of(0));
+        if (smp_processor_id() != 0) {
+                rc = -EBUSY;
+                goto out;
+        }
 #if defined(CONFIG_X86_64)
        asm volatile("pushq %%rax\n\t"
@@ -148,7 +167,7 @@ static int i8k_smm(struct smm_regs *regs)
                "pushfq\n\t"
                "popq %%rax\n\t"
                "andl $1,%%eax\n"
-                :"=a"(rc)
+                : "=a"(rc)
                :    "a"(regs)
                :    "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
 #else
@@ -174,25 +193,17 @@ static int i8k_smm(struct smm_regs *regs)
            "lahf\n\t"
            "shrl $8,%%eax\n\t"
            "andl $1,%%eax\n"
-            :"=a"(rc)
+            : "=a"(rc)
            :    "a"(regs)
            :    "%ebx", "%ecx", "%edx", "%esi", "%edi", "memory");
 #endif
        if (rc != 0 || (regs->eax & 0xffff) == 0xffff || regs->eax == eax)
-                return -EINVAL;
+                rc = -EINVAL;
-        return 0;
+out:
-}
+        set_cpus_allowed_ptr(current, old_mask);
+        free_cpumask_var(old_mask);
-/*
+        return rc;
- * Read the bios version. Return the version as an integer corresponding
- * to the ascii value, for example "A17" is returned as 0x00413137.
- */
-static int i8k_get_bios_version(void)
-{
-        struct smm_regs regs = { .eax = I8K_SMM_BIOS_VERSION, };
-        return i8k_smm(&regs) ? : regs.eax;
 }
 /*
@@ -203,7 +214,8 @@ static int i8k_get_fn_status(void)
        struct smm_regs regs = { .eax = I8K_SMM_FN_STATUS, };
        int rc;
-        if ((rc = i8k_smm(&regs)) < 0)
+        rc = i8k_smm(&regs);
+        if (rc < 0)
                return rc;
        switch ((regs.eax >> I8K_FN_SHIFT) & I8K_FN_MASK) {
@@ -226,7 +238,8 @@ static int i8k_get_power_status(void)
        struct smm_regs regs = { .eax = I8K_SMM_POWER_STATUS, };
        int rc;
-        if ((rc = i8k_smm(&regs)) < 0)
+        rc = i8k_smm(&regs);
+        if (rc < 0)
                return rc;
        return (regs.eax & 0xff) == I8K_POWER_AC ? I8K_AC : I8K_BATTERY;
@@ -251,7 +264,7 @@ static int i8k_get_fan_speed(int fan)
        struct smm_regs regs = { .eax = I8K_SMM_GET_SPEED, };
        regs.ebx = fan & 0xff;
-        return i8k_smm(&regs) ? : (regs.eax & 0xffff) * fan_mult;
+        return i8k_smm(&regs) ? : (regs.eax & 0xffff) * i8k_fan_mult;
 }
 /*
@@ -277,10 +290,11 @@ static int i8k_get_temp(int sensor)
        int temp;
 #ifdef I8K_TEMPERATURE_BUG
-        static int prev;
+        static int prev[4];
 #endif
        regs.ebx = sensor & 0xff;
-        if ((rc = i8k_smm(&regs)) < 0)
+        rc = i8k_smm(&regs);
+        if (rc < 0)
                return rc;
        temp = regs.eax & 0xff;
@@ -294,10 +308,10 @@ static int i8k_get_temp(int sensor)
         # 1003655139 00000054 00005c52
         */
        if (temp > I8K_MAX_TEMP) {
-                temp = prev;
+                temp = prev[sensor];
-                prev = I8K_MAX_TEMP;
+                prev[sensor] = I8K_MAX_TEMP;
        } else {
-                prev = temp;
+                prev[sensor] = temp;
        }
 #endif
@@ -309,7 +323,8 @@ static int i8k_get_dell_signature(int req_fn)
        struct smm_regs regs = { .eax = req_fn, };
        int rc;
-        if ((rc = i8k_smm(&regs)) < 0)
+        rc = i8k_smm(&regs);
+        if (rc < 0)
                return rc;
        return regs.eax == 1145651527 && regs.edx == 1145392204 ? 0 : -1;
@@ -328,12 +343,14 @@ i8k_ioctl_unlocked(struct file *fp, unsigned int cmd, unsigned long arg)
        switch (cmd) {
        case I8K_BIOS_VERSION:
-                val = i8k_get_bios_version();
+                val = (bios_version[0] << 16) |
+                                (bios_version[1] << 8) | bios_version[2];
                break;
        case I8K_MACHINE_ID:
                memset(buff, 0, 16);
-                strlcpy(buff, i8k_get_dmi_data(DMI_PRODUCT_SERIAL), sizeof(buff));
+                strlcpy(buff, i8k_get_dmi_data(DMI_PRODUCT_SERIAL),
+                        sizeof(buff));
                break;
        case I8K_FN_STATUS:
@@ -470,12 +487,13 @@ static ssize_t i8k_hwmon_show_temp(struct device *dev,
                                   struct device_attribute *devattr,
                                   char *buf)
 {
-        int cpu_temp;
+        int index = to_sensor_dev_attr(devattr)->index;
+        int temp;
-        cpu_temp = i8k_get_temp(0);
+        temp = i8k_get_temp(index);
-        if (cpu_temp < 0)
+        if (temp < 0)
-                return cpu_temp;
+                return temp;
-        return sprintf(buf, "%d\n", cpu_temp * 1000);
+        return sprintf(buf, "%d\n", temp * 1000);
 }
 static ssize_t i8k_hwmon_show_fan(struct device *dev,
@@ -491,12 +509,44 @@ static ssize_t i8k_hwmon_show_fan(struct device *dev,
        return sprintf(buf, "%d\n", fan_speed);
 }
+static ssize_t i8k_hwmon_show_pwm(struct device *dev,
+                                  struct device_attribute *devattr,
+                                  char *buf)
+{
+        int index = to_sensor_dev_attr(devattr)->index;
+        int status;
+        status = i8k_get_fan_status(index);
+        if (status < 0)
+                return -EIO;
+        return sprintf(buf, "%d\n", clamp_val(status * 128, 0, 255));
+}
+static ssize_t i8k_hwmon_set_pwm(struct device *dev,
+                                 struct device_attribute *attr,
+                                 const char *buf, size_t count)
+{
+        int index = to_sensor_dev_attr(attr)->index;
+        unsigned long val;
+        int err;
+        err = kstrtoul(buf, 10, &val);
+        if (err)
+                return err;
+        val = clamp_val(DIV_ROUND_CLOSEST(val, 128), 0, 2);
+        mutex_lock(&i8k_mutex);
+        err = i8k_set_fan(index, val);
+        mutex_unlock(&i8k_mutex);
+        return err < 0 ? -EIO : count;
+}
 static ssize_t i8k_hwmon_show_label(struct device *dev,
                                    struct device_attribute *devattr,
                                    char *buf)
 {
-        static const char *labels[4] = {
+        static const char *labels[3] = {
-                "i8k",
                "CPU",
                "Left Fan",
                "Right Fan",
@@ -506,108 +556,108 @@ static ssize_t i8k_hwmon_show_label(struct device *dev,
        return sprintf(buf, "%s\n", labels[index]);
 }
-static DEVICE_ATTR(temp1_input, S_IRUGO, i8k_hwmon_show_temp, NULL);
+static SENSOR_DEVICE_ATTR(temp1_input, S_IRUGO, i8k_hwmon_show_temp, NULL, 0);
+static SENSOR_DEVICE_ATTR(temp2_input, S_IRUGO, i8k_hwmon_show_temp, NULL, 1);
+static SENSOR_DEVICE_ATTR(temp3_input, S_IRUGO, i8k_hwmon_show_temp, NULL, 2);
+static SENSOR_DEVICE_ATTR(temp4_input, S_IRUGO, i8k_hwmon_show_temp, NULL, 3);
 static SENSOR_DEVICE_ATTR(fan1_input, S_IRUGO, i8k_hwmon_show_fan, NULL,
                          I8K_FAN_LEFT);
+static SENSOR_DEVICE_ATTR(pwm1, S_IRUGO | S_IWUSR, i8k_hwmon_show_pwm,
+                          i8k_hwmon_set_pwm, I8K_FAN_LEFT);
 static SENSOR_DEVICE_ATTR(fan2_input, S_IRUGO, i8k_hwmon_show_fan, NULL,
                          I8K_FAN_RIGHT);
-static SENSOR_DEVICE_ATTR(name, S_IRUGO, i8k_hwmon_show_label, NULL, 0);
+static SENSOR_DEVICE_ATTR(pwm2, S_IRUGO | S_IWUSR, i8k_hwmon_show_pwm,
-static SENSOR_DEVICE_ATTR(temp1_label, S_IRUGO, i8k_hwmon_show_label, NULL, 1);
+                          i8k_hwmon_set_pwm, I8K_FAN_RIGHT);
-static SENSOR_DEVICE_ATTR(fan1_label, S_IRUGO, i8k_hwmon_show_label, NULL, 2);
+static SENSOR_DEVICE_ATTR(temp1_label, S_IRUGO, i8k_hwmon_show_label, NULL, 0);
-static SENSOR_DEVICE_ATTR(fan2_label, S_IRUGO, i8k_hwmon_show_label, NULL, 3);
+static SENSOR_DEVICE_ATTR(fan1_label, S_IRUGO, i8k_hwmon_show_label, NULL, 1);
+static SENSOR_DEVICE_ATTR(fan2_label, S_IRUGO, i8k_hwmon_show_label, NULL, 2);
+static struct attribute *i8k_attrs[] = {
+        &sensor_dev_attr_temp1_input.dev_attr.attr,     /* 0 */
+        &sensor_dev_attr_temp1_label.dev_attr.attr,     /* 1 */
+        &sensor_dev_attr_temp2_input.dev_attr.attr,     /* 2 */
+        &sensor_dev_attr_temp3_input.dev_attr.attr,     /* 3 */
+        &sensor_dev_attr_temp4_input.dev_attr.attr,     /* 4 */
+        &sensor_dev_attr_fan1_input.dev_attr.attr,      /* 5 */
+        &sensor_dev_attr_pwm1.dev_attr.attr,            /* 6 */
+        &sensor_dev_attr_fan1_label.dev_attr.attr,      /* 7 */
+        &sensor_dev_attr_fan2_input.dev_attr.attr,      /* 8 */
+        &sensor_dev_attr_pwm2.dev_attr.attr,            /* 9 */
+        &sensor_dev_attr_fan2_label.dev_attr.attr,      /* 10 */
+        NULL
+};
-static void i8k_hwmon_remove_files(struct device *dev)
+static umode_t i8k_is_visible(struct kobject *kobj, struct attribute *attr,
+                              int index)
 {
-        device_remove_file(dev, &dev_attr_temp1_input);
+        if ((index == 0 || index == 1) &&
-        device_remove_file(dev, &sensor_dev_attr_fan1_input.dev_attr);
+            !(i8k_hwmon_flags & I8K_HWMON_HAVE_TEMP1))
-        device_remove_file(dev, &sensor_dev_attr_fan2_input.dev_attr);
+                return 0;
-        device_remove_file(dev, &sensor_dev_attr_temp1_label.dev_attr);
+        if (index == 2 && !(i8k_hwmon_flags & I8K_HWMON_HAVE_TEMP2))
-        device_remove_file(dev, &sensor_dev_attr_fan1_label.dev_attr);
+                return 0;
-        device_remove_file(dev, &sensor_dev_attr_fan2_label.dev_attr);
+        if (index == 3 && !(i8k_hwmon_flags & I8K_HWMON_HAVE_TEMP3))
-        device_remove_file(dev, &sensor_dev_attr_name.dev_attr);
+                return 0;
+        if (index == 4 && !(i8k_hwmon_flags & I8K_HWMON_HAVE_TEMP4))
+                return 0;
+        if (index >= 5 && index <= 7 &&
+            !(i8k_hwmon_flags & I8K_HWMON_HAVE_FAN1))
+                return 0;
+        if (index >= 8 && index <= 10 &&
+            !(i8k_hwmon_flags & I8K_HWMON_HAVE_FAN2))
+                return 0;
+        return attr->mode;
 }
+static const struct attribute_group i8k_group = {
+        .attrs = i8k_attrs,
+        .is_visible = i8k_is_visible,
+};
+__ATTRIBUTE_GROUPS(i8k);
 static int __init i8k_init_hwmon(void)
 {
        int err;
-        i8k_hwmon_dev = hwmon_device_register(NULL);
+        i8k_hwmon_flags = 0;
-        if (IS_ERR(i8k_hwmon_dev)) {
-                err = PTR_ERR(i8k_hwmon_dev);
-                i8k_hwmon_dev = NULL;
-                printk(KERN_ERR "i8k: hwmon registration failed (%d)\n", err);
-                return err;
-        }
-        /* Required name attribute */
-        err = device_create_file(i8k_hwmon_dev,
-                                 &sensor_dev_attr_name.dev_attr);
-        if (err)
-                goto exit_unregister;
        /* CPU temperature attributes, if temperature reading is OK */
        err = i8k_get_temp(0);
-        if (err < 0) {
+        if (err >= 0)
-                dev_dbg(i8k_hwmon_dev,
+                i8k_hwmon_flags |= I8K_HWMON_HAVE_TEMP1;
-                        "Not creating temperature attributes (%d)\n", err);
+        /* check for additional temperature sensors */
-        } else {
+        err = i8k_get_temp(1);
-                err = device_create_file(i8k_hwmon_dev, &dev_attr_temp1_input);
+        if (err >= 0)
-                if (err)
+                i8k_hwmon_flags |= I8K_HWMON_HAVE_TEMP2;
-                        goto exit_remove_files;
+        err = i8k_get_temp(2);
-                err = device_create_file(i8k_hwmon_dev,
+        if (err >= 0)
-                                         &sensor_dev_attr_temp1_label.dev_attr);
+                i8k_hwmon_flags |= I8K_HWMON_HAVE_TEMP3;
-                if (err)
+        err = i8k_get_temp(3);
-                        goto exit_remove_files;
+        if (err >= 0)
-        }
+                i8k_hwmon_flags |= I8K_HWMON_HAVE_TEMP4;
        /* Left fan attributes, if left fan is present */
        err = i8k_get_fan_status(I8K_FAN_LEFT);
-        if (err < 0) {
+        if (err >= 0)
-                dev_dbg(i8k_hwmon_dev,
+                i8k_hwmon_flags |= I8K_HWMON_HAVE_FAN1;
-                        "Not creating %s fan attributes (%d)\n", "left", err);
-        } else {
-                err = device_create_file(i8k_hwmon_dev,
-                                         &sensor_dev_attr_fan1_input.dev_attr);
-                if (err)
-                        goto exit_remove_files;
-                err = device_create_file(i8k_hwmon_dev,
-                                         &sensor_dev_attr_fan1_label.dev_attr);
-                if (err)
-                        goto exit_remove_files;
-        }
        /* Right fan attributes, if right fan is present */
        err = i8k_get_fan_status(I8K_FAN_RIGHT);
-        if (err < 0) {
+        if (err >= 0)
-                dev_dbg(i8k_hwmon_dev,
+                i8k_hwmon_flags |= I8K_HWMON_HAVE_FAN2;
-                        "Not creating %s fan attributes (%d)\n", "right", err);
-        } else {
-                err = device_create_file(i8k_hwmon_dev,
-                                         &sensor_dev_attr_fan2_input.dev_attr);
-                if (err)
-                        goto exit_remove_files;
-                err = device_create_file(i8k_hwmon_dev,
-                                         &sensor_dev_attr_fan2_label.dev_attr);
-                if (err)
-                        goto exit_remove_files;
-        }
+        i8k_hwmon_dev = hwmon_device_register_with_groups(NULL, "i8k", NULL,
+                                                          i8k_groups);
+        if (IS_ERR(i8k_hwmon_dev)) {
+                err = PTR_ERR(i8k_hwmon_dev);
+                i8k_hwmon_dev = NULL;
+                pr_err("hwmon registration failed (%d)\n", err);
+                return err;
+        }
        return 0;
- exit_remove_files:
-        i8k_hwmon_remove_files(i8k_hwmon_dev);
- exit_unregister:
-        hwmon_device_unregister(i8k_hwmon_dev);
-        return err;
 }
-static void __exit i8k_exit_hwmon(void)
+static struct dmi_system_id i8k_dmi_table[] __initdata = {
-{
-        i8k_hwmon_remove_files(i8k_hwmon_dev);
-        hwmon_device_unregister(i8k_hwmon_dev);
-}
-static struct dmi_system_id __initdata i8k_dmi_table[] = {
        {
                .ident = "Dell Inspiron",
                .matches = {
@@ -671,7 +721,23 @@ static struct dmi_system_id __initdata i8k_dmi_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "XPS L421X"),
                },
        },
-        { }
+        {
+                .ident = "Dell Studio",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Studio"),
+                },
+                .driver_data = (void *)1,       /* fan multiplier override */
+        },
+        {
+                .ident = "Dell XPS M140",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "MXC051"),
+                },
+                .driver_data = (void *)1,       /* fan multiplier override */
+        },
+        { }
 };
 /*
@@ -679,8 +745,7 @@ static struct dmi_system_id __initdata i8k_dmi_table[] = {
 */
 static int __init i8k_probe(void)
 {
-        char buff[4];
+        const struct dmi_system_id *id;
-        int version;
        /*
         * Get DMI information
@@ -689,49 +754,30 @@ static int __init i8k_probe(void)
                if (!ignore_dmi && !force)
                        return -ENODEV;
-                printk(KERN_INFO "i8k: not running on a supported Dell system.\n");
+                pr_info("not running on a supported Dell system.\n");
-                printk(KERN_INFO "i8k: vendor=%s, model=%s, version=%s\n",
+                pr_info("vendor=%s, model=%s, version=%s\n",
                        i8k_get_dmi_data(DMI_SYS_VENDOR),
                        i8k_get_dmi_data(DMI_PRODUCT_NAME),
                        i8k_get_dmi_data(DMI_BIOS_VERSION));
        }
-        strlcpy(bios_version, i8k_get_dmi_data(DMI_BIOS_VERSION), sizeof(bios_version));
+        strlcpy(bios_version, i8k_get_dmi_data(DMI_BIOS_VERSION),
+                sizeof(bios_version));
        /*
         * Get SMM Dell signature
         */
        if (i8k_get_dell_signature(I8K_SMM_GET_DELL_SIG1) &&
            i8k_get_dell_signature(I8K_SMM_GET_DELL_SIG2)) {
-                printk(KERN_ERR "i8k: unable to get SMM Dell signature\n");
+                pr_err("unable to get SMM Dell signature\n");
                if (!force)
                        return -ENODEV;
        }
-        /*
+        i8k_fan_mult = fan_mult;
-         * Get SMM BIOS version.
+        id = dmi_first_match(i8k_dmi_table);
-         */
+        if (id && fan_mult == I8K_FAN_MULT && id->driver_data)
-        version = i8k_get_bios_version();
+                i8k_fan_mult = (unsigned long)id->driver_data;
-        if (version <= 0) {
-                printk(KERN_WARNING "i8k: unable to get SMM BIOS version\n");
-        } else {
-                buff[0] = (version >> 16) & 0xff;
-                buff[1] = (version >> 8) & 0xff;
-                buff[2] = (version) & 0xff;
-                buff[3] = '\0';
-                /*
-                 * If DMI BIOS version is unknown use SMM BIOS version.
-                 */
-                if (!dmi_get_system_info(DMI_BIOS_VERSION))
-                        strlcpy(bios_version, buff, sizeof(bios_version));
-                /*
-                 * Check if the two versions match.
-                 */
-                if (strncmp(buff, bios_version, sizeof(bios_version)) != 0)
-                        printk(KERN_WARNING "i8k: BIOS version mismatch: %s != %s\n",
-                                buff, bios_version);
-        }
        return 0;
 }
@@ -754,10 +800,6 @@ static int __init i8k_init(void)
        if (err)
                goto exit_remove_proc;
-        printk(KERN_INFO
-               "Dell laptop SMM driver v%s Massimo Dal Zotto (dz@debian.org)\n",
-               I8K_VERSION);
        return 0;
 exit_remove_proc:
@@ -767,7 +809,7 @@ static int __init i8k_init(void)
 static void __exit i8k_exit(void)
 {
-        i8k_exit_hwmon();
+        hwmon_device_unregister(i8k_hwmon_dev);
        remove_proc_entry("i8k", NULL);
 }
diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index 0913d79424d3..c4094c4e22c1 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -587,6 +587,8 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
                return -ENODEV;
        switch ( cmd ) {
                case LPTIME:
+                        if (arg > UINT_MAX / HZ)
+                                return -EINVAL;
                        LP_TIME(minor) = arg * HZ/100;
                        break;
                case LPCHAR:
diff --git a/drivers/char/nwbutton.c b/drivers/char/nwbutton.c
index 1fd00dc06897..76c490fa0511 100644
--- a/drivers/char/nwbutton.c
+++ b/drivers/char/nwbutton.c
@@ -168,7 +168,10 @@ static irqreturn_t button_handler (int irq, void *dev_id)
 static int button_read (struct file *filp, char __user *buffer,
                        size_t count, loff_t *ppos)
 {
-        interruptible_sleep_on (&button_wait_queue);
+        DEFINE_WAIT(wait);
+        prepare_to_wait(&button_wait_queue, &wait, TASK_INTERRUPTIBLE);
+        schedule();
+        finish_wait(&button_wait_queue, &wait);
        return (copy_to_user (buffer, &button_output_buffer, bcount))
                 ? -EFAULT : bcount;
 }
diff --git a/drivers/char/tpm/tpm_ppi.c b/drivers/char/tpm/tpm_ppi.c
index 8e562dc65601..e1f3337a0cf9 100644
--- a/drivers/char/tpm/tpm_ppi.c
+++ b/drivers/char/tpm/tpm_ppi.c
@@ -27,15 +27,18 @@ static char *tpm_device_name = "TPM";
 static acpi_status ppi_callback(acpi_handle handle, u32 level, void *context,
                                void **return_value)
 {
-        acpi_status status;
+        acpi_status status = AE_OK;
        struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
-        status = acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer);
-        if (strstr(buffer.pointer, context) != NULL) {
+        if (ACPI_SUCCESS(acpi_get_name(handle, ACPI_FULL_PATHNAME, &buffer))) {
-                *return_value = handle;
+                if (strstr(buffer.pointer, context) != NULL) {
+                        *return_value = handle;
+                        status = AE_CTRL_TERMINATE;
+                }
                kfree(buffer.pointer);
-                return AE_CTRL_TERMINATE;
        }
-        return AE_OK;
+        return status;
 }
 static inline void ppi_assign_params(union acpi_object params[4],
diff --git a/drivers/char/ttyprintk.c b/drivers/char/ttyprintk.c
index d5d2e4a985aa..daea84c41743 100644
--- a/drivers/char/ttyprintk.c
+++ b/drivers/char/ttyprintk.c
@@ -216,4 +216,4 @@ error:
        ttyprintk_driver = NULL;
        return ret;
 }
-module_init(ttyprintk_init);
+device_initcall(ttyprintk_init);
diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c
index 8d3009e44fba..5543b7df8e16 100644
--- a/drivers/clk/clk-divider.c
+++ b/drivers/clk/clk-divider.c
@@ -87,7 +87,7 @@ static unsigned int _get_table_val(const struct clk_div_table *table,
        return 0;
 }
-static unsigned int _get_val(struct clk_divider *divider, u8 div)
+static unsigned int _get_val(struct clk_divider *divider, unsigned int div)
 {
        if (divider->flags & CLK_DIVIDER_ONE_BASED)
                return div;
diff --git a/drivers/clk/samsung/clk-exynos-audss.c b/drivers/clk/samsung/clk-exynos-audss.c
index 39b40aaede2b..68e515d093d8 100644
--- a/drivers/clk/samsung/clk-exynos-audss.c
+++ b/drivers/clk/samsung/clk-exynos-audss.c
@@ -26,17 +26,17 @@ static struct clk_onecell_data clk_data;
 #define ASS_CLK_DIV 0x4
 #define ASS_CLK_GATE 0x8
+/* list of all parent clock list */
+static const char *mout_audss_p[] = { "fin_pll", "fout_epll" };
+static const char *mout_i2s_p[] = { "mout_audss", "cdclk0", "sclk_audio0" };
+#ifdef CONFIG_PM_SLEEP
 static unsigned long reg_save[][2] = {
        {ASS_CLK_SRC,  0},
        {ASS_CLK_DIV,  0},
        {ASS_CLK_GATE, 0},
 };
-/* list of all parent clock list */
-static const char *mout_audss_p[] = { "fin_pll", "fout_epll" };
-static const char *mout_i2s_p[] = { "mout_audss", "cdclk0", "sclk_audio0" };
-#ifdef CONFIG_PM_SLEEP
 static int exynos_audss_clk_suspend(void)
 {
        int i;
diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
index ad5ff50c5f28..1a7c1b929c69 100644
--- a/drivers/clk/samsung/clk-exynos4.c
+++ b/drivers/clk/samsung/clk-exynos4.c
@@ -39,7 +39,7 @@
 #define SRC_TOP1                0xc214
 #define SRC_CAM                 0xc220
 #define SRC_TV                  0xc224
-#define SRC_MFC                 0xcc28
+#define SRC_MFC                 0xc228
 #define SRC_G3D                 0xc22c
 #define E4210_SRC_IMAGE         0xc230
 #define SRC_LCD0                0xc234
diff --git a/drivers/clk/samsung/clk-exynos5250.c b/drivers/clk/samsung/clk-exynos5250.c
index adf32343c9f9..e52359cf9b6f 100644
--- a/drivers/clk/samsung/clk-exynos5250.c
+++ b/drivers/clk/samsung/clk-exynos5250.c
@@ -25,6 +25,7 @@
 #define MPLL_LOCK               0x4000
 #define MPLL_CON0               0x4100
 #define SRC_CORE1               0x4204
+#define GATE_IP_ACP             0x8800
 #define CPLL_LOCK               0x10020
 #define EPLL_LOCK               0x10030
 #define VPLL_LOCK               0x10040
@@ -75,7 +76,6 @@
 #define SRC_CDREX               0x20200
 #define PLL_DIV2_SEL            0x20a24
 #define GATE_IP_DISP1           0x10928
-#define GATE_IP_ACP             0x10000
 /* list of PLLs to be registered */
 enum exynos5250_plls {
@@ -120,7 +120,8 @@ enum exynos5250_clks {
        spi2, i2s1, i2s2, pcm1, pcm2, pwm, spdif, ac97, hsi2c0, hsi2c1, hsi2c2,
        hsi2c3, chipid, sysreg, pmu, cmu_top, cmu_core, cmu_mem, tzpc0, tzpc1,
        tzpc2, tzpc3, tzpc4, tzpc5, tzpc6, tzpc7, tzpc8, tzpc9, hdmi_cec, mct,
-        wdt, rtc, tmu, fimd1, mie1, dsim0, dp, mixer, hdmi, g2d,
+        wdt, rtc, tmu, fimd1, mie1, dsim0, dp, mixer, hdmi, g2d, mdma0,
+        smmu_mdma0,
        /* mux clocks */
        mout_hdmi = 1024,
@@ -354,8 +355,8 @@ static struct samsung_gate_clock exynos5250_gate_clks[] __initdata = {
        GATE(smmu_gscl2, "smmu_gscl2", "aclk266", GATE_IP_GSCL, 9, 0, 0),
        GATE(smmu_gscl3, "smmu_gscl3", "aclk266", GATE_IP_GSCL, 10, 0, 0),
        GATE(mfc, "mfc", "aclk333", GATE_IP_MFC, 0, 0, 0),
-        GATE(smmu_mfcl, "smmu_mfcl", "aclk333", GATE_IP_MFC, 1, 0, 0),
+        GATE(smmu_mfcl, "smmu_mfcl", "aclk333", GATE_IP_MFC, 2, 0, 0),
-        GATE(smmu_mfcr, "smmu_mfcr", "aclk333", GATE_IP_MFC, 2, 0, 0),
+        GATE(smmu_mfcr, "smmu_mfcr", "aclk333", GATE_IP_MFC, 1, 0, 0),
        GATE(rotator, "rotator", "aclk266", GATE_IP_GEN, 1, 0, 0),
        GATE(jpeg, "jpeg", "aclk166", GATE_IP_GEN, 2, 0, 0),
        GATE(mdma1, "mdma1", "aclk266", GATE_IP_GEN, 4, 0, 0),
@@ -406,7 +407,8 @@ static struct samsung_gate_clock exynos5250_gate_clks[] __initdata = {
        GATE(hsi2c2, "hsi2c2", "aclk66", GATE_IP_PERIC, 30, 0, 0),
        GATE(hsi2c3, "hsi2c3", "aclk66", GATE_IP_PERIC, 31, 0, 0),
        GATE(chipid, "chipid", "aclk66", GATE_IP_PERIS, 0, 0, 0),
-        GATE(sysreg, "sysreg", "aclk66", GATE_IP_PERIS, 1, 0, 0),
+        GATE(sysreg, "sysreg", "aclk66",
+                        GATE_IP_PERIS, 1, CLK_IGNORE_UNUSED, 0),
        GATE(pmu, "pmu", "aclk66", GATE_IP_PERIS, 2, CLK_IGNORE_UNUSED, 0),
        GATE(tzpc0, "tzpc0", "aclk66", GATE_IP_PERIS, 6, 0, 0),
        GATE(tzpc1, "tzpc1", "aclk66", GATE_IP_PERIS, 7, 0, 0),
@@ -492,6 +494,8 @@ static struct samsung_gate_clock exynos5250_gate_clks[] __initdata = {
        GATE(mixer, "mixer", "mout_aclk200_disp1", GATE_IP_DISP1, 5, 0, 0),
        GATE(hdmi, "hdmi", "mout_aclk200_disp1", GATE_IP_DISP1, 6, 0, 0),
        GATE(g2d, "g2d", "aclk200", GATE_IP_ACP, 3, 0, 0),
+        GATE(mdma0, "mdma0", "aclk266", GATE_IP_ACP, 1, 0, 0),
+        GATE(smmu_mdma0, "smmu_mdma0", "aclk266", GATE_IP_ACP, 5, 0, 0),
 };
 static struct samsung_pll_rate_table vpll_24mhz_tbl[] __initdata = {
diff --git a/drivers/clocksource/Kconfig b/drivers/clocksource/Kconfig
index 634c4d6dd45a..cd6950fd8caf 100644
--- a/drivers/clocksource/Kconfig
+++ b/drivers/clocksource/Kconfig
@@ -37,6 +37,10 @@ config SUN4I_TIMER
        select CLKSRC_MMIO
        bool
+config SUN5I_HSTIMER
+        select CLKSRC_MMIO
+        bool
 config VT8500_TIMER
        bool
diff --git a/drivers/clocksource/Makefile b/drivers/clocksource/Makefile
index 33621efb9148..358358d87b6d 100644
--- a/drivers/clocksource/Makefile
+++ b/drivers/clocksource/Makefile
@@ -22,6 +22,7 @@ obj-$(CONFIG_ARCH_MOXART)	+= moxart_timer.o
 obj-$(CONFIG_ARCH_MXS)          += mxs_timer.o
 obj-$(CONFIG_ARCH_PRIMA2)       += timer-prima2.o
 obj-$(CONFIG_SUN4I_TIMER)       += sun4i_timer.o
+obj-$(CONFIG_SUN5I_HSTIMER)     += timer-sun5i.o
 obj-$(CONFIG_ARCH_TEGRA)        += tegra20_timer.o
 obj-$(CONFIG_VT8500_TIMER)      += vt8500_timer.o
 obj-$(CONFIG_ARCH_NSPIRE)       += zevio-timer.o
diff --git a/drivers/clocksource/arm_global_timer.c b/drivers/clocksource/arm_global_timer.c
index c639b1a9e996..0fc31d029e52 100644
--- a/drivers/clocksource/arm_global_timer.c
+++ b/drivers/clocksource/arm_global_timer.c
@@ -202,7 +202,7 @@ static struct clocksource gt_clocksource = {
 };
 #ifdef CONFIG_CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK
-static u32 notrace gt_sched_clock_read(void)
+static u64 notrace gt_sched_clock_read(void)
 {
        return gt_counter_read();
 }
@@ -217,7 +217,7 @@ static void __init gt_clocksource_init(void)
        writel(GT_CONTROL_TIMER_ENABLE, gt_base + GT_CONTROL);
 #ifdef CONFIG_CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK
-        setup_sched_clock(gt_sched_clock_read, 32, gt_clk_rate);
+        sched_clock_register(gt_sched_clock_read, 64, gt_clk_rate);
 #endif
        clocksource_register_hz(&gt_clocksource, gt_clk_rate);
 }
diff --git a/drivers/clocksource/bcm_kona_timer.c b/drivers/clocksource/bcm_kona_timer.c
index 0d7d8c3ed6b2..5176e761166b 100644
--- a/drivers/clocksource/bcm_kona_timer.c
+++ b/drivers/clocksource/bcm_kona_timer.c
@@ -98,12 +98,6 @@ kona_timer_get_counter(void *timer_base, uint32_t *msw, uint32_t *lsw)
        return;
 }
-static const struct of_device_id bcm_timer_ids[] __initconst = {
-        {.compatible = "brcm,kona-timer"},
-        {.compatible = "bcm,kona-timer"}, /* deprecated name */
-        {},
-};
 static void __init kona_timers_init(struct device_node *node)
 {
        u32 freq;
diff --git a/drivers/clocksource/cadence_ttc_timer.c b/drivers/clocksource/cadence_ttc_timer.c
index b2bb3a4bc205..63f176de0d02 100644
--- a/drivers/clocksource/cadence_ttc_timer.c
+++ b/drivers/clocksource/cadence_ttc_timer.c
@@ -67,11 +67,13 @@
 * struct ttc_timer - This definition defines local timer structure
 *
 * @base_addr:  Base address of timer
+ * @freq:       Timer input clock frequency
 * @clk:        Associated clock source
 * @clk_rate_change_nb  Notifier block for clock rate changes
 */
 struct ttc_timer {
        void __iomem *base_addr;
+        unsigned long freq;
        struct clk *clk;
        struct notifier_block clk_rate_change_nb;
 };
@@ -158,7 +160,7 @@ static cycle_t __ttc_clocksource_read(struct clocksource *cs)
                                TTC_COUNT_VAL_OFFSET);
 }
-static u32 notrace ttc_sched_clock_read(void)
+static u64 notrace ttc_sched_clock_read(void)
 {
        return __raw_readl(ttc_sched_clock_val_reg);
 }
@@ -196,9 +198,8 @@ static void ttc_set_mode(enum clock_event_mode mode,
        switch (mode) {
        case CLOCK_EVT_MODE_PERIODIC:
-                ttc_set_interval(timer,
+                ttc_set_interval(timer, DIV_ROUND_CLOSEST(ttce->ttc.freq,
-                                DIV_ROUND_CLOSEST(clk_get_rate(ttce->ttc.clk),
+                                                PRESCALE * HZ));
-                                        PRESCALE * HZ));
                break;
        case CLOCK_EVT_MODE_ONESHOT:
        case CLOCK_EVT_MODE_UNUSED:
@@ -273,6 +274,8 @@ static void __init ttc_setup_clocksource(struct clk *clk, void __iomem *base)
                return;
        }
+        ttccs->ttc.freq = clk_get_rate(ttccs->ttc.clk);
        ttccs->ttc.clk_rate_change_nb.notifier_call =
                ttc_rate_change_clocksource_cb;
        ttccs->ttc.clk_rate_change_nb.next = NULL;
@@ -298,16 +301,14 @@ static void __init ttc_setup_clocksource(struct clk *clk, void __iomem *base)
        __raw_writel(CNT_CNTRL_RESET,
                     ttccs->ttc.base_addr + TTC_CNT_CNTRL_OFFSET);
-        err = clocksource_register_hz(&ttccs->cs,
+        err = clocksource_register_hz(&ttccs->cs, ttccs->ttc.freq / PRESCALE);
-                        clk_get_rate(ttccs->ttc.clk) / PRESCALE);
        if (WARN_ON(err)) {
                kfree(ttccs);
                return;
        }
        ttc_sched_clock_val_reg = base + TTC_COUNT_VAL_OFFSET;
-        setup_sched_clock(ttc_sched_clock_read, 16,
+        sched_clock_register(ttc_sched_clock_read, 16, ttccs->ttc.freq / PRESCALE);
-                        clk_get_rate(ttccs->ttc.clk) / PRESCALE);
 }
 static int ttc_rate_change_clockevent_cb(struct notifier_block *nb,
@@ -334,6 +335,9 @@ static int ttc_rate_change_clockevent_cb(struct notifier_block *nb,
                                ndata->new_rate / PRESCALE);
                local_irq_restore(flags);
+                /* update cached frequency */
+                ttc->freq = ndata->new_rate;
                /* fall through */
        }
        case PRE_RATE_CHANGE:
@@ -367,6 +371,7 @@ static void __init ttc_setup_clockevent(struct clk *clk,
        if (clk_notifier_register(ttcce->ttc.clk,
                                &ttcce->ttc.clk_rate_change_nb))
                pr_warn("Unable to register clock notifier.\n");
+        ttcce->ttc.freq = clk_get_rate(ttcce->ttc.clk);
        ttcce->ttc.base_addr = base;
        ttcce->ce.name = "ttc_clockevent";
@@ -388,15 +393,14 @@ static void __init ttc_setup_clockevent(struct clk *clk,
        __raw_writel(0x1,  ttcce->ttc.base_addr + TTC_IER_OFFSET);
        err = request_irq(irq, ttc_clock_event_interrupt,
-                          IRQF_DISABLED | IRQF_TIMER,
+                          IRQF_TIMER, ttcce->ce.name, ttcce);
-                          ttcce->ce.name, ttcce);
        if (WARN_ON(err)) {
                kfree(ttcce);
                return;
        }
        clockevents_config_and_register(&ttcce->ce,
-                        clk_get_rate(ttcce->ttc.clk) / PRESCALE, 1, 0xfffe);
+                        ttcce->ttc.freq / PRESCALE, 1, 0xfffe);
 }
 /**
diff --git a/drivers/clocksource/clksrc-of.c b/drivers/clocksource/clksrc-of.c
index b9ddd9e3a2f5..ae2e4278c42a 100644
--- a/drivers/clocksource/clksrc-of.c
+++ b/drivers/clocksource/clksrc-of.c
@@ -28,6 +28,7 @@ void __init clocksource_of_init(void)
        struct device_node *np;
        const struct of_device_id *match;
        clocksource_of_init_fn init_func;
+        unsigned clocksources = 0;
        for_each_matching_node_and_match(np, __clksrc_of_table, &match) {
                if (!of_device_is_available(np))
@@ -35,5 +36,8 @@ void __init clocksource_of_init(void)
                init_func = match->data;
                init_func(np);
+                clocksources++;
        }
+        if (!clocksources)
+                pr_crit("%s: no matching clocksources found\n", __func__);
 }
diff --git a/drivers/clocksource/cs5535-clockevt.c b/drivers/clocksource/cs5535-clockevt.c
index ea210482dd20..db2105290898 100644
--- a/drivers/clocksource/cs5535-clockevt.c
+++ b/drivers/clocksource/cs5535-clockevt.c
@@ -131,7 +131,7 @@ static irqreturn_t mfgpt_tick(int irq, void *dev_id)
 static struct irqaction mfgptirq  = {
        .handler = mfgpt_tick,
-        .flags = IRQF_DISABLED | IRQF_NOBALANCING | IRQF_TIMER | IRQF_SHARED,
+        .flags = IRQF_NOBALANCING | IRQF_TIMER | IRQF_SHARED,
        .name = DRV_NAME,
 };
diff --git a/drivers/clocksource/dw_apb_timer.c b/drivers/clocksource/dw_apb_timer.c
index e54ca1062d8e..f3656a6b0382 100644
--- a/drivers/clocksource/dw_apb_timer.c
+++ b/drivers/clocksource/dw_apb_timer.c
@@ -243,8 +243,7 @@ dw_apb_clockevent_init(int cpu, const char *name, unsigned rating,
        dw_ced->irqaction.dev_id        = &dw_ced->ced;
        dw_ced->irqaction.irq           = irq;
        dw_ced->irqaction.flags         = IRQF_TIMER | IRQF_IRQPOLL |
-                                          IRQF_NOBALANCING |
+                                          IRQF_NOBALANCING;
-                                          IRQF_DISABLED;
        dw_ced->eoi = apbt_eoi;
        err = setup_irq(irq, &dw_ced->irqaction);
diff --git a/drivers/clocksource/nomadik-mtu.c b/drivers/clocksource/nomadik-mtu.c
index ed7b73b508e0..152a3f3875ee 100644
--- a/drivers/clocksource/nomadik-mtu.c
+++ b/drivers/clocksource/nomadik-mtu.c
@@ -187,7 +187,7 @@ static irqreturn_t nmdk_timer_interrupt(int irq, void *dev_id)
 static struct irqaction nmdk_timer_irq = {
        .name           = "Nomadik Timer Tick",
-        .flags          = IRQF_DISABLED | IRQF_TIMER,
+        .flags          = IRQF_TIMER,
        .handler        = nmdk_timer_interrupt,
        .dev_id         = &nmdk_clkevt,
 };
diff --git a/drivers/clocksource/samsung_pwm_timer.c b/drivers/clocksource/samsung_pwm_timer.c
index 85082e8d3052..5645cfc90c41 100644
--- a/drivers/clocksource/samsung_pwm_timer.c
+++ b/drivers/clocksource/samsung_pwm_timer.c
@@ -264,7 +264,7 @@ static irqreturn_t samsung_clock_event_isr(int irq, void *dev_id)
 static struct irqaction samsung_clock_event_irq = {
        .name           = "samsung_time_irq",
-        .flags          = IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL,
+        .flags          = IRQF_TIMER | IRQF_IRQPOLL,
        .handler        = samsung_clock_event_isr,
        .dev_id         = &time_event_device,
 };
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index 0965e9848b3d..0b1836a6c539 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -634,12 +634,18 @@ static int sh_cmt_clock_event_next(unsigned long delta,
 static void sh_cmt_clock_event_suspend(struct clock_event_device *ced)
 {
-        pm_genpd_syscore_poweroff(&ced_to_sh_cmt(ced)->pdev->dev);
+        struct sh_cmt_priv *p = ced_to_sh_cmt(ced);
+        pm_genpd_syscore_poweroff(&p->pdev->dev);
+        clk_unprepare(p->clk);
 }
 static void sh_cmt_clock_event_resume(struct clock_event_device *ced)
 {
-        pm_genpd_syscore_poweron(&ced_to_sh_cmt(ced)->pdev->dev);
+        struct sh_cmt_priv *p = ced_to_sh_cmt(ced);
+        clk_prepare(p->clk);
+        pm_genpd_syscore_poweron(&p->pdev->dev);
 }
 static void sh_cmt_register_clockevent(struct sh_cmt_priv *p,
@@ -726,8 +732,7 @@ static int sh_cmt_setup(struct sh_cmt_priv *p, struct platform_device *pdev)
        p->irqaction.name = dev_name(&p->pdev->dev);
        p->irqaction.handler = sh_cmt_interrupt;
        p->irqaction.dev_id = p;
-        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | \
+        p->irqaction.flags = IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING;
-                             IRQF_IRQPOLL  | IRQF_NOBALANCING;
        /* get hold of clock */
        p->clk = clk_get(&p->pdev->dev, "cmt_fck");
@@ -737,6 +742,10 @@ static int sh_cmt_setup(struct sh_cmt_priv *p, struct platform_device *pdev)
                goto err2;
        }
+        ret = clk_prepare(p->clk);
+        if (ret < 0)
+                goto err3;
        if (res2 && (resource_size(res2) == 4)) {
                /* assume both CMSTR and CMCSR to be 32-bit */
                p->read_control = sh_cmt_read32;
@@ -773,19 +782,21 @@ static int sh_cmt_setup(struct sh_cmt_priv *p, struct platform_device *pdev)
                              cfg->clocksource_rating);
        if (ret) {
                dev_err(&p->pdev->dev, "registration failed\n");
-                goto err3;
+                goto err4;
        }
        p->cs_enabled = false;
        ret = setup_irq(irq, &p->irqaction);
        if (ret) {
                dev_err(&p->pdev->dev, "failed to request irq %d\n", irq);
-                goto err3;
+                goto err4;
        }
        platform_set_drvdata(pdev, p);
        return 0;
+err4:
+        clk_unprepare(p->clk);
 err3:
        clk_put(p->clk);
 err2:
diff --git a/drivers/clocksource/sh_mtu2.c b/drivers/clocksource/sh_mtu2.c
index 3cf12834681e..e30d76e0a6fa 100644
--- a/drivers/clocksource/sh_mtu2.c
+++ b/drivers/clocksource/sh_mtu2.c
@@ -302,8 +302,7 @@ static int sh_mtu2_setup(struct sh_mtu2_priv *p, struct platform_device *pdev)
        p->irqaction.handler = sh_mtu2_interrupt;
        p->irqaction.dev_id = p;
        p->irqaction.irq = irq;
-        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | \
+        p->irqaction.flags = IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING;
-                             IRQF_IRQPOLL  | IRQF_NOBALANCING;
        /* get hold of clock */
        p->clk = clk_get(&p->pdev->dev, "mtu2_fck");
@@ -358,7 +357,6 @@ static int sh_mtu2_probe(struct platform_device *pdev)
        ret = sh_mtu2_setup(p, pdev);
        if (ret) {
                kfree(p);
-                platform_set_drvdata(pdev, NULL);
                pm_runtime_idle(&pdev->dev);
                return ret;
        }
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index 63557cda0a7d..ecd7b60bfdfa 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -462,8 +462,7 @@ static int sh_tmu_setup(struct sh_tmu_priv *p, struct platform_device *pdev)
        p->irqaction.handler = sh_tmu_interrupt;
        p->irqaction.dev_id = p;
        p->irqaction.irq = irq;
-        p->irqaction.flags = IRQF_DISABLED | IRQF_TIMER | \
+        p->irqaction.flags = IRQF_TIMER | IRQF_IRQPOLL | IRQF_NOBALANCING;
-                             IRQF_IRQPOLL  | IRQF_NOBALANCING;
        /* get hold of clock */
        p->clk = clk_get(&p->pdev->dev, "tmu_fck");
@@ -523,7 +522,6 @@ static int sh_tmu_probe(struct platform_device *pdev)
        ret = sh_tmu_setup(p, pdev);
        if (ret) {
                kfree(p);
-                platform_set_drvdata(pdev, NULL);
                pm_runtime_idle(&pdev->dev);
                return ret;
        }
diff --git a/drivers/clocksource/sun4i_timer.c b/drivers/clocksource/sun4i_timer.c
index a4f6119aafd8..bf497afba9ad 100644
--- a/drivers/clocksource/sun4i_timer.c
+++ b/drivers/clocksource/sun4i_timer.c
@@ -114,7 +114,7 @@ static int sun4i_clkevt_next_event(unsigned long evt,
 static struct clock_event_device sun4i_clockevent = {
        .name = "sun4i_tick",
-        .rating = 300,
+        .rating = 350,
        .features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT,
        .set_mode = sun4i_clkevt_mode,
        .set_next_event = sun4i_clkevt_next_event,
@@ -138,7 +138,7 @@ static struct irqaction sun4i_timer_irq = {
        .dev_id = &sun4i_clockevent,
 };
-static u32 sun4i_timer_sched_read(void)
+static u64 notrace sun4i_timer_sched_read(void)
 {
        return ~readl(timer_base + TIMER_CNTVAL_REG(1));
 }
@@ -170,9 +170,9 @@ static void __init sun4i_timer_init(struct device_node *node)
               TIMER_CTL_CLK_SRC(TIMER_CTL_CLK_SRC_OSC24M),
               timer_base + TIMER_CTL_REG(1));
-        setup_sched_clock(sun4i_timer_sched_read, 32, rate);
+        sched_clock_register(sun4i_timer_sched_read, 32, rate);
        clocksource_mmio_init(timer_base + TIMER_CNTVAL_REG(1), node->name,
-                              rate, 300, 32, clocksource_mmio_readl_down);
+                              rate, 350, 32, clocksource_mmio_readl_down);
        ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
@@ -190,7 +190,8 @@ static void __init sun4i_timer_init(struct device_node *node)
        val = readl(timer_base + TIMER_IRQ_EN_REG);
        writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
-        sun4i_clockevent.cpumask = cpumask_of(0);
+        sun4i_clockevent.cpumask = cpu_possible_mask;
+        sun4i_clockevent.irq = irq;
        clockevents_config_and_register(&sun4i_clockevent, rate,
                                        TIMER_SYNC_TICKS, 0xffffffff);
diff --git a/drivers/clocksource/tegra20_timer.c b/drivers/clocksource/tegra20_timer.c
index 642849256d82..d1869f02051c 100644
--- a/drivers/clocksource/tegra20_timer.c
+++ b/drivers/clocksource/tegra20_timer.c
@@ -149,7 +149,7 @@ static irqreturn_t tegra_timer_interrupt(int irq, void *dev_id)
 static struct irqaction tegra_timer_irq = {
        .name           = "timer0",
-        .flags          = IRQF_DISABLED | IRQF_TIMER | IRQF_TRIGGER_HIGH,
+        .flags          = IRQF_TIMER | IRQF_TRIGGER_HIGH,
        .handler        = tegra_timer_interrupt,
        .dev_id         = &tegra_clockevent,
 };
diff --git a/drivers/clocksource/time-armada-370-xp.c b/drivers/clocksource/time-armada-370-xp.c
index 4e7f6802e840..ee8691b89944 100644
--- a/drivers/clocksource/time-armada-370-xp.c
+++ b/drivers/clocksource/time-armada-370-xp.c
@@ -76,6 +76,7 @@
 static void __iomem *timer_base, *local_base;
 static unsigned int timer_clk;
 static bool timer25Mhz = true;
+static u32 enable_mask;
 /*
 * Number of timer ticks per jiffy.
@@ -121,8 +122,7 @@ armada_370_xp_clkevt_next_event(unsigned long delta,
        /*
         * Enable the timer.
         */
-        local_timer_ctrl_clrset(TIMER0_RELOAD_EN,
+        local_timer_ctrl_clrset(TIMER0_RELOAD_EN, enable_mask);
-                                TIMER0_EN | TIMER0_DIV(TIMER_DIVIDER_SHIFT));
        return 0;
 }
@@ -141,9 +141,7 @@ armada_370_xp_clkevt_mode(enum clock_event_mode mode,
                /*
                 * Enable timer.
                 */
-                local_timer_ctrl_clrset(0, TIMER0_RELOAD_EN |
+                local_timer_ctrl_clrset(0, TIMER0_RELOAD_EN | enable_mask);
-                                           TIMER0_EN |
-                                           TIMER0_DIV(TIMER_DIVIDER_SHIFT));
        } else {
                /*
                 * Disable timer.
@@ -240,10 +238,13 @@ static void __init armada_370_xp_timer_common_init(struct device_node *np)
        WARN_ON(!timer_base);
        local_base = of_iomap(np, 1);
-        if (timer25Mhz)
+        if (timer25Mhz) {
                set = TIMER0_25MHZ;             
-        else
+                enable_mask = TIMER0_EN;
+        } else {
                clr = TIMER0_25MHZ;
+                enable_mask = TIMER0_EN | TIMER0_DIV(TIMER_DIVIDER_SHIFT);
+        }
        timer_ctrl_clrset(clr, set);
        local_timer_ctrl_clrset(clr, set);
@@ -262,8 +263,7 @@ static void __init armada_370_xp_timer_common_init(struct device_node *np)
        writel(0xffffffff, timer_base + TIMER0_VAL_OFF);
        writel(0xffffffff, timer_base + TIMER0_RELOAD_OFF);
-        timer_ctrl_clrset(0, TIMER0_EN | TIMER0_RELOAD_EN |
+        timer_ctrl_clrset(0, TIMER0_RELOAD_EN | enable_mask);
-                             TIMER0_DIV(TIMER_DIVIDER_SHIFT));
        /*
         * Set scale and timer for sched_clock.
diff --git a/drivers/clocksource/time-orion.c b/drivers/clocksource/time-orion.c
index 9c7f018a67ca..20066222f3f2 100644
--- a/drivers/clocksource/time-orion.c
+++ b/drivers/clocksource/time-orion.c
@@ -53,7 +53,7 @@ EXPORT_SYMBOL(orion_timer_ctrl_clrset);
 /*
 * Free-running clocksource handling.
 */
-static u32 notrace orion_read_sched_clock(void)
+static u64 notrace orion_read_sched_clock(void)
 {
        return ~readl(timer_base + TIMER0_VAL);
 }
@@ -135,7 +135,7 @@ static void __init orion_timer_init(struct device_node *np)
        clocksource_mmio_init(timer_base + TIMER0_VAL, "orion_clocksource",
                              clk_get_rate(clk), 300, 32,
                              clocksource_mmio_readl_down);
-        setup_sched_clock(orion_read_sched_clock, 32, clk_get_rate(clk));
+        sched_clock_register(orion_read_sched_clock, 32, clk_get_rate(clk));
        /* setup timer1 as clockevent timer */
        if (setup_irq(irq, &orion_clkevt_irq))
diff --git a/drivers/clocksource/timer-sun5i.c b/drivers/clocksource/timer-sun5i.c
new file mode 100644
index 000000000000..deebcd6469fc
--- /dev/null
+++ b/drivers/clocksource/timer-sun5i.c
@@ -0,0 +1,192 @@
+/*
+ * Allwinner SoCs hstimer driver.
+ *
+ * Copyright (C) 2013 Maxime Ripard
+ *
+ * Maxime Ripard <maxime.ripard@free-electrons.com>
+ *
+ * This file is licensed under the terms of the GNU General Public
+ * License version 2.  This program is licensed "as is" without any
+ * warranty of any kind, whether express or implied.
+ */
+#include <linux/clk.h>
+#include <linux/clockchips.h>
+#include <linux/delay.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/irqreturn.h>
+#include <linux/sched_clock.h>
+#include <linux/of.h>
+#include <linux/of_address.h>
+#include <linux/of_irq.h>
+#define TIMER_IRQ_EN_REG                0x00
+#define TIMER_IRQ_EN(val)                       BIT(val)
+#define TIMER_IRQ_ST_REG                0x04
+#define TIMER_CTL_REG(val)              (0x20 * (val) + 0x10)
+#define TIMER_CTL_ENABLE                        BIT(0)
+#define TIMER_CTL_RELOAD                        BIT(1)
+#define TIMER_CTL_CLK_PRES(val)                 (((val) & 0x7) << 4)
+#define TIMER_CTL_ONESHOT                       BIT(7)
+#define TIMER_INTVAL_LO_REG(val)        (0x20 * (val) + 0x14)
+#define TIMER_INTVAL_HI_REG(val)        (0x20 * (val) + 0x18)
+#define TIMER_CNTVAL_LO_REG(val)        (0x20 * (val) + 0x1c)
+#define TIMER_CNTVAL_HI_REG(val)        (0x20 * (val) + 0x20)
+#define TIMER_SYNC_TICKS        3
+static void __iomem *timer_base;
+static u32 ticks_per_jiffy;
+/*
+ * When we disable a timer, we need to wait at least for 2 cycles of
+ * the timer source clock. We will use for that the clocksource timer
+ * that is already setup and runs at the same frequency than the other
+ * timers, and we never will be disabled.
+ */
+static void sun5i_clkevt_sync(void)
+{
+        u32 old = readl(timer_base + TIMER_CNTVAL_LO_REG(1));
+        while ((old - readl(timer_base + TIMER_CNTVAL_LO_REG(1))) < TIMER_SYNC_TICKS)
+                cpu_relax();
+}
+static void sun5i_clkevt_time_stop(u8 timer)
+{
+        u32 val = readl(timer_base + TIMER_CTL_REG(timer));
+        writel(val & ~TIMER_CTL_ENABLE, timer_base + TIMER_CTL_REG(timer));
+        sun5i_clkevt_sync();
+}
+static void sun5i_clkevt_time_setup(u8 timer, u32 delay)
+{
+        writel(delay, timer_base + TIMER_INTVAL_LO_REG(timer));
+}
+static void sun5i_clkevt_time_start(u8 timer, bool periodic)
+{
+        u32 val = readl(timer_base + TIMER_CTL_REG(timer));
+        if (periodic)
+                val &= ~TIMER_CTL_ONESHOT;
+        else
+                val |= TIMER_CTL_ONESHOT;
+        writel(val | TIMER_CTL_ENABLE | TIMER_CTL_RELOAD,
+               timer_base + TIMER_CTL_REG(timer));
+}
+static void sun5i_clkevt_mode(enum clock_event_mode mode,
+                              struct clock_event_device *clk)
+{
+        switch (mode) {
+        case CLOCK_EVT_MODE_PERIODIC:
+                sun5i_clkevt_time_stop(0);
+                sun5i_clkevt_time_setup(0, ticks_per_jiffy);
+                sun5i_clkevt_time_start(0, true);
+                break;
+        case CLOCK_EVT_MODE_ONESHOT:
+                sun5i_clkevt_time_stop(0);
+                sun5i_clkevt_time_start(0, false);
+                break;
+        case CLOCK_EVT_MODE_UNUSED:
+        case CLOCK_EVT_MODE_SHUTDOWN:
+        default:
+                sun5i_clkevt_time_stop(0);
+                break;
+        }
+}
+static int sun5i_clkevt_next_event(unsigned long evt,
+                                   struct clock_event_device *unused)
+{
+        sun5i_clkevt_time_stop(0);
+        sun5i_clkevt_time_setup(0, evt - TIMER_SYNC_TICKS);
+        sun5i_clkevt_time_start(0, false);
+        return 0;
+}
+static struct clock_event_device sun5i_clockevent = {
+        .name = "sun5i_tick",
+        .rating = 340,
+        .features = CLOCK_EVT_FEAT_PERIODIC | CLOCK_EVT_FEAT_ONESHOT,
+        .set_mode = sun5i_clkevt_mode,
+        .set_next_event = sun5i_clkevt_next_event,
+};
+static irqreturn_t sun5i_timer_interrupt(int irq, void *dev_id)
+{
+        struct clock_event_device *evt = (struct clock_event_device *)dev_id;
+        writel(0x1, timer_base + TIMER_IRQ_ST_REG);
+        evt->event_handler(evt);
+        return IRQ_HANDLED;
+}
+static struct irqaction sun5i_timer_irq = {
+        .name = "sun5i_timer0",
+        .flags = IRQF_TIMER | IRQF_IRQPOLL,
+        .handler = sun5i_timer_interrupt,
+        .dev_id = &sun5i_clockevent,
+};
+static u64 sun5i_timer_sched_read(void)
+{
+        return ~readl(timer_base + TIMER_CNTVAL_LO_REG(1));
+}
+static void __init sun5i_timer_init(struct device_node *node)
+{
+        unsigned long rate;
+        struct clk *clk;
+        int ret, irq;
+        u32 val;
+        timer_base = of_iomap(node, 0);
+        if (!timer_base)
+                panic("Can't map registers");
+        irq = irq_of_parse_and_map(node, 0);
+        if (irq <= 0)
+                panic("Can't parse IRQ");
+        clk = of_clk_get(node, 0);
+        if (IS_ERR(clk))
+                panic("Can't get timer clock");
+        clk_prepare_enable(clk);
+        rate = clk_get_rate(clk);
+        writel(~0, timer_base + TIMER_INTVAL_LO_REG(1));
+        writel(TIMER_CTL_ENABLE | TIMER_CTL_RELOAD,
+               timer_base + TIMER_CTL_REG(1));
+        sched_clock_register(sun5i_timer_sched_read, 32, rate);
+        clocksource_mmio_init(timer_base + TIMER_CNTVAL_LO_REG(1), node->name,
+                              rate, 340, 32, clocksource_mmio_readl_down);
+        ticks_per_jiffy = DIV_ROUND_UP(rate, HZ);
+        ret = setup_irq(irq, &sun5i_timer_irq);
+        if (ret)
+                pr_warn("failed to setup irq %d\n", irq);
+        /* Enable timer0 interrupt */
+        val = readl(timer_base + TIMER_IRQ_EN_REG);
+        writel(val | TIMER_IRQ_EN(0), timer_base + TIMER_IRQ_EN_REG);
+        sun5i_clockevent.cpumask = cpu_possible_mask;
+        sun5i_clockevent.irq = irq;
+        clockevents_config_and_register(&sun5i_clockevent, rate,
+                                        TIMER_SYNC_TICKS, 0xffffffff);
+}
+CLOCKSOURCE_OF_DECLARE(sun5i_a13, "allwinner,sun5i-a13-hstimer",
+                       sun5i_timer_init);
+CLOCKSOURCE_OF_DECLARE(sun7i_a20, "allwinner,sun7i-a20-hstimer",
+                       sun5i_timer_init);
diff --git a/drivers/clocksource/vt8500_timer.c b/drivers/clocksource/vt8500_timer.c
index ad3c0e83a779..1098ed3b9b89 100644
--- a/drivers/clocksource/vt8500_timer.c
+++ b/drivers/clocksource/vt8500_timer.c
@@ -124,7 +124,7 @@ static irqreturn_t vt8500_timer_interrupt(int irq, void *dev_id)
 static struct irqaction irq = {
        .name    = "vt8500_timer",
-        .flags   = IRQF_DISABLED | IRQF_TIMER | IRQF_IRQPOLL,
+        .flags   = IRQF_TIMER | IRQF_IRQPOLL,
        .handler = vt8500_timer_interrupt,
        .dev_id  = &clockevent,
 };
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 02d534da22dd..8d19f7c06010 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -828,14 +828,17 @@ static void cpufreq_init_policy(struct cpufreq_policy *policy)
        int ret = 0;
        memcpy(&new_policy, policy, sizeof(*policy));
+        /* Use the default policy if its valid. */
+        if (cpufreq_driver->setpolicy)
+                cpufreq_parse_governor(policy->governor->name,
+                                        &new_policy.policy, NULL);
        /* assure that the starting sequence is run in cpufreq_set_policy */
        policy->governor = NULL;
        /* set default policy */
        ret = cpufreq_set_policy(policy, &new_policy);
-        policy->user_policy.policy = policy->policy;
-        policy->user_policy.governor = policy->governor;
        if (ret) {
                pr_debug("setting policy failed\n");
                if (cpufreq_driver->exit)
@@ -845,8 +848,7 @@ static void cpufreq_init_policy(struct cpufreq_policy *policy)
 #ifdef CONFIG_HOTPLUG_CPU
 static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy,
-                                  unsigned int cpu, struct device *dev,
+                                  unsigned int cpu, struct device *dev)
-                                  bool frozen)
 {
        int ret = 0;
        unsigned long flags;
@@ -877,11 +879,7 @@ static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy,
                }
        }
-        /* Don't touch sysfs links during light-weight init */
+        return sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq");
-        if (!frozen)
-                ret = sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq");
-        return ret;
 }
 #endif
@@ -926,6 +924,27 @@ err_free_policy:
        return NULL;
 }
+static void cpufreq_policy_put_kobj(struct cpufreq_policy *policy)
+{
+        struct kobject *kobj;
+        struct completion *cmp;
+        down_read(&policy->rwsem);
+        kobj = &policy->kobj;
+        cmp = &policy->kobj_unregister;
+        up_read(&policy->rwsem);
+        kobject_put(kobj);
+        /*
+         * We need to make sure that the underlying kobj is
+         * actually not referenced anymore by anybody before we
+         * proceed with unloading.
+         */
+        pr_debug("waiting for dropping of refcount\n");
+        wait_for_completion(cmp);
+        pr_debug("wait complete\n");
+}
 static void cpufreq_policy_free(struct cpufreq_policy *policy)
 {
        free_cpumask_var(policy->related_cpus);
@@ -986,7 +1005,7 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
        list_for_each_entry(tpolicy, &cpufreq_policy_list, policy_list) {
                if (cpumask_test_cpu(cpu, tpolicy->related_cpus)) {
                        read_unlock_irqrestore(&cpufreq_driver_lock, flags);
-                        ret = cpufreq_add_policy_cpu(tpolicy, cpu, dev, frozen);
+                        ret = cpufreq_add_policy_cpu(tpolicy, cpu, dev);
                        up_read(&cpufreq_rwsem);
                        return ret;
                }
@@ -994,15 +1013,17 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
        read_unlock_irqrestore(&cpufreq_driver_lock, flags);
 #endif
-        if (frozen)
+        /*
-                /* Restore the saved policy when doing light-weight init */
+         * Restore the saved policy when doing light-weight init and fall back
-                policy = cpufreq_policy_restore(cpu);
+         * to the full init if that fails.
-        else
+         */
+        policy = frozen ? cpufreq_policy_restore(cpu) : NULL;
+        if (!policy) {
+                frozen = false;
                policy = cpufreq_policy_alloc();
+                if (!policy)
-        if (!policy)
+                        goto nomem_out;
-                goto nomem_out;
+        }
        /*
         * In the resume path, since we restore a saved policy, the assignment
@@ -1047,8 +1068,10 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
         */
        cpumask_and(policy->cpus, policy->cpus, cpu_online_mask);
-        policy->user_policy.min = policy->min;
+        if (!frozen) {
-        policy->user_policy.max = policy->max;
+                policy->user_policy.min = policy->min;
+                policy->user_policy.max = policy->max;
+        }
        blocking_notifier_call_chain(&cpufreq_policy_notifier_list,
                                     CPUFREQ_START, policy);
@@ -1079,6 +1102,11 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif,
        cpufreq_init_policy(policy);
+        if (!frozen) {
+                policy->user_policy.policy = policy->policy;
+                policy->user_policy.governor = policy->governor;
+        }
        kobject_uevent(&policy->kobj, KOBJ_ADD);
        up_read(&cpufreq_rwsem);
@@ -1096,7 +1124,13 @@ err_get_freq:
        if (cpufreq_driver->exit)
                cpufreq_driver->exit(policy);
 err_set_policy_cpu:
+        if (frozen) {
+                /* Do not leave stale fallback data behind. */
+                per_cpu(cpufreq_cpu_data_fallback, cpu) = NULL;
+                cpufreq_policy_put_kobj(policy);
+        }
        cpufreq_policy_free(policy);
 nomem_out:
        up_read(&cpufreq_rwsem);
@@ -1118,7 +1152,7 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif)
 }
 static int cpufreq_nominate_new_policy_cpu(struct cpufreq_policy *policy,
-                                           unsigned int old_cpu, bool frozen)
+                                           unsigned int old_cpu)
 {
        struct device *cpu_dev;
        int ret;
@@ -1126,10 +1160,6 @@ static int cpufreq_nominate_new_policy_cpu(struct cpufreq_policy *policy,
        /* first sibling now owns the new sysfs dir */
        cpu_dev = get_cpu_device(cpumask_any_but(policy->cpus, old_cpu));
-        /* Don't touch sysfs files during light-weight tear-down */
-        if (frozen)
-                return cpu_dev->id;
        sysfs_remove_link(&cpu_dev->kobj, "cpufreq");
        ret = kobject_move(&policy->kobj, &cpu_dev->kobj);
        if (ret) {
@@ -1196,7 +1226,7 @@ static int __cpufreq_remove_dev_prepare(struct device *dev,
                if (!frozen)
                        sysfs_remove_link(&dev->kobj, "cpufreq");
        } else if (cpus > 1) {
-                new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu, frozen);
+                new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu);
                if (new_cpu >= 0) {
                        update_policy_cpu(policy, new_cpu);
@@ -1218,8 +1248,6 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
        int ret;
        unsigned long flags;
        struct cpufreq_policy *policy;
-        struct kobject *kobj;
-        struct completion *cmp;
        read_lock_irqsave(&cpufreq_driver_lock, flags);
        policy = per_cpu(cpufreq_cpu_data, cpu);
@@ -1249,22 +1277,8 @@ static int __cpufreq_remove_dev_finish(struct device *dev,
                        }
                }
-                if (!frozen) {
+                if (!frozen)
-                        down_read(&policy->rwsem);
+                        cpufreq_policy_put_kobj(policy);
-                        kobj = &policy->kobj;
-                        cmp = &policy->kobj_unregister;
-                        up_read(&policy->rwsem);
-                        kobject_put(kobj);
-                        /*
-                         * We need to make sure that the underlying kobj is
-                         * actually not referenced anymore by anybody before we
-                         * proceed with unloading.
-                         */
-                        pr_debug("waiting for dropping of refcount\n");
-                        wait_for_completion(cmp);
-                        pr_debug("wait complete\n");
-                }
                /*
                 * Perform the ->exit() even during light-weight tear-down,
diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c
index 5f1cbae36961..d51f17ed691e 100644
--- a/drivers/cpufreq/intel_pstate.c
+++ b/drivers/cpufreq/intel_pstate.c
@@ -581,7 +581,8 @@ static void intel_pstate_timer_func(unsigned long __data)
 }
 #define ICPU(model, policy) \
-        { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (unsigned long)&policy }
+        { X86_VENDOR_INTEL, 6, model, X86_FEATURE_APERFMPERF,\
+                        (unsigned long)&policy }
 static const struct x86_cpu_id intel_pstate_cpu_ids[] = {
        ICPU(0x2a, core_params),
@@ -614,6 +615,11 @@ static int intel_pstate_init_cpu(unsigned int cpunum)
        cpu = all_cpu_data[cpunum];
        intel_pstate_get_cpu_pstates(cpu);
+        if (!cpu->pstate.current_pstate) {
+                all_cpu_data[cpunum] = NULL;
+                kfree(cpu);
+                return -ENODATA;
+        }
        cpu->cpu = cpunum;
diff --git a/drivers/cpuidle/cpuidle-calxeda.c b/drivers/cpuidle/cpuidle-calxeda.c
index 36795639df0d..6e51114057d0 100644
--- a/drivers/cpuidle/cpuidle-calxeda.c
+++ b/drivers/cpuidle/cpuidle-calxeda.c
@@ -65,7 +65,7 @@ static struct cpuidle_driver calxeda_idle_driver = {
        .state_count = 2,
 };
-static int __init calxeda_cpuidle_probe(struct platform_device *pdev)
+static int calxeda_cpuidle_probe(struct platform_device *pdev)
 {
        return cpuidle_register(&calxeda_idle_driver, NULL);
 }
diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c
index 9dd6e01eac33..f757a0f428bd 100644
--- a/drivers/crypto/ixp4xx_crypto.c
+++ b/drivers/crypto/ixp4xx_crypto.c
@@ -1410,14 +1410,12 @@ static const struct platform_device_info ixp_dev_info __initdata = {
 static int __init ixp_module_init(void)
 {
        int num = ARRAY_SIZE(ixp4xx_algos);
-        int i, err ;
+        int i, err;
        pdev = platform_device_register_full(&ixp_dev_info);
        if (IS_ERR(pdev))
                return PTR_ERR(pdev);
-        dev = &pdev->dev;
        spin_lock_init(&desc_lock);
        spin_lock_init(&emerg_lock);
diff --git a/drivers/dma/ioat/dma.c b/drivers/dma/ioat/dma.c
index 1a49c777607c..87529181efcc 100644
--- a/drivers/dma/ioat/dma.c
+++ b/drivers/dma/ioat/dma.c
@@ -817,7 +817,15 @@ int ioat_dma_self_test(struct ioatdma_device *device)
        }
        dma_src = dma_map_single(dev, src, IOAT_TEST_SIZE, DMA_TO_DEVICE);
+        if (dma_mapping_error(dev, dma_src)) {
+                dev_err(dev, "mapping src buffer failed\n");
+                goto free_resources;
+        }
        dma_dest = dma_map_single(dev, dest, IOAT_TEST_SIZE, DMA_FROM_DEVICE);
+        if (dma_mapping_error(dev, dma_dest)) {
+                dev_err(dev, "mapping dest buffer failed\n");
+                goto unmap_src;
+        }
        flags = DMA_PREP_INTERRUPT;
        tx = device->common.device_prep_dma_memcpy(dma_chan, dma_dest, dma_src,
                                                   IOAT_TEST_SIZE, flags);
@@ -855,8 +863,9 @@ int ioat_dma_self_test(struct ioatdma_device *device)
        }
 unmap_dma:
-        dma_unmap_single(dev, dma_src, IOAT_TEST_SIZE, DMA_TO_DEVICE);
        dma_unmap_single(dev, dma_dest, IOAT_TEST_SIZE, DMA_FROM_DEVICE);
+unmap_src:
+        dma_unmap_single(dev, dma_src, IOAT_TEST_SIZE, DMA_TO_DEVICE);
 free_resources:
        dma->device_free_chan_resources(dma_chan);
 out:
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index b53d0de17e15..98e14ee4833c 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -1,7 +1,7 @@
 #include "amd64_edac.h"
 #include <asm/amd_nb.h>
-static struct edac_pci_ctl_info *amd64_ctl_pci;
+static struct edac_pci_ctl_info *pci_ctl;
 static int report_gart_errors;
 module_param(report_gart_errors, int, 0644);
@@ -162,7 +162,7 @@ static int f15_read_dct_pci_cfg(struct amd64_pvt *pvt, int addr, u32 *val,
 * scan the scrub rate mapping table for a close or matching bandwidth value to
 * issue. If requested is too big, then use last maximum value found.
 */
-static int __amd64_set_scrub_rate(struct pci_dev *ctl, u32 new_bw, u32 min_rate)
+static int __set_scrub_rate(struct pci_dev *ctl, u32 new_bw, u32 min_rate)
 {
        u32 scrubval;
        int i;
@@ -198,7 +198,7 @@ static int __amd64_set_scrub_rate(struct pci_dev *ctl, u32 new_bw, u32 min_rate)
        return 0;
 }
-static int amd64_set_scrub_rate(struct mem_ctl_info *mci, u32 bw)
+static int set_scrub_rate(struct mem_ctl_info *mci, u32 bw)
 {
        struct amd64_pvt *pvt = mci->pvt_info;
        u32 min_scrubrate = 0x5;
@@ -210,10 +210,10 @@ static int amd64_set_scrub_rate(struct mem_ctl_info *mci, u32 bw)
        if (pvt->fam == 0x15 && pvt->model < 0x10)
                f15h_select_dct(pvt, 0);
-        return __amd64_set_scrub_rate(pvt->F3, bw, min_scrubrate);
+        return __set_scrub_rate(pvt->F3, bw, min_scrubrate);
 }
-static int amd64_get_scrub_rate(struct mem_ctl_info *mci)
+static int get_scrub_rate(struct mem_ctl_info *mci)
 {
        struct amd64_pvt *pvt = mci->pvt_info;
        u32 scrubval = 0;
@@ -240,8 +240,7 @@ static int amd64_get_scrub_rate(struct mem_ctl_info *mci)
 * returns true if the SysAddr given by sys_addr matches the
 * DRAM base/limit associated with node_id
 */
-static bool amd64_base_limit_match(struct amd64_pvt *pvt, u64 sys_addr,
+static bool base_limit_match(struct amd64_pvt *pvt, u64 sys_addr, u8 nid)
-                                   u8 nid)
 {
        u64 addr;
@@ -285,7 +284,7 @@ static struct mem_ctl_info *find_mc_by_sys_addr(struct mem_ctl_info *mci,
        if (intlv_en == 0) {
                for (node_id = 0; node_id < DRAM_RANGES; node_id++) {
-                        if (amd64_base_limit_match(pvt, sys_addr, node_id))
+                        if (base_limit_match(pvt, sys_addr, node_id))
                                goto found;
                }
                goto err_no_match;
@@ -309,7 +308,7 @@ static struct mem_ctl_info *find_mc_by_sys_addr(struct mem_ctl_info *mci,
        }
        /* sanity test for sys_addr */
-        if (unlikely(!amd64_base_limit_match(pvt, sys_addr, node_id))) {
+        if (unlikely(!base_limit_match(pvt, sys_addr, node_id))) {
                amd64_warn("%s: sys_addr 0x%llx falls outside base/limit address"
                           "range for node %d with node interleaving enabled.\n",
                           __func__, sys_addr, node_id);
@@ -660,7 +659,7 @@ static int get_channel_from_ecc_syndrome(struct mem_ctl_info *, u16);
 * Determine if the DIMMs have ECC enabled. ECC is enabled ONLY if all the DIMMs
 * are ECC capable.
 */
-static unsigned long amd64_determine_edac_cap(struct amd64_pvt *pvt)
+static unsigned long determine_edac_cap(struct amd64_pvt *pvt)
 {
        u8 bit;
        unsigned long edac_cap = EDAC_FLAG_NONE;
@@ -675,9 +674,9 @@ static unsigned long amd64_determine_edac_cap(struct amd64_pvt *pvt)
        return edac_cap;
 }
-static void amd64_debug_display_dimm_sizes(struct amd64_pvt *, u8);
+static void debug_display_dimm_sizes(struct amd64_pvt *, u8);
-static void amd64_dump_dramcfg_low(struct amd64_pvt *pvt, u32 dclr, int chan)
+static void debug_dump_dramcfg_low(struct amd64_pvt *pvt, u32 dclr, int chan)
 {
        edac_dbg(1, "F2x%d90 (DRAM Cfg Low): 0x%08x\n", chan, dclr);
@@ -711,7 +710,7 @@ static void dump_misc_regs(struct amd64_pvt *pvt)
                 (pvt->nbcap & NBCAP_SECDED) ? "yes" : "no",
                 (pvt->nbcap & NBCAP_CHIPKILL) ? "yes" : "no");
-        amd64_dump_dramcfg_low(pvt, pvt->dclr0, 0);
+        debug_dump_dramcfg_low(pvt, pvt->dclr0, 0);
        edac_dbg(1, "F3xB0 (Online Spare): 0x%08x\n", pvt->online_spare);
@@ -722,19 +721,19 @@ static void dump_misc_regs(struct amd64_pvt *pvt)
        edac_dbg(1, "  DramHoleValid: %s\n", dhar_valid(pvt) ? "yes" : "no");
-        amd64_debug_display_dimm_sizes(pvt, 0);
+        debug_display_dimm_sizes(pvt, 0);
        /* everything below this point is Fam10h and above */
        if (pvt->fam == 0xf)
                return;
-        amd64_debug_display_dimm_sizes(pvt, 1);
+        debug_display_dimm_sizes(pvt, 1);
        amd64_info("using %s syndromes.\n", ((pvt->ecc_sym_sz == 8) ? "x8" : "x4"));
        /* Only if NOT ganged does dclr1 have valid info */
        if (!dct_ganging_enabled(pvt))
-                amd64_dump_dramcfg_low(pvt, pvt->dclr1, 1);
+                debug_dump_dramcfg_low(pvt, pvt->dclr1, 1);
 }
 /*
@@ -800,7 +799,7 @@ static void read_dct_base_mask(struct amd64_pvt *pvt)
        }
 }
-static enum mem_type amd64_determine_memory_type(struct amd64_pvt *pvt, int cs)
+static enum mem_type determine_memory_type(struct amd64_pvt *pvt, int cs)
 {
        enum mem_type type;
@@ -1578,7 +1577,7 @@ static int f15_m30h_match_to_this_node(struct amd64_pvt *pvt, unsigned range,
                                             num_dcts_intlv, dct_sel);
        /* Verify we stay within the MAX number of channels allowed */
-        if (channel > 4 || channel < 0)
+        if (channel > 3)
                return -EINVAL;
        leg_mmio_hole = (u8) (dct_cont_base_reg >> 1 & BIT(0));
@@ -1702,7 +1701,7 @@ static void f1x_map_sysaddr_to_csrow(struct mem_ctl_info *mci, u64 sys_addr,
 * debug routine to display the memory sizes of all logical DIMMs and its
 * CSROWs
 */
-static void amd64_debug_display_dimm_sizes(struct amd64_pvt *pvt, u8 ctrl)
+static void debug_display_dimm_sizes(struct amd64_pvt *pvt, u8 ctrl)
 {
        int dimm, size0, size1;
        u32 *dcsb = ctrl ? pvt->csels[1].csbases : pvt->csels[0].csbases;
@@ -1744,7 +1743,7 @@ static void amd64_debug_display_dimm_sizes(struct amd64_pvt *pvt, u8 ctrl)
        }
 }
-static struct amd64_family_type amd64_family_types[] = {
+static struct amd64_family_type family_types[] = {
        [K8_CPUS] = {
                .ctl_name = "K8",
                .f1_id = PCI_DEVICE_ID_AMD_K8_NB_ADDRMAP,
@@ -2005,9 +2004,9 @@ static void __log_bus_error(struct mem_ctl_info *mci, struct err_info *err,
                             string, "");
 }
-static inline void __amd64_decode_bus_error(struct mem_ctl_info *mci,
+static inline void decode_bus_error(int node_id, struct mce *m)
-                                            struct mce *m)
 {
+        struct mem_ctl_info *mci = mcis[node_id];
        struct amd64_pvt *pvt = mci->pvt_info;
        u8 ecc_type = (m->status >> 45) & 0x3;
        u8 xec = XEC(m->status, 0x1f);
@@ -2035,11 +2034,6 @@ static inline void __amd64_decode_bus_error(struct mem_ctl_info *mci,
        __log_bus_error(mci, &err, ecc_type);
 }
-void amd64_decode_bus_error(int node_id, struct mce *m)
-{
-        __amd64_decode_bus_error(mcis[node_id], m);
-}
 /*
 * Use pvt->F2 which contains the F2 CPU PCI device to get the related
 * F1 (AddrMap) and F3 (Misc) devices. Return negative value on error.
@@ -2196,7 +2190,7 @@ static void read_mc_regs(struct amd64_pvt *pvt)
 *      encompasses
 *
 */
-static u32 amd64_csrow_nr_pages(struct amd64_pvt *pvt, u8 dct, int csrow_nr)
+static u32 get_csrow_nr_pages(struct amd64_pvt *pvt, u8 dct, int csrow_nr)
 {
        u32 cs_mode, nr_pages;
        u32 dbam = dct ? pvt->dbam1 : pvt->dbam0;
@@ -2263,19 +2257,19 @@ static int init_csrows(struct mem_ctl_info *mci)
                            pvt->mc_node_id, i);
                if (row_dct0) {
-                        nr_pages = amd64_csrow_nr_pages(pvt, 0, i);
+                        nr_pages = get_csrow_nr_pages(pvt, 0, i);
                        csrow->channels[0]->dimm->nr_pages = nr_pages;
                }
                /* K8 has only one DCT */
                if (pvt->fam != 0xf && row_dct1) {
-                        int row_dct1_pages = amd64_csrow_nr_pages(pvt, 1, i);
+                        int row_dct1_pages = get_csrow_nr_pages(pvt, 1, i);
                        csrow->channels[1]->dimm->nr_pages = row_dct1_pages;
                        nr_pages += row_dct1_pages;
                }
-                mtype = amd64_determine_memory_type(pvt, i);
+                mtype = determine_memory_type(pvt, i);
                edac_dbg(1, "Total csrow%d pages: %u\n", i, nr_pages);
@@ -2309,7 +2303,7 @@ static void get_cpus_on_this_dct_cpumask(struct cpumask *mask, u16 nid)
 }
 /* check MCG_CTL on all the cpus on this node */
-static bool amd64_nb_mce_bank_enabled_on_node(u16 nid)
+static bool nb_mce_bank_enabled_on_node(u16 nid)
 {
        cpumask_var_t mask;
        int cpu, nbe;
@@ -2482,7 +2476,7 @@ static bool ecc_enabled(struct pci_dev *F3, u16 nid)
        ecc_en = !!(value & NBCFG_ECC_ENABLE);
        amd64_info("DRAM ECC %s.\n", (ecc_en ? "enabled" : "disabled"));
-        nb_mce_en = amd64_nb_mce_bank_enabled_on_node(nid);
+        nb_mce_en = nb_mce_bank_enabled_on_node(nid);
        if (!nb_mce_en)
                amd64_notice("NB MCE bank disabled, set MSR "
                             "0x%08x[4] on node %d to enable.\n",
@@ -2537,7 +2531,7 @@ static void setup_mci_misc_attrs(struct mem_ctl_info *mci,
        if (pvt->nbcap & NBCAP_CHIPKILL)
                mci->edac_ctl_cap |= EDAC_FLAG_S4ECD4ED;
-        mci->edac_cap           = amd64_determine_edac_cap(pvt);
+        mci->edac_cap           = determine_edac_cap(pvt);
        mci->mod_name           = EDAC_MOD_STR;
        mci->mod_ver            = EDAC_AMD64_VERSION;
        mci->ctl_name           = fam->ctl_name;
@@ -2545,14 +2539,14 @@ static void setup_mci_misc_attrs(struct mem_ctl_info *mci,
        mci->ctl_page_to_phys   = NULL;
        /* memory scrubber interface */
-        mci->set_sdram_scrub_rate = amd64_set_scrub_rate;
+        mci->set_sdram_scrub_rate = set_scrub_rate;
-        mci->get_sdram_scrub_rate = amd64_get_scrub_rate;
+        mci->get_sdram_scrub_rate = get_scrub_rate;
 }
 /*
 * returns a pointer to the family descriptor on success, NULL otherwise.
 */
-static struct amd64_family_type *amd64_per_family_init(struct amd64_pvt *pvt)
+static struct amd64_family_type *per_family_init(struct amd64_pvt *pvt)
 {
        struct amd64_family_type *fam_type = NULL;
@@ -2563,29 +2557,29 @@ static struct amd64_family_type *amd64_per_family_init(struct amd64_pvt *pvt)
        switch (pvt->fam) {
        case 0xf:
-                fam_type                = &amd64_family_types[K8_CPUS];
+                fam_type        = &family_types[K8_CPUS];
-                pvt->ops                = &amd64_family_types[K8_CPUS].ops;
+                pvt->ops        = &family_types[K8_CPUS].ops;
                break;
        case 0x10:
-                fam_type                = &amd64_family_types[F10_CPUS];
+                fam_type        = &family_types[F10_CPUS];
-                pvt->ops                = &amd64_family_types[F10_CPUS].ops;
+                pvt->ops        = &family_types[F10_CPUS].ops;
                break;
        case 0x15:
                if (pvt->model == 0x30) {
-                        fam_type        = &amd64_family_types[F15_M30H_CPUS];
+                        fam_type = &family_types[F15_M30H_CPUS];
-                        pvt->ops        = &amd64_family_types[F15_M30H_CPUS].ops;
+                        pvt->ops = &family_types[F15_M30H_CPUS].ops;
                        break;
                }
-                fam_type                = &amd64_family_types[F15_CPUS];
+                fam_type        = &family_types[F15_CPUS];
-                pvt->ops                = &amd64_family_types[F15_CPUS].ops;
+                pvt->ops        = &family_types[F15_CPUS].ops;
                break;
        case 0x16:
-                fam_type                = &amd64_family_types[F16_CPUS];
+                fam_type        = &family_types[F16_CPUS];
-                pvt->ops                = &amd64_family_types[F16_CPUS].ops;
+                pvt->ops        = &family_types[F16_CPUS].ops;
                break;
        default:
@@ -2601,7 +2595,7 @@ static struct amd64_family_type *amd64_per_family_init(struct amd64_pvt *pvt)
        return fam_type;
 }
-static int amd64_init_one_instance(struct pci_dev *F2)
+static int init_one_instance(struct pci_dev *F2)
 {
        struct amd64_pvt *pvt = NULL;
        struct amd64_family_type *fam_type = NULL;
@@ -2619,7 +2613,7 @@ static int amd64_init_one_instance(struct pci_dev *F2)
        pvt->F2 = F2;
        ret = -EINVAL;
-        fam_type = amd64_per_family_init(pvt);
+        fam_type = per_family_init(pvt);
        if (!fam_type)
                goto err_free;
@@ -2680,7 +2674,7 @@ static int amd64_init_one_instance(struct pci_dev *F2)
        if (report_gart_errors)
                amd_report_gart_errors(true);
-        amd_register_ecc_decoder(amd64_decode_bus_error);
+        amd_register_ecc_decoder(decode_bus_error);
        mcis[nid] = mci;
@@ -2703,8 +2697,8 @@ err_ret:
        return ret;
 }
-static int amd64_probe_one_instance(struct pci_dev *pdev,
+static int probe_one_instance(struct pci_dev *pdev,
-                                    const struct pci_device_id *mc_type)
+                              const struct pci_device_id *mc_type)
 {
        u16 nid = amd_get_node_id(pdev);
        struct pci_dev *F3 = node_to_amd_nb(nid)->misc;
@@ -2736,7 +2730,7 @@ static int amd64_probe_one_instance(struct pci_dev *pdev,
                        goto err_enable;
        }
-        ret = amd64_init_one_instance(pdev);
+        ret = init_one_instance(pdev);
        if (ret < 0) {
                amd64_err("Error probing instance: %d\n", nid);
                restore_ecc_error_reporting(s, nid, F3);
@@ -2752,7 +2746,7 @@ err_out:
        return ret;
 }
-static void amd64_remove_one_instance(struct pci_dev *pdev)
+static void remove_one_instance(struct pci_dev *pdev)
 {
        struct mem_ctl_info *mci;
        struct amd64_pvt *pvt;
@@ -2777,7 +2771,7 @@ static void amd64_remove_one_instance(struct pci_dev *pdev)
        /* unregister from EDAC MCE */
        amd_report_gart_errors(false);
-        amd_unregister_ecc_decoder(amd64_decode_bus_error);
+        amd_unregister_ecc_decoder(decode_bus_error);
        kfree(ecc_stngs[nid]);
        ecc_stngs[nid] = NULL;
@@ -2795,7 +2789,7 @@ static void amd64_remove_one_instance(struct pci_dev *pdev)
 * PCI core identifies what devices are on a system during boot, and then
 * inquiry this table to see if this driver is for a given device found.
 */
-static DEFINE_PCI_DEVICE_TABLE(amd64_pci_table) = {
+static const struct pci_device_id amd64_pci_table[] = {
        {
                .vendor         = PCI_VENDOR_ID_AMD,
                .device         = PCI_DEVICE_ID_AMD_K8_NB_MEMCTL,
@@ -2843,8 +2837,8 @@ MODULE_DEVICE_TABLE(pci, amd64_pci_table);
 static struct pci_driver amd64_pci_driver = {
        .name           = EDAC_MOD_STR,
-        .probe          = amd64_probe_one_instance,
+        .probe          = probe_one_instance,
-        .remove         = amd64_remove_one_instance,
+        .remove         = remove_one_instance,
        .id_table       = amd64_pci_table,
 };
@@ -2853,23 +2847,18 @@ static void setup_pci_device(void)
        struct mem_ctl_info *mci;
        struct amd64_pvt *pvt;
-        if (amd64_ctl_pci)
+        if (pci_ctl)
                return;
        mci = mcis[0];
-        if (mci) {
+        if (!mci)
+                return;
-                pvt = mci->pvt_info;
-                amd64_ctl_pci =
-                        edac_pci_create_generic_ctl(&pvt->F2->dev, EDAC_MOD_STR);
-                if (!amd64_ctl_pci) {
-                        pr_warning("%s(): Unable to create PCI control\n",
-                                   __func__);
-                        pr_warning("%s(): PCI error report via EDAC not set\n",
+        pvt = mci->pvt_info;
-                                   __func__);
+        pci_ctl = edac_pci_create_generic_ctl(&pvt->F2->dev, EDAC_MOD_STR);
-                        }
+        if (!pci_ctl) {
+                pr_warn("%s(): Unable to create PCI control\n", __func__);
+                pr_warn("%s(): PCI error report via EDAC not set\n", __func__);
        }
 }
@@ -2925,8 +2914,8 @@ err_ret:
 static void __exit amd64_edac_exit(void)
 {
-        if (amd64_ctl_pci)
+        if (pci_ctl)
-                edac_pci_release_generic_ctl(amd64_ctl_pci);
+                edac_pci_release_generic_ctl(pci_ctl);
        pci_unregister_driver(&amd64_pci_driver);
diff --git a/drivers/edac/amd76x_edac.c b/drivers/edac/amd76x_edac.c
index 96e3ee3460a5..3a501b530e11 100644
--- a/drivers/edac/amd76x_edac.c
+++ b/drivers/edac/amd76x_edac.c
@@ -333,7 +333,7 @@ static void amd76x_remove_one(struct pci_dev *pdev)
        edac_mc_free(mci);
 }
-static DEFINE_PCI_DEVICE_TABLE(amd76x_pci_tbl) = {
+static const struct pci_device_id amd76x_pci_tbl[] = {
        {
         PCI_VEND_DEV(AMD, FE_GATE_700C), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
         AMD762},
diff --git a/drivers/edac/e752x_edac.c b/drivers/edac/e752x_edac.c
index 644fec54681f..92d54fa65f93 100644
--- a/drivers/edac/e752x_edac.c
+++ b/drivers/edac/e752x_edac.c
@@ -1182,9 +1182,11 @@ static int e752x_get_devs(struct pci_dev *pdev, int dev_idx,
        pvt->bridge_ck = pci_get_device(PCI_VENDOR_ID_INTEL,
                                pvt->dev_info->err_dev, pvt->bridge_ck);
-        if (pvt->bridge_ck == NULL)
+        if (pvt->bridge_ck == NULL) {
                pvt->bridge_ck = pci_scan_single_device(pdev->bus,
                                                        PCI_DEVFN(0, 1));
+                pci_dev_get(pvt->bridge_ck);
+        }
        if (pvt->bridge_ck == NULL) {
                e752x_printk(KERN_ERR, "error reporting device not found:"
@@ -1421,7 +1423,7 @@ static void e752x_remove_one(struct pci_dev *pdev)
        edac_mc_free(mci);
 }
-static DEFINE_PCI_DEVICE_TABLE(e752x_pci_tbl) = {
+static const struct pci_device_id e752x_pci_tbl[] = {
        {
         PCI_VEND_DEV(INTEL, 7520_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
         E7520},
diff --git a/drivers/edac/e7xxx_edac.c b/drivers/edac/e7xxx_edac.c
index 1c4056a50383..3cda79bc8b00 100644
--- a/drivers/edac/e7xxx_edac.c
+++ b/drivers/edac/e7xxx_edac.c
@@ -555,7 +555,7 @@ static void e7xxx_remove_one(struct pci_dev *pdev)
        edac_mc_free(mci);
 }
-static DEFINE_PCI_DEVICE_TABLE(e7xxx_pci_tbl) = {
+static const struct pci_device_id e7xxx_pci_tbl[] = {
        {
         PCI_VEND_DEV(INTEL, 7205_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
         E7205},
diff --git a/drivers/edac/edac_device.c b/drivers/edac/edac_device.c
index 102674346035..592af5f0cf39 100644
--- a/drivers/edac/edac_device.c
+++ b/drivers/edac/edac_device.c
@@ -437,6 +437,9 @@ void edac_device_workq_teardown(struct edac_device_ctl_info *edac_dev)
 {
        int status;
+        if (!edac_dev->edac_check)
+                return;
        status = cancel_delayed_work(&edac_dev->work);
        if (status == 0) {
                /* workq instance might be running, wait for it */
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index 9f7e0e609516..51c0362acf5c 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -914,7 +914,7 @@ void __exit edac_debugfs_exit(void)
        debugfs_remove(edac_debugfs);
 }
-int edac_create_debug_nodes(struct mem_ctl_info *mci)
+static int edac_create_debug_nodes(struct mem_ctl_info *mci)
 {
        struct dentry *d, *parent;
        char name[80];
diff --git a/drivers/edac/edac_stub.c b/drivers/edac/edac_stub.c
index 351945fa2ecd..9d9e18aefaaa 100644
--- a/drivers/edac/edac_stub.c
+++ b/drivers/edac/edac_stub.c
@@ -29,6 +29,25 @@ EXPORT_SYMBOL_GPL(edac_err_assert);
 static atomic_t edac_subsys_valid = ATOMIC_INIT(0);
+int edac_report_status = EDAC_REPORTING_ENABLED;
+EXPORT_SYMBOL_GPL(edac_report_status);
+static int __init edac_report_setup(char *str)
+{
+        if (!str)
+                return -EINVAL;
+        if (!strncmp(str, "on", 2))
+                set_edac_report_status(EDAC_REPORTING_ENABLED);
+        else if (!strncmp(str, "off", 3))
+                set_edac_report_status(EDAC_REPORTING_DISABLED);
+        else if (!strncmp(str, "force", 5))
+                set_edac_report_status(EDAC_REPORTING_FORCE);
+        return 0;
+}
+__setup("edac_report=", edac_report_setup);
 /*
 * called to determine if there is an EDAC driver interested in
 * knowing an event (such as NMI) occurred
diff --git a/drivers/edac/i3000_edac.c b/drivers/edac/i3000_edac.c
index 694efcbf19c0..cd28b968e5c7 100644
--- a/drivers/edac/i3000_edac.c
+++ b/drivers/edac/i3000_edac.c
@@ -487,7 +487,7 @@ static void i3000_remove_one(struct pci_dev *pdev)
        edac_mc_free(mci);
 }
-static DEFINE_PCI_DEVICE_TABLE(i3000_pci_tbl) = {
+static const struct pci_device_id i3000_pci_tbl[] = {
        {
         PCI_VEND_DEV(INTEL, 3000_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
         I3000},
diff --git a/drivers/edac/i3200_edac.c b/drivers/edac/i3200_edac.c
index be10a74b16ea..fa1326e5a4b0 100644
--- a/drivers/edac/i3200_edac.c
+++ b/drivers/edac/i3200_edac.c
@@ -466,7 +466,7 @@ static void i3200_remove_one(struct pci_dev *pdev)
        edac_mc_free(mci);
 }
-static DEFINE_PCI_DEVICE_TABLE(i3200_pci_tbl) = {
+static const struct pci_device_id i3200_pci_tbl[] = {
        {
                PCI_VEND_DEV(INTEL, 3200_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
                I3200},
diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c
index 63b2194e8c20..72e07e3cf718 100644
--- a/drivers/edac/i5000_edac.c
+++ b/drivers/edac/i5000_edac.c
@@ -1530,7 +1530,7 @@ static void i5000_remove_one(struct pci_dev *pdev)
 *
 *      The "E500P" device is the first device supported.
 */
-static DEFINE_PCI_DEVICE_TABLE(i5000_pci_tbl) = {
+static const struct pci_device_id i5000_pci_tbl[] = {
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I5000_DEV16),
         .driver_data = I5000P},
diff --git a/drivers/edac/i5100_edac.c b/drivers/edac/i5100_edac.c
index 157b934e8ce3..36a38ee94fa8 100644
--- a/drivers/edac/i5100_edac.c
+++ b/drivers/edac/i5100_edac.c
@@ -1213,7 +1213,7 @@ static void i5100_remove_one(struct pci_dev *pdev)
        edac_mc_free(mci);
 }
-static DEFINE_PCI_DEVICE_TABLE(i5100_pci_tbl) = {
+static const struct pci_device_id i5100_pci_tbl[] = {
        /* Device 16, Function 0, Channel 0 Memory Map, Error Flag/Mask, ... */
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5100_16) },
        { 0, }
diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c
index 0a05bbceb08f..e080cbfa8fc9 100644
--- a/drivers/edac/i5400_edac.c
+++ b/drivers/edac/i5400_edac.c
@@ -1416,7 +1416,7 @@ static void i5400_remove_one(struct pci_dev *pdev)
 *
 *      The "E500P" device is the first device supported.
 */
-static DEFINE_PCI_DEVICE_TABLE(i5400_pci_tbl) = {
+static const struct pci_device_id i5400_pci_tbl[] = {
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_5400_ERR)},
        {0,}                    /* 0 terminated list. */
 };
diff --git a/drivers/edac/i7300_edac.c b/drivers/edac/i7300_edac.c
index 9004c64b169e..d63f4798f7d0 100644
--- a/drivers/edac/i7300_edac.c
+++ b/drivers/edac/i7300_edac.c
@@ -1160,7 +1160,7 @@ static void i7300_remove_one(struct pci_dev *pdev)
 *
 * Has only 8086:360c PCI ID
 */
-static DEFINE_PCI_DEVICE_TABLE(i7300_pci_tbl) = {
+static const struct pci_device_id i7300_pci_tbl[] = {
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_I7300_MCH_ERR)},
        {0,}                    /* 0 terminated list. */
 };
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index 80a963d64e58..87533ca7752e 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -394,7 +394,7 @@ static const struct pci_id_table pci_dev_table[] = {
 /*
 *      pci_device_id   table for which devices we are looking for
 */
-static DEFINE_PCI_DEVICE_TABLE(i7core_pci_tbl) = {
+static const struct pci_device_id i7core_pci_tbl[] = {
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_X58_HUB_MGMT)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_LYNNFIELD_QPI_LINK0)},
        {0,}                    /* 0 terminated list. */
diff --git a/drivers/edac/i82443bxgx_edac.c b/drivers/edac/i82443bxgx_edac.c
index 57fdb77903ba..d730e276d1a8 100644
--- a/drivers/edac/i82443bxgx_edac.c
+++ b/drivers/edac/i82443bxgx_edac.c
@@ -386,7 +386,7 @@ static void i82443bxgx_edacmc_remove_one(struct pci_dev *pdev)
 EXPORT_SYMBOL_GPL(i82443bxgx_edacmc_remove_one);
-static DEFINE_PCI_DEVICE_TABLE(i82443bxgx_pci_tbl) = {
+static const struct pci_device_id i82443bxgx_pci_tbl[] = {
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_0)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443BX_2)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0)},
diff --git a/drivers/edac/i82860_edac.c b/drivers/edac/i82860_edac.c
index 3e3e431c8301..3382f6344e42 100644
--- a/drivers/edac/i82860_edac.c
+++ b/drivers/edac/i82860_edac.c
@@ -288,7 +288,7 @@ static void i82860_remove_one(struct pci_dev *pdev)
        edac_mc_free(mci);
 }
-static DEFINE_PCI_DEVICE_TABLE(i82860_pci_tbl) = {
+static const struct pci_device_id i82860_pci_tbl[] = {
        {
         PCI_VEND_DEV(INTEL, 82860_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
         I82860},
diff --git a/drivers/edac/i82875p_edac.c b/drivers/edac/i82875p_edac.c
index 2f8535fc451e..80573df0a4d7 100644
--- a/drivers/edac/i82875p_edac.c
+++ b/drivers/edac/i82875p_edac.c
@@ -527,7 +527,7 @@ static void i82875p_remove_one(struct pci_dev *pdev)
        edac_mc_free(mci);
 }
-static DEFINE_PCI_DEVICE_TABLE(i82875p_pci_tbl) = {
+static const struct pci_device_id i82875p_pci_tbl[] = {
        {
         PCI_VEND_DEV(INTEL, 82875_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
         I82875P},
diff --git a/drivers/edac/i82975x_edac.c b/drivers/edac/i82975x_edac.c
index 0c8d4b0eaa32..10b10521f62e 100644
--- a/drivers/edac/i82975x_edac.c
+++ b/drivers/edac/i82975x_edac.c
@@ -628,7 +628,7 @@ static void i82975x_remove_one(struct pci_dev *pdev)
        edac_mc_free(mci);
 }
-static DEFINE_PCI_DEVICE_TABLE(i82975x_pci_tbl) = {
+static const struct pci_device_id i82975x_pci_tbl[] = {
        {
                PCI_VEND_DEV(INTEL, 82975_0), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
                I82975X
diff --git a/drivers/edac/mpc85xx_edac.c b/drivers/edac/mpc85xx_edac.c
index fd46b0bd5f2a..8f9182179a7c 100644
--- a/drivers/edac/mpc85xx_edac.c
+++ b/drivers/edac/mpc85xx_edac.c
@@ -1,6 +1,8 @@
 /*
 * Freescale MPC85xx Memory Controller kenel module
 *
+ * Parts Copyrighted (c) 2013 by Freescale Semiconductor, Inc.
+ *
 * Author: Dave Jiang <djiang@mvista.com>
 *
 * 2006-2007 (c) MontaVista Software, Inc. This file is licensed under
@@ -196,6 +198,42 @@ static void mpc85xx_pci_check(struct edac_pci_ctl_info *pci)
                edac_pci_handle_npe(pci, pci->ctl_name);
 }
+static void mpc85xx_pcie_check(struct edac_pci_ctl_info *pci)
+{
+        struct mpc85xx_pci_pdata *pdata = pci->pvt_info;
+        u32 err_detect;
+        err_detect = in_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_DR);
+        pr_err("PCIe error(s) detected\n");
+        pr_err("PCIe ERR_DR register: 0x%08x\n", err_detect);
+        pr_err("PCIe ERR_CAP_STAT register: 0x%08x\n",
+                        in_be32(pdata->pci_vbase + MPC85XX_PCI_GAS_TIMR));
+        pr_err("PCIe ERR_CAP_R0 register: 0x%08x\n",
+                        in_be32(pdata->pci_vbase + MPC85XX_PCIE_ERR_CAP_R0));
+        pr_err("PCIe ERR_CAP_R1 register: 0x%08x\n",
+                        in_be32(pdata->pci_vbase + MPC85XX_PCIE_ERR_CAP_R1));
+        pr_err("PCIe ERR_CAP_R2 register: 0x%08x\n",
+                        in_be32(pdata->pci_vbase + MPC85XX_PCIE_ERR_CAP_R2));
+        pr_err("PCIe ERR_CAP_R3 register: 0x%08x\n",
+                        in_be32(pdata->pci_vbase + MPC85XX_PCIE_ERR_CAP_R3));
+        /* clear error bits */
+        out_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_DR, err_detect);
+}
+static int mpc85xx_pcie_find_capability(struct device_node *np)
+{
+        struct pci_controller *hose;
+        if (!np)
+                return -EINVAL;
+        hose = pci_find_hose_for_OF_device(np);
+        return early_find_capability(hose, 0, 0, PCI_CAP_ID_EXP);
+}
 static irqreturn_t mpc85xx_pci_isr(int irq, void *dev_id)
 {
        struct edac_pci_ctl_info *pci = dev_id;
@@ -207,7 +245,10 @@ static irqreturn_t mpc85xx_pci_isr(int irq, void *dev_id)
        if (!err_detect)
                return IRQ_NONE;
-        mpc85xx_pci_check(pci);
+        if (pdata->is_pcie)
+                mpc85xx_pcie_check(pci);
+        else
+                mpc85xx_pci_check(pci);
        return IRQ_HANDLED;
 }
@@ -239,14 +280,22 @@ int mpc85xx_pci_err_probe(struct platform_device *op)
        pdata = pci->pvt_info;
        pdata->name = "mpc85xx_pci_err";
        pdata->irq = NO_IRQ;
+        if (mpc85xx_pcie_find_capability(op->dev.of_node) > 0)
+                pdata->is_pcie = true;
        dev_set_drvdata(&op->dev, pci);
        pci->dev = &op->dev;
        pci->mod_name = EDAC_MOD_STR;
        pci->ctl_name = pdata->name;
        pci->dev_name = dev_name(&op->dev);
-        if (edac_op_state == EDAC_OPSTATE_POLL)
+        if (edac_op_state == EDAC_OPSTATE_POLL) {
-                pci->edac_check = mpc85xx_pci_check;
+                if (pdata->is_pcie)
+                        pci->edac_check = mpc85xx_pcie_check;
+                else
+                        pci->edac_check = mpc85xx_pci_check;
+        }
        pdata->edac_idx = edac_pci_idx++;
@@ -275,16 +324,26 @@ int mpc85xx_pci_err_probe(struct platform_device *op)
                goto err;
        }
-        orig_pci_err_cap_dr =
+        if (pdata->is_pcie) {
-            in_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_CAP_DR);
+                orig_pci_err_cap_dr =
+                    in_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_ADDR);
+                out_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_ADDR, ~0);
+                orig_pci_err_en =
+                    in_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_EN);
+                out_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_EN, 0);
+        } else {
+                orig_pci_err_cap_dr =
+                    in_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_CAP_DR);
-        /* PCI master abort is expected during config cycles */
+                /* PCI master abort is expected during config cycles */
-        out_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_CAP_DR, 0x40);
+                out_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_CAP_DR, 0x40);
-        orig_pci_err_en = in_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_EN);
+                orig_pci_err_en =
+                    in_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_EN);
-        /* disable master abort reporting */
+                /* disable master abort reporting */
-        out_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_EN, ~0x40);
+                out_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_EN, ~0x40);
+        }
        /* clear error bits */
        out_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_DR, ~0);
@@ -297,7 +356,8 @@ int mpc85xx_pci_err_probe(struct platform_device *op)
        if (edac_op_state == EDAC_OPSTATE_INT) {
                pdata->irq = irq_of_parse_and_map(op->dev.of_node, 0);
                res = devm_request_irq(&op->dev, pdata->irq,
-                                       mpc85xx_pci_isr, IRQF_DISABLED,
+                                       mpc85xx_pci_isr,
+                                       IRQF_DISABLED | IRQF_SHARED,
                                       "[EDAC] PCI err", pci);
                if (res < 0) {
                        printk(KERN_ERR
@@ -312,6 +372,22 @@ int mpc85xx_pci_err_probe(struct platform_device *op)
                       pdata->irq);
        }
+        if (pdata->is_pcie) {
+                /*
+                 * Enable all PCIe error interrupt & error detect except invalid
+                 * PEX_CONFIG_ADDR/PEX_CONFIG_DATA access interrupt generation
+                 * enable bit and invalid PEX_CONFIG_ADDR/PEX_CONFIG_DATA access
+                 * detection enable bit. Because PCIe bus code to initialize and
+                 * configure these PCIe devices on booting will use some invalid
+                 * PEX_CONFIG_ADDR/PEX_CONFIG_DATA, edac driver prints the much
+                 * notice information. So disable this detect to fix ugly print.
+                 */
+                out_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_EN, ~0
+                         & ~PEX_ERR_ICCAIE_EN_BIT);
+                out_be32(pdata->pci_vbase + MPC85XX_PCI_ERR_ADDR, 0
+                         | PEX_ERR_ICCAD_DISR_BIT);
+        }
        devres_remove_group(&op->dev, mpc85xx_pci_err_probe);
        edac_dbg(3, "success\n");
        printk(KERN_INFO EDAC_MOD_STR " PCI err registered\n");
diff --git a/drivers/edac/mpc85xx_edac.h b/drivers/edac/mpc85xx_edac.h
index 932016f2cf06..8c6256436227 100644
--- a/drivers/edac/mpc85xx_edac.h
+++ b/drivers/edac/mpc85xx_edac.h
@@ -134,13 +134,19 @@
 #define MPC85XX_PCI_ERR_DR              0x0000
 #define MPC85XX_PCI_ERR_CAP_DR          0x0004
 #define MPC85XX_PCI_ERR_EN              0x0008
+#define   PEX_ERR_ICCAIE_EN_BIT         0x00020000
 #define MPC85XX_PCI_ERR_ATTRIB          0x000c
 #define MPC85XX_PCI_ERR_ADDR            0x0010
+#define   PEX_ERR_ICCAD_DISR_BIT        0x00020000
 #define MPC85XX_PCI_ERR_EXT_ADDR        0x0014
 #define MPC85XX_PCI_ERR_DL              0x0018
 #define MPC85XX_PCI_ERR_DH              0x001c
 #define MPC85XX_PCI_GAS_TIMR            0x0020
 #define MPC85XX_PCI_PCIX_TIMR           0x0024
+#define MPC85XX_PCIE_ERR_CAP_R0         0x0028
+#define MPC85XX_PCIE_ERR_CAP_R1         0x002c
+#define MPC85XX_PCIE_ERR_CAP_R2         0x0030
+#define MPC85XX_PCIE_ERR_CAP_R3         0x0034
 struct mpc85xx_mc_pdata {
        char *name;
@@ -158,6 +164,7 @@ struct mpc85xx_l2_pdata {
 struct mpc85xx_pci_pdata {
        char *name;
+        bool is_pcie;
        int edac_idx;
        void __iomem *pci_vbase;
        int irq;
diff --git a/drivers/edac/r82600_edac.c b/drivers/edac/r82600_edac.c
index 2fd6a5490905..8f936bc7a010 100644
--- a/drivers/edac/r82600_edac.c
+++ b/drivers/edac/r82600_edac.c
@@ -383,7 +383,7 @@ static void r82600_remove_one(struct pci_dev *pdev)
        edac_mc_free(mci);
 }
-static DEFINE_PCI_DEVICE_TABLE(r82600_pci_tbl) = {
+static const struct pci_device_id r82600_pci_tbl[] = {
        {
         PCI_DEVICE(PCI_VENDOR_ID_RADISYS, R82600_BRIDGE_ID)
         },
diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c
index d7f1b57bd3be..54e2abe671f7 100644
--- a/drivers/edac/sb_edac.c
+++ b/drivers/edac/sb_edac.c
@@ -461,7 +461,7 @@ static const struct pci_id_table pci_dev_descr_ibridge_table[] = {
 /*
 *      pci_device_id   table for which devices we are looking for
 */
-static DEFINE_PCI_DEVICE_TABLE(sbridge_pci_tbl) = {
+static const struct pci_device_id sbridge_pci_tbl[] = {
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_SBRIDGE_IMC_TA)},
        {PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_TA)},
        {0,}                    /* 0 terminated list. */
@@ -915,7 +915,7 @@ static void get_memory_layout(const struct mem_ctl_info *mci)
        }
 }
-struct mem_ctl_info *get_mci_for_node_id(u8 node_id)
+static struct mem_ctl_info *get_mci_for_node_id(u8 node_id)
 {
        struct sbridge_dev *sbridge_dev;
@@ -1829,6 +1829,9 @@ static int sbridge_mce_check_error(struct notifier_block *nb, unsigned long val,
        struct mem_ctl_info *mci;
        struct sbridge_pvt *pvt;
+        if (get_edac_report_status() == EDAC_REPORTING_DISABLED)
+                return NOTIFY_DONE;
        mci = get_mci_for_node_id(mce->socketid);
        if (!mci)
                return NOTIFY_BAD;
@@ -2142,9 +2145,10 @@ static int __init sbridge_init(void)
        opstate_init();
        pci_rc = pci_register_driver(&sbridge_driver);
        if (pci_rc >= 0) {
                mce_register_decode_chain(&sbridge_mce_dec);
+                if (get_edac_report_status() == EDAC_REPORTING_DISABLED)
+                        sbridge_printk(KERN_WARNING, "Loading driver, error reporting disabled.\n");
                return 0;
        }
diff --git a/drivers/edac/x38_edac.c b/drivers/edac/x38_edac.c
index 1a4df82376ba..4891b450830b 100644
--- a/drivers/edac/x38_edac.c
+++ b/drivers/edac/x38_edac.c
@@ -448,7 +448,7 @@ static void x38_remove_one(struct pci_dev *pdev)
        edac_mc_free(mci);
 }
-static DEFINE_PCI_DEVICE_TABLE(x38_pci_tbl) = {
+static const struct pci_device_id x38_pci_tbl[] = {
        {
         PCI_VEND_DEV(INTEL, X38_HB), PCI_ANY_ID, PCI_ANY_ID, 0, 0,
         X38},
diff --git a/drivers/extcon/Kconfig b/drivers/extcon/Kconfig
index f1d54a3985bd..bdb5a00f1dfa 100644
--- a/drivers/extcon/Kconfig
+++ b/drivers/extcon/Kconfig
@@ -31,6 +31,16 @@ config EXTCON_ADC_JACK
        help
          Say Y here to enable extcon device driver based on ADC values.
+config EXTCON_MAX14577
+        tristate "MAX14577 EXTCON Support"
+        depends on MFD_MAX14577
+        select IRQ_DOMAIN
+        select REGMAP_I2C
+        help
+          If you say yes here you get support for the MUIC device of
+          Maxim MAX14577 PMIC. The MAX14577 MUIC is a USB port accessory
+          detector and switch.
 config EXTCON_MAX77693
        tristate "MAX77693 EXTCON Support"
        depends on MFD_MAX77693 && INPUT
diff --git a/drivers/extcon/Makefile b/drivers/extcon/Makefile
index 759fdae46f95..43eccc0e3448 100644
--- a/drivers/extcon/Makefile
+++ b/drivers/extcon/Makefile
@@ -7,6 +7,7 @@ obj-$(CONFIG_OF_EXTCON)		+= of_extcon.o
 obj-$(CONFIG_EXTCON)            += extcon-class.o
 obj-$(CONFIG_EXTCON_GPIO)       += extcon-gpio.o
 obj-$(CONFIG_EXTCON_ADC_JACK)   += extcon-adc-jack.o
+obj-$(CONFIG_EXTCON_MAX14577)   += extcon-max14577.o
 obj-$(CONFIG_EXTCON_MAX77693)   += extcon-max77693.o
 obj-$(CONFIG_EXTCON_MAX8997)    += extcon-max8997.o
 obj-$(CONFIG_EXTCON_ARIZONA)    += extcon-arizona.o
diff --git a/drivers/extcon/extcon-arizona.c b/drivers/extcon/extcon-arizona.c
index a287cece0593..c20602f601ee 100644
--- a/drivers/extcon/extcon-arizona.c
+++ b/drivers/extcon/extcon-arizona.c
@@ -44,6 +44,15 @@
 #define HPDET_DEBOUNCE 500
 #define DEFAULT_MICD_TIMEOUT 2000
+#define MICD_LVL_1_TO_7 (ARIZONA_MICD_LVL_1 | ARIZONA_MICD_LVL_2 | \
+                         ARIZONA_MICD_LVL_3 | ARIZONA_MICD_LVL_4 | \
+                         ARIZONA_MICD_LVL_5 | ARIZONA_MICD_LVL_6 | \
+                         ARIZONA_MICD_LVL_7)
+#define MICD_LVL_0_TO_7 (ARIZONA_MICD_LVL_0 | MICD_LVL_1_TO_7)
+#define MICD_LVL_0_TO_8 (MICD_LVL_0_TO_7 | ARIZONA_MICD_LVL_8)
 struct arizona_extcon_info {
        struct device *dev;
        struct arizona *arizona;
@@ -426,26 +435,15 @@ static int arizona_hpdet_read(struct arizona_extcon_info *info)
                }
                val &= ARIZONA_HP_LVL_B_MASK;
+                /* Convert to ohms, the value is in 0.5 ohm increments */
+                val /= 2;
                regmap_read(arizona->regmap, ARIZONA_HEADPHONE_DETECT_1,
                            &range);
                range = (range & ARIZONA_HP_IMPEDANCE_RANGE_MASK)
                           >> ARIZONA_HP_IMPEDANCE_RANGE_SHIFT;
-                /* Skip up or down a range? */
+                /* Skip up a range, or report? */
-                if (range && (val < arizona_hpdet_c_ranges[range].min)) {
-                        range--;
-                        dev_dbg(arizona->dev, "Moving to HPDET range %d-%d\n",
-                                arizona_hpdet_c_ranges[range].min,
-                                arizona_hpdet_c_ranges[range].max);
-                        regmap_update_bits(arizona->regmap,
-                                           ARIZONA_HEADPHONE_DETECT_1,
-                                           ARIZONA_HP_IMPEDANCE_RANGE_MASK,
-                                           range <<
-                                           ARIZONA_HP_IMPEDANCE_RANGE_SHIFT);
-                        return -EAGAIN;
-                }
                if (range < ARRAY_SIZE(arizona_hpdet_c_ranges) - 1 &&
                    (val >= arizona_hpdet_c_ranges[range].max)) {
                        range++;
@@ -459,6 +457,12 @@ static int arizona_hpdet_read(struct arizona_extcon_info *info)
                                           ARIZONA_HP_IMPEDANCE_RANGE_SHIFT);
                        return -EAGAIN;
                }
+                if (range && (val < arizona_hpdet_c_ranges[range].min)) {
+                        dev_dbg(arizona->dev, "Reporting range boundary %d\n",
+                                arizona_hpdet_c_ranges[range].min);
+                        val = arizona_hpdet_c_ranges[range].min;
+                }
        }
        dev_dbg(arizona->dev, "HP impedance %d ohms\n", val);
@@ -594,9 +598,15 @@ static irqreturn_t arizona_hpdet_irq(int irq, void *data)
                dev_err(arizona->dev, "Failed to report HP/line: %d\n",
                        ret);
+done:
+        /* Reset back to starting range */
+        regmap_update_bits(arizona->regmap,
+                           ARIZONA_HEADPHONE_DETECT_1,
+                           ARIZONA_HP_IMPEDANCE_RANGE_MASK | ARIZONA_HP_POLL,
+                           0);
        arizona_extcon_do_magic(info, 0);
-done:
        if (id_gpio)
                gpio_set_value_cansleep(id_gpio, 0);
@@ -765,7 +775,20 @@ static void arizona_micd_detect(struct work_struct *work)
        mutex_lock(&info->lock);
-        for (i = 0; i < 10 && !(val & 0x7fc); i++) {
+        /* If the cable was removed while measuring ignore the result */
+        ret = extcon_get_cable_state_(&info->edev, ARIZONA_CABLE_MECHANICAL);
+        if (ret < 0) {
+                dev_err(arizona->dev, "Failed to check cable state: %d\n",
+                                ret);
+                mutex_unlock(&info->lock);
+                return;
+        } else if (!ret) {
+                dev_dbg(arizona->dev, "Ignoring MICDET for removed cable\n");
+                mutex_unlock(&info->lock);
+                return;
+        }
+        for (i = 0; i < 10 && !(val & MICD_LVL_0_TO_8); i++) {
                ret = regmap_read(arizona->regmap, ARIZONA_MIC_DETECT_3, &val);
                if (ret != 0) {
                        dev_err(arizona->dev,
@@ -784,7 +807,7 @@ static void arizona_micd_detect(struct work_struct *work)
                }
        }
-        if (i == 10 && !(val & 0x7fc)) {
+        if (i == 10 && !(val & MICD_LVL_0_TO_8)) {
                dev_err(arizona->dev, "Failed to get valid MICDET value\n");
                mutex_unlock(&info->lock);
                return;
@@ -798,7 +821,7 @@ static void arizona_micd_detect(struct work_struct *work)
        }
        /* If we got a high impedence we should have a headset, report it. */
-        if (info->detecting && (val & 0x400)) {
+        if (info->detecting && (val & ARIZONA_MICD_LVL_8)) {
                arizona_identify_headphone(info);
                ret = extcon_update_state(&info->edev,
@@ -827,7 +850,7 @@ static void arizona_micd_detect(struct work_struct *work)
         * plain headphones.  If both polarities report a low
         * impedence then give up and report headphones.
         */
-        if (info->detecting && (val & 0x3f8)) {
+        if (info->detecting && (val & MICD_LVL_1_TO_7)) {
                if (info->jack_flips >= info->micd_num_modes * 10) {
                        dev_dbg(arizona->dev, "Detected HP/line\n");
                        arizona_identify_headphone(info);
@@ -851,7 +874,7 @@ static void arizona_micd_detect(struct work_struct *work)
         * If we're still detecting and we detect a short then we've
         * got a headphone.  Otherwise it's a button press.
         */
-        if (val & 0x3fc) {
+        if (val & MICD_LVL_0_TO_7) {
                if (info->mic) {
                        dev_dbg(arizona->dev, "Mic button detected\n");
@@ -1126,6 +1149,16 @@ static int arizona_extcon_probe(struct platform_device *pdev)
                        break;
                }
                break;
+        case WM5110:
+                switch (arizona->rev) {
+                case 0 ... 2:
+                        break;
+                default:
+                        info->micd_clamp = true;
+                        info->hpdet_ip = 2;
+                        break;
+                }
+                break;
        default:
                break;
        }
diff --git a/drivers/extcon/extcon-gpio.c b/drivers/extcon/extcon-gpio.c
index 7e0dff58e494..a63a6b21c9ad 100644
--- a/drivers/extcon/extcon-gpio.c
+++ b/drivers/extcon/extcon-gpio.c
@@ -40,6 +40,7 @@ struct gpio_extcon_data {
        int irq;
        struct delayed_work work;
        unsigned long debounce_jiffies;
+        bool check_on_resume;
 };
 static void gpio_extcon_work(struct work_struct *work)
@@ -103,8 +104,15 @@ static int gpio_extcon_probe(struct platform_device *pdev)
        extcon_data->gpio_active_low = pdata->gpio_active_low;
        extcon_data->state_on = pdata->state_on;
        extcon_data->state_off = pdata->state_off;
+        extcon_data->check_on_resume = pdata->check_on_resume;
        if (pdata->state_on && pdata->state_off)
                extcon_data->edev.print_state = extcon_gpio_print_state;
+        ret = devm_gpio_request_one(&pdev->dev, extcon_data->gpio, GPIOF_DIR_IN,
+                                    pdev->name);
+        if (ret < 0)
+                return ret;
        if (pdata->debounce) {
                ret = gpio_set_debounce(extcon_data->gpio,
                                        pdata->debounce * 1000);
@@ -117,11 +125,6 @@ static int gpio_extcon_probe(struct platform_device *pdev)
        if (ret < 0)
                return ret;
-        ret = devm_gpio_request_one(&pdev->dev, extcon_data->gpio, GPIOF_DIR_IN,
-                                    pdev->name);
-        if (ret < 0)
-                goto err;
        INIT_DELAYED_WORK(&extcon_data->work, gpio_extcon_work);
        extcon_data->irq = gpio_to_irq(extcon_data->gpio);
@@ -159,12 +162,31 @@ static int gpio_extcon_remove(struct platform_device *pdev)
        return 0;
 }
+#ifdef CONFIG_PM_SLEEP
+static int gpio_extcon_resume(struct device *dev)
+{
+        struct gpio_extcon_data *extcon_data;
+        extcon_data = dev_get_drvdata(dev);
+        if (extcon_data->check_on_resume)
+                queue_delayed_work(system_power_efficient_wq,
+                        &extcon_data->work, extcon_data->debounce_jiffies);
+        return 0;
+}
+#endif
+static const struct dev_pm_ops gpio_extcon_pm_ops = {
+        SET_SYSTEM_SLEEP_PM_OPS(NULL, gpio_extcon_resume)
+};
 static struct platform_driver gpio_extcon_driver = {
        .probe          = gpio_extcon_probe,
        .remove         = gpio_extcon_remove,
        .driver         = {
                .name   = "extcon-gpio",
                .owner  = THIS_MODULE,
+                .pm     = &gpio_extcon_pm_ops,
        },
 };
diff --git a/drivers/extcon/extcon-max14577.c b/drivers/extcon/extcon-max14577.c
new file mode 100644
index 000000000000..3846941801b8
--- /dev/null
+++ b/drivers/extcon/extcon-max14577.c
@@ -0,0 +1,752 @@
+/*
+ * extcon-max14577.c - MAX14577 extcon driver to support MAX14577 MUIC
+ *
+ * Copyright (C) 2013 Samsung Electrnoics
+ * Chanwoo Choi <cw00.choi@samsung.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/interrupt.h>
+#include <linux/platform_device.h>
+#include <linux/mfd/max14577.h>
+#include <linux/mfd/max14577-private.h>
+#include <linux/extcon.h>
+#define DEV_NAME                        "max14577-muic"
+#define DELAY_MS_DEFAULT                17000           /* unit: millisecond */
+enum max14577_muic_adc_debounce_time {
+        ADC_DEBOUNCE_TIME_5MS = 0,
+        ADC_DEBOUNCE_TIME_10MS,
+        ADC_DEBOUNCE_TIME_25MS,
+        ADC_DEBOUNCE_TIME_38_62MS,
+};
+enum max14577_muic_status {
+        MAX14577_MUIC_STATUS1 = 0,
+        MAX14577_MUIC_STATUS2 = 1,
+        MAX14577_MUIC_STATUS_END,
+};
+struct max14577_muic_info {
+        struct device *dev;
+        struct max14577 *max14577;
+        struct extcon_dev *edev;
+        int prev_cable_type;
+        int prev_chg_type;
+        u8 status[MAX14577_MUIC_STATUS_END];
+        bool irq_adc;
+        bool irq_chg;
+        struct work_struct irq_work;
+        struct mutex mutex;
+        /*
+         * Use delayed workqueue to detect cable state and then
+         * notify cable state to notifiee/platform through uevent.
+         * After completing the booting of platform, the extcon provider
+         * driver should notify cable state to upper layer.
+         */
+        struct delayed_work wq_detcable;
+        /*
+         * Default usb/uart path whether UART/USB or AUX_UART/AUX_USB
+         * h/w path of COMP2/COMN1 on CONTROL1 register.
+         */
+        int path_usb;
+        int path_uart;
+};
+enum max14577_muic_cable_group {
+        MAX14577_CABLE_GROUP_ADC = 0,
+        MAX14577_CABLE_GROUP_CHG,
+};
+/**
+ * struct max14577_muic_irq
+ * @irq: the index of irq list of MUIC device.
+ * @name: the name of irq.
+ * @virq: the virtual irq to use irq domain
+ */
+struct max14577_muic_irq {
+        unsigned int irq;
+        const char *name;
+        unsigned int virq;
+};
+static struct max14577_muic_irq muic_irqs[] = {
+        { MAX14577_IRQ_INT1_ADC,        "muic-ADC" },
+        { MAX14577_IRQ_INT1_ADCLOW,     "muic-ADCLOW" },
+        { MAX14577_IRQ_INT1_ADCERR,     "muic-ADCError" },
+        { MAX14577_IRQ_INT2_CHGTYP,     "muic-CHGTYP" },
+        { MAX14577_IRQ_INT2_CHGDETRUN,  "muic-CHGDETRUN" },
+        { MAX14577_IRQ_INT2_DCDTMR,     "muic-DCDTMR" },
+        { MAX14577_IRQ_INT2_DBCHG,      "muic-DBCHG" },
+        { MAX14577_IRQ_INT2_VBVOLT,     "muic-VBVOLT" },
+};
+/* Define supported accessory type */
+enum max14577_muic_acc_type {
+        MAX14577_MUIC_ADC_GROUND = 0x0,
+        MAX14577_MUIC_ADC_SEND_END_BUTTON,
+        MAX14577_MUIC_ADC_REMOTE_S1_BUTTON,
+        MAX14577_MUIC_ADC_REMOTE_S2_BUTTON,
+        MAX14577_MUIC_ADC_REMOTE_S3_BUTTON,
+        MAX14577_MUIC_ADC_REMOTE_S4_BUTTON,
+        MAX14577_MUIC_ADC_REMOTE_S5_BUTTON,
+        MAX14577_MUIC_ADC_REMOTE_S6_BUTTON,
+        MAX14577_MUIC_ADC_REMOTE_S7_BUTTON,
+        MAX14577_MUIC_ADC_REMOTE_S8_BUTTON,
+        MAX14577_MUIC_ADC_REMOTE_S9_BUTTON,
+        MAX14577_MUIC_ADC_REMOTE_S10_BUTTON,
+        MAX14577_MUIC_ADC_REMOTE_S11_BUTTON,
+        MAX14577_MUIC_ADC_REMOTE_S12_BUTTON,
+        MAX14577_MUIC_ADC_RESERVED_ACC_1,
+        MAX14577_MUIC_ADC_RESERVED_ACC_2,
+        MAX14577_MUIC_ADC_RESERVED_ACC_3,
+        MAX14577_MUIC_ADC_RESERVED_ACC_4,
+        MAX14577_MUIC_ADC_RESERVED_ACC_5,
+        MAX14577_MUIC_ADC_AUDIO_DEVICE_TYPE2,
+        MAX14577_MUIC_ADC_PHONE_POWERED_DEV,
+        MAX14577_MUIC_ADC_TTY_CONVERTER,
+        MAX14577_MUIC_ADC_UART_CABLE,
+        MAX14577_MUIC_ADC_CEA936A_TYPE1_CHG,
+        MAX14577_MUIC_ADC_FACTORY_MODE_USB_OFF,
+        MAX14577_MUIC_ADC_FACTORY_MODE_USB_ON,
+        MAX14577_MUIC_ADC_AV_CABLE_NOLOAD,
+        MAX14577_MUIC_ADC_CEA936A_TYPE2_CHG,
+        MAX14577_MUIC_ADC_FACTORY_MODE_UART_OFF,
+        MAX14577_MUIC_ADC_FACTORY_MODE_UART_ON,
+        MAX14577_MUIC_ADC_AUDIO_DEVICE_TYPE1, /* with Remote and Simple Ctrl */
+        MAX14577_MUIC_ADC_OPEN,
+};
+/* max14577 MUIC device support below list of accessories(external connector) */
+enum {
+        EXTCON_CABLE_USB = 0,
+        EXTCON_CABLE_TA,
+        EXTCON_CABLE_FAST_CHARGER,
+        EXTCON_CABLE_SLOW_CHARGER,
+        EXTCON_CABLE_CHARGE_DOWNSTREAM,
+        EXTCON_CABLE_JIG_USB_ON,
+        EXTCON_CABLE_JIG_USB_OFF,
+        EXTCON_CABLE_JIG_UART_OFF,
+        EXTCON_CABLE_JIG_UART_ON,
+        _EXTCON_CABLE_NUM,
+};
+static const char *max14577_extcon_cable[] = {
+        [EXTCON_CABLE_USB]                      = "USB",
+        [EXTCON_CABLE_TA]                       = "TA",
+        [EXTCON_CABLE_FAST_CHARGER]             = "Fast-charger",
+        [EXTCON_CABLE_SLOW_CHARGER]             = "Slow-charger",
+        [EXTCON_CABLE_CHARGE_DOWNSTREAM]        = "Charge-downstream",
+        [EXTCON_CABLE_JIG_USB_ON]               = "JIG-USB-ON",
+        [EXTCON_CABLE_JIG_USB_OFF]              = "JIG-USB-OFF",
+        [EXTCON_CABLE_JIG_UART_OFF]             = "JIG-UART-OFF",
+        [EXTCON_CABLE_JIG_UART_ON]              = "JIG-UART-ON",
+        NULL,
+};
+/*
+ * max14577_muic_set_debounce_time - Set the debounce time of ADC
+ * @info: the instance including private data of max14577 MUIC
+ * @time: the debounce time of ADC
+ */
+static int max14577_muic_set_debounce_time(struct max14577_muic_info *info,
+                enum max14577_muic_adc_debounce_time time)
+{
+        u8 ret;
+        switch (time) {
+        case ADC_DEBOUNCE_TIME_5MS:
+        case ADC_DEBOUNCE_TIME_10MS:
+        case ADC_DEBOUNCE_TIME_25MS:
+        case ADC_DEBOUNCE_TIME_38_62MS:
+                ret = max14577_update_reg(info->max14577->regmap,
+                                          MAX14577_MUIC_REG_CONTROL3,
+                                          CTRL3_ADCDBSET_MASK,
+                                          time << CTRL3_ADCDBSET_SHIFT);
+                if (ret) {
+                        dev_err(info->dev, "failed to set ADC debounce time\n");
+                        return ret;
+                }
+                break;
+        default:
+                dev_err(info->dev, "invalid ADC debounce time\n");
+                return -EINVAL;
+        }
+        return 0;
+};
+/*
+ * max14577_muic_set_path - Set hardware line according to attached cable
+ * @info: the instance including private data of max14577 MUIC
+ * @value: the path according to attached cable
+ * @attached: the state of cable (true:attached, false:detached)
+ *
+ * The max14577 MUIC device share outside H/W line among a varity of cables
+ * so, this function set internal path of H/W line according to the type of
+ * attached cable.
+ */
+static int max14577_muic_set_path(struct max14577_muic_info *info,
+                u8 val, bool attached)
+{
+        int ret = 0;
+        u8 ctrl1, ctrl2 = 0;
+        /* Set open state to path before changing hw path */
+        ret = max14577_update_reg(info->max14577->regmap,
+                                MAX14577_MUIC_REG_CONTROL1,
+                                CLEAR_IDBEN_MICEN_MASK, CTRL1_SW_OPEN);
+        if (ret < 0) {
+                dev_err(info->dev, "failed to update MUIC register\n");
+                return ret;
+        }
+        if (attached)
+                ctrl1 = val;
+        else
+                ctrl1 = CTRL1_SW_OPEN;
+        ret = max14577_update_reg(info->max14577->regmap,
+                                MAX14577_MUIC_REG_CONTROL1,
+                                CLEAR_IDBEN_MICEN_MASK, ctrl1);
+        if (ret < 0) {
+                dev_err(info->dev, "failed to update MUIC register\n");
+                return ret;
+        }
+        if (attached)
+                ctrl2 |= CTRL2_CPEN_MASK;       /* LowPwr=0, CPEn=1 */
+        else
+                ctrl2 |= CTRL2_LOWPWR_MASK;     /* LowPwr=1, CPEn=0 */
+        ret = max14577_update_reg(info->max14577->regmap,
+                        MAX14577_REG_CONTROL2,
+                        CTRL2_LOWPWR_MASK | CTRL2_CPEN_MASK, ctrl2);
+        if (ret < 0) {
+                dev_err(info->dev, "failed to update MUIC register\n");
+                return ret;
+        }
+        dev_dbg(info->dev,
+                "CONTROL1 : 0x%02x, CONTROL2 : 0x%02x, state : %s\n",
+                ctrl1, ctrl2, attached ? "attached" : "detached");
+        return 0;
+}
+/*
+ * max14577_muic_get_cable_type - Return cable type and check cable state
+ * @info: the instance including private data of max14577 MUIC
+ * @group: the path according to attached cable
+ * @attached: store cable state and return
+ *
+ * This function check the cable state either attached or detached,
+ * and then divide precise type of cable according to cable group.
+ *      - max14577_CABLE_GROUP_ADC
+ *      - max14577_CABLE_GROUP_CHG
+ */
+static int max14577_muic_get_cable_type(struct max14577_muic_info *info,
+                enum max14577_muic_cable_group group, bool *attached)
+{
+        int cable_type = 0;
+        int adc;
+        int chg_type;
+        switch (group) {
+        case MAX14577_CABLE_GROUP_ADC:
+                /*
+                 * Read ADC value to check cable type and decide cable state
+                 * according to cable type
+                 */
+                adc = info->status[MAX14577_MUIC_STATUS1] & STATUS1_ADC_MASK;
+                adc >>= STATUS1_ADC_SHIFT;
+                /*
+                 * Check current cable state/cable type and store cable type
+                 * (info->prev_cable_type) for handling cable when cable is
+                 * detached.
+                 */
+                if (adc == MAX14577_MUIC_ADC_OPEN) {
+                        *attached = false;
+                        cable_type = info->prev_cable_type;
+                        info->prev_cable_type = MAX14577_MUIC_ADC_OPEN;
+                } else {
+                        *attached = true;
+                        cable_type = info->prev_cable_type = adc;
+                }
+                break;
+        case MAX14577_CABLE_GROUP_CHG:
+                /*
+                 * Read charger type to check cable type and decide cable state
+                 * according to type of charger cable.
+                 */
+                chg_type = info->status[MAX14577_MUIC_STATUS2] &
+                        STATUS2_CHGTYP_MASK;
+                chg_type >>= STATUS2_CHGTYP_SHIFT;
+                if (chg_type == MAX14577_CHARGER_TYPE_NONE) {
+                        *attached = false;
+                        cable_type = info->prev_chg_type;
+                        info->prev_chg_type = MAX14577_CHARGER_TYPE_NONE;
+                } else {
+                        *attached = true;
+                        /*
+                         * Check current cable state/cable type and store cable
+                         * type(info->prev_chg_type) for handling cable when
+                         * charger cable is detached.
+                         */
+                        cable_type = info->prev_chg_type = chg_type;
+                }
+                break;
+        default:
+                dev_err(info->dev, "Unknown cable group (%d)\n", group);
+                cable_type = -EINVAL;
+                break;
+        }
+        return cable_type;
+}
+static int max14577_muic_jig_handler(struct max14577_muic_info *info,
+                int cable_type, bool attached)
+{
+        char cable_name[32];
+        int ret = 0;
+        u8 path = CTRL1_SW_OPEN;
+        dev_dbg(info->dev,
+                "external connector is %s (adc:0x%02x)\n",
+                attached ? "attached" : "detached", cable_type);
+        switch (cable_type) {
+        case MAX14577_MUIC_ADC_FACTORY_MODE_USB_OFF:    /* ADC_JIG_USB_OFF */
+                /* PATH:AP_USB */
+                strcpy(cable_name, "JIG-USB-OFF");
+                path = CTRL1_SW_USB;
+                break;
+        case MAX14577_MUIC_ADC_FACTORY_MODE_USB_ON:     /* ADC_JIG_USB_ON */
+                /* PATH:AP_USB */
+                strcpy(cable_name, "JIG-USB-ON");
+                path = CTRL1_SW_USB;
+                break;
+        case MAX14577_MUIC_ADC_FACTORY_MODE_UART_OFF:   /* ADC_JIG_UART_OFF */
+                /* PATH:AP_UART */
+                strcpy(cable_name, "JIG-UART-OFF");
+                path = CTRL1_SW_UART;
+                break;
+        default:
+                dev_err(info->dev, "failed to detect %s jig cable\n",
+                        attached ? "attached" : "detached");
+                return -EINVAL;
+        }
+        ret = max14577_muic_set_path(info, path, attached);
+        if (ret < 0)
+                return ret;
+        extcon_set_cable_state(info->edev, cable_name, attached);
+        return 0;
+}
+static int max14577_muic_adc_handler(struct max14577_muic_info *info)
+{
+        int cable_type;
+        bool attached;
+        int ret = 0;
+        /* Check accessory state which is either detached or attached */
+        cable_type = max14577_muic_get_cable_type(info,
+                                MAX14577_CABLE_GROUP_ADC, &attached);
+        dev_dbg(info->dev,
+                "external connector is %s (adc:0x%02x, prev_adc:0x%x)\n",
+                attached ? "attached" : "detached", cable_type,
+                info->prev_cable_type);
+        switch (cable_type) {
+        case MAX14577_MUIC_ADC_FACTORY_MODE_USB_OFF:
+        case MAX14577_MUIC_ADC_FACTORY_MODE_USB_ON:
+        case MAX14577_MUIC_ADC_FACTORY_MODE_UART_OFF:
+                /* JIG */
+                ret = max14577_muic_jig_handler(info, cable_type, attached);
+                if (ret < 0)
+                        return ret;
+                break;
+        case MAX14577_MUIC_ADC_GROUND:
+        case MAX14577_MUIC_ADC_SEND_END_BUTTON:
+        case MAX14577_MUIC_ADC_REMOTE_S1_BUTTON:
+        case MAX14577_MUIC_ADC_REMOTE_S2_BUTTON:
+        case MAX14577_MUIC_ADC_REMOTE_S3_BUTTON:
+        case MAX14577_MUIC_ADC_REMOTE_S4_BUTTON:
+        case MAX14577_MUIC_ADC_REMOTE_S5_BUTTON:
+        case MAX14577_MUIC_ADC_REMOTE_S6_BUTTON:
+        case MAX14577_MUIC_ADC_REMOTE_S7_BUTTON:
+        case MAX14577_MUIC_ADC_REMOTE_S8_BUTTON:
+        case MAX14577_MUIC_ADC_REMOTE_S9_BUTTON:
+        case MAX14577_MUIC_ADC_REMOTE_S10_BUTTON:
+        case MAX14577_MUIC_ADC_REMOTE_S11_BUTTON:
+        case MAX14577_MUIC_ADC_REMOTE_S12_BUTTON:
+        case MAX14577_MUIC_ADC_RESERVED_ACC_1:
+        case MAX14577_MUIC_ADC_RESERVED_ACC_2:
+        case MAX14577_MUIC_ADC_RESERVED_ACC_3:
+        case MAX14577_MUIC_ADC_RESERVED_ACC_4:
+        case MAX14577_MUIC_ADC_RESERVED_ACC_5:
+        case MAX14577_MUIC_ADC_AUDIO_DEVICE_TYPE2:
+        case MAX14577_MUIC_ADC_PHONE_POWERED_DEV:
+        case MAX14577_MUIC_ADC_TTY_CONVERTER:
+        case MAX14577_MUIC_ADC_UART_CABLE:
+        case MAX14577_MUIC_ADC_CEA936A_TYPE1_CHG:
+        case MAX14577_MUIC_ADC_AV_CABLE_NOLOAD:
+        case MAX14577_MUIC_ADC_CEA936A_TYPE2_CHG:
+        case MAX14577_MUIC_ADC_FACTORY_MODE_UART_ON:
+        case MAX14577_MUIC_ADC_AUDIO_DEVICE_TYPE1:
+                /*
+                 * This accessory isn't used in general case if it is specially
+                 * needed to detect additional accessory, should implement
+                 * proper operation when this accessory is attached/detached.
+                 */
+                dev_info(info->dev,
+                        "accessory is %s but it isn't used (adc:0x%x)\n",
+                        attached ? "attached" : "detached", cable_type);
+                return -EAGAIN;
+        default:
+                dev_err(info->dev,
+                        "failed to detect %s accessory (adc:0x%x)\n",
+                        attached ? "attached" : "detached", cable_type);
+                return -EINVAL;
+        }
+        return 0;
+}
+static int max14577_muic_chg_handler(struct max14577_muic_info *info)
+{
+        int chg_type;
+        bool attached;
+        int ret = 0;
+        chg_type = max14577_muic_get_cable_type(info,
+                                MAX14577_CABLE_GROUP_CHG, &attached);
+        dev_dbg(info->dev,
+                "external connector is %s(chg_type:0x%x, prev_chg_type:0x%x)\n",
+                        attached ? "attached" : "detached",
+                        chg_type, info->prev_chg_type);
+        switch (chg_type) {
+        case MAX14577_CHARGER_TYPE_USB:
+                /* PATH:AP_USB */
+                ret = max14577_muic_set_path(info, info->path_usb, attached);
+                if (ret < 0)
+                        return ret;
+                extcon_set_cable_state(info->edev, "USB", attached);
+                break;
+        case MAX14577_CHARGER_TYPE_DEDICATED_CHG:
+                extcon_set_cable_state(info->edev, "TA", attached);
+                break;
+        case MAX14577_CHARGER_TYPE_DOWNSTREAM_PORT:
+                extcon_set_cable_state(info->edev,
+                                "Charge-downstream", attached);
+                break;
+        case MAX14577_CHARGER_TYPE_SPECIAL_500MA:
+                extcon_set_cable_state(info->edev, "Slow-charger", attached);
+                break;
+        case MAX14577_CHARGER_TYPE_SPECIAL_1A:
+                extcon_set_cable_state(info->edev, "Fast-charger", attached);
+                break;
+        case MAX14577_CHARGER_TYPE_NONE:
+        case MAX14577_CHARGER_TYPE_DEAD_BATTERY:
+                break;
+        default:
+                dev_err(info->dev,
+                        "failed to detect %s accessory (chg_type:0x%x)\n",
+                        attached ? "attached" : "detached", chg_type);
+                return -EINVAL;
+        }
+        return 0;
+}
+static void max14577_muic_irq_work(struct work_struct *work)
+{
+        struct max14577_muic_info *info = container_of(work,
+                        struct max14577_muic_info, irq_work);
+        int ret = 0;
+        if (!info->edev)
+                return;
+        mutex_lock(&info->mutex);
+        ret = max14577_bulk_read(info->max14577->regmap,
+                        MAX14577_MUIC_REG_STATUS1, info->status, 2);
+        if (ret) {
+                dev_err(info->dev, "failed to read MUIC register\n");
+                mutex_unlock(&info->mutex);
+                return;
+        }
+        if (info->irq_adc) {
+                ret = max14577_muic_adc_handler(info);
+                info->irq_adc = false;
+        }
+        if (info->irq_chg) {
+                ret = max14577_muic_chg_handler(info);
+                info->irq_chg = false;
+        }
+        if (ret < 0)
+                dev_err(info->dev, "failed to handle MUIC interrupt\n");
+        mutex_unlock(&info->mutex);
+        return;
+}
+static irqreturn_t max14577_muic_irq_handler(int irq, void *data)
+{
+        struct max14577_muic_info *info = data;
+        int i, irq_type = -1;
+        /*
+         * We may be called multiple times for different nested IRQ-s.
+         * Including changes in INT1_ADC and INT2_CGHTYP at once.
+         * However we only need to know whether it was ADC, charger
+         * or both interrupts so decode IRQ and turn on proper flags.
+         */
+        for (i = 0; i < ARRAY_SIZE(muic_irqs); i++)
+                if (irq == muic_irqs[i].virq)
+                        irq_type = muic_irqs[i].irq;
+        switch (irq_type) {
+        case MAX14577_IRQ_INT1_ADC:
+        case MAX14577_IRQ_INT1_ADCLOW:
+        case MAX14577_IRQ_INT1_ADCERR:
+                /* Handle all of accessory except for
+                   type of charger accessory */
+                info->irq_adc = true;
+                break;
+        case MAX14577_IRQ_INT2_CHGTYP:
+        case MAX14577_IRQ_INT2_CHGDETRUN:
+        case MAX14577_IRQ_INT2_DCDTMR:
+        case MAX14577_IRQ_INT2_DBCHG:
+        case MAX14577_IRQ_INT2_VBVOLT:
+                /* Handle charger accessory */
+                info->irq_chg = true;
+                break;
+        default:
+                dev_err(info->dev, "muic interrupt: irq %d occurred, skipped\n",
+                                irq_type);
+                return IRQ_HANDLED;
+        }
+        schedule_work(&info->irq_work);
+        return IRQ_HANDLED;
+}
+static int max14577_muic_detect_accessory(struct max14577_muic_info *info)
+{
+        int ret = 0;
+        int adc;
+        int chg_type;
+        bool attached;
+        mutex_lock(&info->mutex);
+        /* Read STATUSx register to detect accessory */
+        ret = max14577_bulk_read(info->max14577->regmap,
+                        MAX14577_MUIC_REG_STATUS1, info->status, 2);
+        if (ret) {
+                dev_err(info->dev, "failed to read MUIC register\n");
+                mutex_unlock(&info->mutex);
+                return ret;
+        }
+        adc = max14577_muic_get_cable_type(info, MAX14577_CABLE_GROUP_ADC,
+                                        &attached);
+        if (attached && adc != MAX14577_MUIC_ADC_OPEN) {
+                ret = max14577_muic_adc_handler(info);
+                if (ret < 0) {
+                        dev_err(info->dev, "Cannot detect accessory\n");
+                        mutex_unlock(&info->mutex);
+                        return ret;
+                }
+        }
+        chg_type = max14577_muic_get_cable_type(info, MAX14577_CABLE_GROUP_CHG,
+                                        &attached);
+        if (attached && chg_type != MAX14577_CHARGER_TYPE_NONE) {
+                ret = max14577_muic_chg_handler(info);
+                if (ret < 0) {
+                        dev_err(info->dev, "Cannot detect charger accessory\n");
+                        mutex_unlock(&info->mutex);
+                        return ret;
+                }
+        }
+        mutex_unlock(&info->mutex);
+        return 0;
+}
+static void max14577_muic_detect_cable_wq(struct work_struct *work)
+{
+        struct max14577_muic_info *info = container_of(to_delayed_work(work),
+                                struct max14577_muic_info, wq_detcable);
+        max14577_muic_detect_accessory(info);
+}
+static int max14577_muic_probe(struct platform_device *pdev)
+{
+        struct max14577 *max14577 = dev_get_drvdata(pdev->dev.parent);
+        struct max14577_muic_info *info;
+        int delay_jiffies;
+        int ret;
+        int i;
+        u8 id;
+        info = devm_kzalloc(&pdev->dev, sizeof(*info), GFP_KERNEL);
+        if (!info) {
+                dev_err(&pdev->dev, "failed to allocate memory\n");
+                return -ENOMEM;
+        }
+        info->dev = &pdev->dev;
+        info->max14577 = max14577;
+        platform_set_drvdata(pdev, info);
+        mutex_init(&info->mutex);
+        INIT_WORK(&info->irq_work, max14577_muic_irq_work);
+        /* Support irq domain for max14577 MUIC device */
+        for (i = 0; i < ARRAY_SIZE(muic_irqs); i++) {
+                struct max14577_muic_irq *muic_irq = &muic_irqs[i];
+                unsigned int virq = 0;
+                virq = regmap_irq_get_virq(max14577->irq_data, muic_irq->irq);
+                if (!virq)
+                        return -EINVAL;
+                muic_irq->virq = virq;
+                ret = devm_request_threaded_irq(&pdev->dev, virq, NULL,
+                                max14577_muic_irq_handler,
+                                IRQF_NO_SUSPEND,
+                                muic_irq->name, info);
+                if (ret) {
+                        dev_err(&pdev->dev,
+                                "failed: irq request (IRQ: %d,"
+                                " error :%d)\n",
+                                muic_irq->irq, ret);
+                        return ret;
+                }
+        }
+        /* Initialize extcon device */
+        info->edev = devm_kzalloc(&pdev->dev, sizeof(*info->edev), GFP_KERNEL);
+        if (!info->edev) {
+                dev_err(&pdev->dev, "failed to allocate memory for extcon\n");
+                return -ENOMEM;
+        }
+        info->edev->name = DEV_NAME;
+        info->edev->supported_cable = max14577_extcon_cable;
+        ret = extcon_dev_register(info->edev);
+        if (ret) {
+                dev_err(&pdev->dev, "failed to register extcon device\n");
+                return ret;
+        }
+        /* Default h/w line path */
+        info->path_usb = CTRL1_SW_USB;
+        info->path_uart = CTRL1_SW_UART;
+        delay_jiffies = msecs_to_jiffies(DELAY_MS_DEFAULT);
+        /* Set initial path for UART */
+        max14577_muic_set_path(info, info->path_uart, true);
+        /* Check revision number of MUIC device*/
+        ret = max14577_read_reg(info->max14577->regmap,
+                        MAX14577_REG_DEVICEID, &id);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "failed to read revision number\n");
+                goto err_extcon;
+        }
+        dev_info(info->dev, "device ID : 0x%x\n", id);
+        /* Set ADC debounce time */
+        max14577_muic_set_debounce_time(info, ADC_DEBOUNCE_TIME_25MS);
+        /*
+         * Detect accessory after completing the initialization of platform
+         *
+         * - Use delayed workqueue to detect cable state and then
+         * notify cable state to notifiee/platform through uevent.
+         * After completing the booting of platform, the extcon provider
+         * driver should notify cable state to upper layer.
+         */
+        INIT_DELAYED_WORK(&info->wq_detcable, max14577_muic_detect_cable_wq);
+        ret = queue_delayed_work(system_power_efficient_wq, &info->wq_detcable,
+                        delay_jiffies);
+        if (ret < 0) {
+                dev_err(&pdev->dev,
+                        "failed to schedule delayed work for cable detect\n");
+                goto err_extcon;
+        }
+        return ret;
+err_extcon:
+        extcon_dev_unregister(info->edev);
+        return ret;
+}
+static int max14577_muic_remove(struct platform_device *pdev)
+{
+        struct max14577_muic_info *info = platform_get_drvdata(pdev);
+        cancel_work_sync(&info->irq_work);
+        extcon_dev_unregister(info->edev);
+        return 0;
+}
+static struct platform_driver max14577_muic_driver = {
+        .driver         = {
+                .name   = DEV_NAME,
+                .owner  = THIS_MODULE,
+        },
+        .probe          = max14577_muic_probe,
+        .remove         = max14577_muic_remove,
+};
+module_platform_driver(max14577_muic_driver);
+MODULE_DESCRIPTION("MAXIM 14577 Extcon driver");
+MODULE_AUTHOR("Chanwoo Choi <cw00.choi@samsung.com>");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:extcon-max14577");
diff --git a/drivers/extcon/extcon-palmas.c b/drivers/extcon/extcon-palmas.c
index 6c91976dd823..2aea4bcdd7f3 100644
--- a/drivers/extcon/extcon-palmas.c
+++ b/drivers/extcon/extcon-palmas.c
@@ -78,20 +78,24 @@ static irqreturn_t palmas_vbus_irq_handler(int irq, void *_palmas_usb)
 static irqreturn_t palmas_id_irq_handler(int irq, void *_palmas_usb)
 {
-        unsigned int set;
+        unsigned int set, id_src;
        struct palmas_usb *palmas_usb = _palmas_usb;
        palmas_read(palmas_usb->palmas, PALMAS_USB_OTG_BASE,
                PALMAS_USB_ID_INT_LATCH_SET, &set);
+        palmas_read(palmas_usb->palmas, PALMAS_USB_OTG_BASE,
+                PALMAS_USB_ID_INT_SRC, &id_src);
-        if (set & PALMAS_USB_ID_INT_SRC_ID_GND) {
+        if ((set & PALMAS_USB_ID_INT_SRC_ID_GND) &&
+                                (id_src & PALMAS_USB_ID_INT_SRC_ID_GND)) {
                palmas_write(palmas_usb->palmas, PALMAS_USB_OTG_BASE,
                        PALMAS_USB_ID_INT_LATCH_CLR,
                        PALMAS_USB_ID_INT_EN_HI_CLR_ID_GND);
                palmas_usb->linkstat = PALMAS_USB_STATE_ID;
                extcon_set_cable_state(&palmas_usb->edev, "USB-HOST", true);
                dev_info(palmas_usb->dev, "USB-HOST cable is attached\n");
-        } else if (set & PALMAS_USB_ID_INT_SRC_ID_FLOAT) {
+        } else if ((set & PALMAS_USB_ID_INT_SRC_ID_FLOAT) &&
+                                (id_src & PALMAS_USB_ID_INT_SRC_ID_FLOAT)) {
                palmas_write(palmas_usb->palmas, PALMAS_USB_OTG_BASE,
                        PALMAS_USB_ID_INT_LATCH_CLR,
                        PALMAS_USB_ID_INT_EN_HI_CLR_ID_FLOAT);
@@ -103,6 +107,11 @@ static irqreturn_t palmas_id_irq_handler(int irq, void *_palmas_usb)
                palmas_usb->linkstat = PALMAS_USB_STATE_DISCONNECT;
                extcon_set_cable_state(&palmas_usb->edev, "USB-HOST", false);
                dev_info(palmas_usb->dev, "USB-HOST cable is detached\n");
+        } else if ((palmas_usb->linkstat == PALMAS_USB_STATE_DISCONNECT) &&
+                                (id_src & PALMAS_USB_ID_INT_SRC_ID_GND)) {
+                palmas_usb->linkstat = PALMAS_USB_STATE_ID;
+                extcon_set_cable_state(&palmas_usb->edev, "USB-HOST", true);
+                dev_info(palmas_usb->dev, " USB-HOST cable is attached\n");
        }
        return IRQ_HANDLED;
@@ -269,7 +278,9 @@ static const struct dev_pm_ops palmas_pm_ops = {
 static struct of_device_id of_palmas_match_tbl[] = {
        { .compatible = "ti,palmas-usb", },
+        { .compatible = "ti,palmas-usb-vid", },
        { .compatible = "ti,twl6035-usb", },
+        { .compatible = "ti,twl6035-usb-vid", },
        { /* end */ }
 };
diff --git a/drivers/firmware/Makefile b/drivers/firmware/Makefile
index 299fad6b5867..5373dc5b6011 100644
--- a/drivers/firmware/Makefile
+++ b/drivers/firmware/Makefile
@@ -14,3 +14,4 @@ obj-$(CONFIG_FIRMWARE_MEMMAP)	+= memmap.o
 obj-$(CONFIG_GOOGLE_FIRMWARE)   += google/
 obj-$(CONFIG_EFI)               += efi/
+obj-$(CONFIG_UEFI_CPER)         += efi/
diff --git a/drivers/firmware/efi/Kconfig b/drivers/firmware/efi/Kconfig
index 3150aa4874e8..1e75f48b61f8 100644
--- a/drivers/firmware/efi/Kconfig
+++ b/drivers/firmware/efi/Kconfig
@@ -36,7 +36,18 @@ config EFI_VARS_PSTORE_DEFAULT_DISABLE
          backend for pstore by default. This setting can be overridden
          using the efivars module's pstore_disable parameter.
-config UEFI_CPER
+config EFI_RUNTIME_MAP
-        def_bool n
+        bool "Export efi runtime maps to sysfs"
+        depends on X86 && EFI && KEXEC
+        default y
+        help
+          Export efi runtime memory maps to /sys/firmware/efi/runtime-map.
+          That memory map is used for example by kexec to set up efi virtual
+          mapping the 2nd kernel, but can also be used for debugging purposes.
+          See also Documentation/ABI/testing/sysfs-firmware-efi-runtime-map.
 endmenu
+config UEFI_CPER
+        bool
diff --git a/drivers/firmware/efi/Makefile b/drivers/firmware/efi/Makefile
index 9ba156d3c775..9553496b0f43 100644
--- a/drivers/firmware/efi/Makefile
+++ b/drivers/firmware/efi/Makefile
@@ -1,7 +1,8 @@
 #
 # Makefile for linux kernel
 #
-obj-y                                   += efi.o vars.o
+obj-$(CONFIG_EFI)                       += efi.o vars.o
 obj-$(CONFIG_EFI_VARS)                  += efivars.o
 obj-$(CONFIG_EFI_VARS_PSTORE)           += efi-pstore.o
 obj-$(CONFIG_UEFI_CPER)                 += cper.o
+obj-$(CONFIG_EFI_RUNTIME_MAP)           += runtime-map.o
diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c
index 2e2fbdec0845..4753bac65279 100644
--- a/drivers/firmware/efi/efi.c
+++ b/drivers/firmware/efi/efi.c
@@ -32,6 +32,9 @@ struct efi __read_mostly efi = {
        .hcdp       = EFI_INVALID_TABLE_ADDR,
        .uga        = EFI_INVALID_TABLE_ADDR,
        .uv_systab  = EFI_INVALID_TABLE_ADDR,
+        .fw_vendor  = EFI_INVALID_TABLE_ADDR,
+        .runtime    = EFI_INVALID_TABLE_ADDR,
+        .config_table  = EFI_INVALID_TABLE_ADDR,
 };
 EXPORT_SYMBOL(efi);
@@ -71,13 +74,49 @@ static ssize_t systab_show(struct kobject *kobj,
 static struct kobj_attribute efi_attr_systab =
                        __ATTR(systab, 0400, systab_show, NULL);
+#define EFI_FIELD(var) efi.var
+#define EFI_ATTR_SHOW(name) \
+static ssize_t name##_show(struct kobject *kobj, \
+                                struct kobj_attribute *attr, char *buf) \
+{ \
+        return sprintf(buf, "0x%lx\n", EFI_FIELD(name)); \
+}
+EFI_ATTR_SHOW(fw_vendor);
+EFI_ATTR_SHOW(runtime);
+EFI_ATTR_SHOW(config_table);
+static struct kobj_attribute efi_attr_fw_vendor = __ATTR_RO(fw_vendor);
+static struct kobj_attribute efi_attr_runtime = __ATTR_RO(runtime);
+static struct kobj_attribute efi_attr_config_table = __ATTR_RO(config_table);
 static struct attribute *efi_subsys_attrs[] = {
        &efi_attr_systab.attr,
-        NULL,   /* maybe more in the future? */
+        &efi_attr_fw_vendor.attr,
+        &efi_attr_runtime.attr,
+        &efi_attr_config_table.attr,
+        NULL,
 };
+static umode_t efi_attr_is_visible(struct kobject *kobj,
+                                   struct attribute *attr, int n)
+{
+        umode_t mode = attr->mode;
+        if (attr == &efi_attr_fw_vendor.attr)
+                return (efi.fw_vendor == EFI_INVALID_TABLE_ADDR) ? 0 : mode;
+        else if (attr == &efi_attr_runtime.attr)
+                return (efi.runtime == EFI_INVALID_TABLE_ADDR) ? 0 : mode;
+        else if (attr == &efi_attr_config_table.attr)
+                return (efi.config_table == EFI_INVALID_TABLE_ADDR) ? 0 : mode;
+        return mode;
+}
 static struct attribute_group efi_subsys_attr_group = {
        .attrs = efi_subsys_attrs,
+        .is_visible = efi_attr_is_visible,
 };
 static struct efivars generic_efivars;
@@ -128,6 +167,10 @@ static int __init efisubsys_init(void)
                goto err_unregister;
        }
+        error = efi_runtime_map_init(efi_kobj);
+        if (error)
+                goto err_remove_group;
        /* and the standard mountpoint for efivarfs */
        efivars_kobj = kobject_create_and_add("efivars", efi_kobj);
        if (!efivars_kobj) {
diff --git a/drivers/firmware/efi/runtime-map.c b/drivers/firmware/efi/runtime-map.c
new file mode 100644
index 000000000000..97cdd16a2169
--- /dev/null
+++ b/drivers/firmware/efi/runtime-map.c
@@ -0,0 +1,181 @@
+/*
+ * linux/drivers/efi/runtime-map.c
+ * Copyright (C) 2013 Red Hat, Inc., Dave Young <dyoung@redhat.com>
+ *
+ * This file is released under the GPLv2.
+ */
+#include <linux/string.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/efi.h>
+#include <linux/slab.h>
+#include <asm/setup.h>
+static void *efi_runtime_map;
+static int nr_efi_runtime_map;
+static u32 efi_memdesc_size;
+struct efi_runtime_map_entry {
+        efi_memory_desc_t md;
+        struct kobject kobj;   /* kobject for each entry */
+};
+static struct efi_runtime_map_entry **map_entries;
+struct map_attribute {
+        struct attribute attr;
+        ssize_t (*show)(struct efi_runtime_map_entry *entry, char *buf);
+};
+static inline struct map_attribute *to_map_attr(struct attribute *attr)
+{
+        return container_of(attr, struct map_attribute, attr);
+}
+static ssize_t type_show(struct efi_runtime_map_entry *entry, char *buf)
+{
+        return snprintf(buf, PAGE_SIZE, "0x%x\n", entry->md.type);
+}
+#define EFI_RUNTIME_FIELD(var) entry->md.var
+#define EFI_RUNTIME_U64_ATTR_SHOW(name) \
+static ssize_t name##_show(struct efi_runtime_map_entry *entry, char *buf) \
+{ \
+        return snprintf(buf, PAGE_SIZE, "0x%llx\n", EFI_RUNTIME_FIELD(name)); \
+}
+EFI_RUNTIME_U64_ATTR_SHOW(phys_addr);
+EFI_RUNTIME_U64_ATTR_SHOW(virt_addr);
+EFI_RUNTIME_U64_ATTR_SHOW(num_pages);
+EFI_RUNTIME_U64_ATTR_SHOW(attribute);
+static inline struct efi_runtime_map_entry *to_map_entry(struct kobject *kobj)
+{
+        return container_of(kobj, struct efi_runtime_map_entry, kobj);
+}
+static ssize_t map_attr_show(struct kobject *kobj, struct attribute *attr,
+                              char *buf)
+{
+        struct efi_runtime_map_entry *entry = to_map_entry(kobj);
+        struct map_attribute *map_attr = to_map_attr(attr);
+        return map_attr->show(entry, buf);
+}
+static struct map_attribute map_type_attr = __ATTR_RO(type);
+static struct map_attribute map_phys_addr_attr   = __ATTR_RO(phys_addr);
+static struct map_attribute map_virt_addr_attr  = __ATTR_RO(virt_addr);
+static struct map_attribute map_num_pages_attr  = __ATTR_RO(num_pages);
+static struct map_attribute map_attribute_attr  = __ATTR_RO(attribute);
+/*
+ * These are default attributes that are added for every memmap entry.
+ */
+static struct attribute *def_attrs[] = {
+        &map_type_attr.attr,
+        &map_phys_addr_attr.attr,
+        &map_virt_addr_attr.attr,
+        &map_num_pages_attr.attr,
+        &map_attribute_attr.attr,
+        NULL
+};
+static const struct sysfs_ops map_attr_ops = {
+        .show = map_attr_show,
+};
+static void map_release(struct kobject *kobj)
+{
+        struct efi_runtime_map_entry *entry;
+        entry = to_map_entry(kobj);
+        kfree(entry);
+}
+static struct kobj_type __refdata map_ktype = {
+        .sysfs_ops      = &map_attr_ops,
+        .default_attrs  = def_attrs,
+        .release        = map_release,
+};
+static struct kset *map_kset;
+static struct efi_runtime_map_entry *
+add_sysfs_runtime_map_entry(struct kobject *kobj, int nr)
+{
+        int ret;
+        struct efi_runtime_map_entry *entry;
+        if (!map_kset) {
+                map_kset = kset_create_and_add("runtime-map", NULL, kobj);
+                if (!map_kset)
+                        return ERR_PTR(-ENOMEM);
+        }
+        entry = kzalloc(sizeof(*entry), GFP_KERNEL);
+        if (!entry) {
+                kset_unregister(map_kset);
+                return entry;
+        }
+        memcpy(&entry->md, efi_runtime_map + nr * efi_memdesc_size,
+               sizeof(efi_memory_desc_t));
+        kobject_init(&entry->kobj, &map_ktype);
+        entry->kobj.kset = map_kset;
+        ret = kobject_add(&entry->kobj, NULL, "%d", nr);
+        if (ret) {
+                kobject_put(&entry->kobj);
+                kset_unregister(map_kset);
+                return ERR_PTR(ret);
+        }
+        return entry;
+}
+void efi_runtime_map_setup(void *map, int nr_entries, u32 desc_size)
+{
+        efi_runtime_map = map;
+        nr_efi_runtime_map = nr_entries;
+        efi_memdesc_size = desc_size;
+}
+int __init efi_runtime_map_init(struct kobject *efi_kobj)
+{
+        int i, j, ret = 0;
+        struct efi_runtime_map_entry *entry;
+        if (!efi_runtime_map)
+                return 0;
+        map_entries = kzalloc(nr_efi_runtime_map * sizeof(entry), GFP_KERNEL);
+        if (!map_entries) {
+                ret = -ENOMEM;
+                goto out;
+        }
+        for (i = 0; i < nr_efi_runtime_map; i++) {
+                entry = add_sysfs_runtime_map_entry(efi_kobj, i);
+                if (IS_ERR(entry)) {
+                        ret = PTR_ERR(entry);
+                        goto out_add_entry;
+                }
+                *(map_entries + i) = entry;
+        }
+        return 0;
+out_add_entry:
+        for (j = i - 1; j > 0; j--) {
+                entry = *(map_entries + j);
+                kobject_put(&entry->kobj);
+        }
+        if (map_kset)
+                kset_unregister(map_kset);
+out:
+        return ret;
+}
diff --git a/drivers/gpu/drm/drm_modes.c b/drivers/gpu/drm/drm_modes.c
index 85071a1c4547..b0733153dfd2 100644
--- a/drivers/gpu/drm/drm_modes.c
+++ b/drivers/gpu/drm/drm_modes.c
@@ -1041,7 +1041,7 @@ void drm_mode_connector_list_update(struct drm_connector *connector)
                                /* if equal delete the probed mode */
                                mode->status = pmode->status;
                                /* Merge type bits together */
-                                mode->type = pmode->type;
+                                mode->type |= pmode->type;
                                list_del(&pmode->head);
                                drm_mode_destroy(connector->dev, pmode);
                                break;
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 621c7c67a643..76d3d1ab73c6 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -2343,15 +2343,24 @@ static void i915_gem_free_request(struct drm_i915_gem_request *request)
        kfree(request);
 }
-static void i915_gem_reset_ring_lists(struct drm_i915_private *dev_priv,
+static void i915_gem_reset_ring_status(struct drm_i915_private *dev_priv,
-                                      struct intel_ring_buffer *ring)
+                                       struct intel_ring_buffer *ring)
 {
-        u32 completed_seqno;
+        u32 completed_seqno = ring->get_seqno(ring, false);
-        u32 acthd;
+        u32 acthd = intel_ring_get_active_head(ring);
+        struct drm_i915_gem_request *request;
+        list_for_each_entry(request, &ring->request_list, list) {
+                if (i915_seqno_passed(completed_seqno, request->seqno))
+                        continue;
-        acthd = intel_ring_get_active_head(ring);
+                i915_set_reset_status(ring, request, acthd);
-        completed_seqno = ring->get_seqno(ring, false);
+        }
+}
+static void i915_gem_reset_ring_cleanup(struct drm_i915_private *dev_priv,
+                                        struct intel_ring_buffer *ring)
+{
        while (!list_empty(&ring->request_list)) {
                struct drm_i915_gem_request *request;
@@ -2359,9 +2368,6 @@ static void i915_gem_reset_ring_lists(struct drm_i915_private *dev_priv,
                                           struct drm_i915_gem_request,
                                           list);
-                if (request->seqno > completed_seqno)
-                        i915_set_reset_status(ring, request, acthd);
                i915_gem_free_request(request);
        }
@@ -2403,8 +2409,16 @@ void i915_gem_reset(struct drm_device *dev)
        struct intel_ring_buffer *ring;
        int i;
+        /*
+         * Before we free the objects from the requests, we need to inspect
+         * them for finding the guilty party. As the requests only borrow
+         * their reference to the objects, the inspection must be done first.
+         */
+        for_each_ring(ring, dev_priv, i)
+                i915_gem_reset_ring_status(dev_priv, ring);
        for_each_ring(ring, dev_priv, i)
-                i915_gem_reset_ring_lists(dev_priv, ring);
+                i915_gem_reset_ring_cleanup(dev_priv, ring);
        i915_gem_cleanup_ringbuffer(dev);
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index b7e787fb4649..a3ba9a8cd687 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -93,7 +93,7 @@ eb_lookup_vmas(struct eb_vmas *eb,
 {
        struct drm_i915_gem_object *obj;
        struct list_head objects;
-        int i, ret = 0;
+        int i, ret;
        INIT_LIST_HEAD(&objects);
        spin_lock(&file->table_lock);
@@ -106,7 +106,7 @@ eb_lookup_vmas(struct eb_vmas *eb,
                        DRM_DEBUG("Invalid object handle %d at index %d\n",
                                   exec[i].handle, i);
                        ret = -ENOENT;
-                        goto out;
+                        goto err;
                }
                if (!list_empty(&obj->obj_exec_link)) {
@@ -114,7 +114,7 @@ eb_lookup_vmas(struct eb_vmas *eb,
                        DRM_DEBUG("Object %p [handle %d, index %d] appears more than once in object list\n",
                                   obj, exec[i].handle, i);
                        ret = -EINVAL;
-                        goto out;
+                        goto err;
                }
                drm_gem_object_reference(&obj->base);
@@ -123,9 +123,13 @@ eb_lookup_vmas(struct eb_vmas *eb,
        spin_unlock(&file->table_lock);
        i = 0;
-        list_for_each_entry(obj, &objects, obj_exec_link) {
+        while (!list_empty(&objects)) {
                struct i915_vma *vma;
+                obj = list_first_entry(&objects,
+                                       struct drm_i915_gem_object,
+                                       obj_exec_link);
                /*
                 * NOTE: We can leak any vmas created here when something fails
                 * later on. But that's no issue since vma_unbind can deal with
@@ -138,10 +142,12 @@ eb_lookup_vmas(struct eb_vmas *eb,
                if (IS_ERR(vma)) {
                        DRM_DEBUG("Failed to lookup VMA\n");
                        ret = PTR_ERR(vma);
-                        goto out;
+                        goto err;
                }
+                /* Transfer ownership from the objects list to the vmas list. */
                list_add_tail(&vma->exec_list, &eb->vmas);
+                list_del_init(&obj->obj_exec_link);
                vma->exec_entry = &exec[i];
                if (eb->and < 0) {
@@ -155,16 +161,22 @@ eb_lookup_vmas(struct eb_vmas *eb,
                ++i;
        }
+        return 0;
-out:
+err:
        while (!list_empty(&objects)) {
                obj = list_first_entry(&objects,
                                       struct drm_i915_gem_object,
                                       obj_exec_link);
                list_del_init(&obj->obj_exec_link);
-                if (ret)
+                drm_gem_object_unreference(&obj->base);
-                        drm_gem_object_unreference(&obj->base);
        }
+        /*
+         * Objects already transfered to the vmas list will be unreferenced by
+         * eb_destroy.
+         */
        return ret;
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_gtt.c b/drivers/gpu/drm/i915/i915_gem_gtt.c
index c79dd2b1f70e..d3c3b5b15824 100644
--- a/drivers/gpu/drm/i915/i915_gem_gtt.c
+++ b/drivers/gpu/drm/i915/i915_gem_gtt.c
@@ -906,14 +906,12 @@ static void gen8_ggtt_insert_entries(struct i915_address_space *vm,
                WARN_ON(readq(&gtt_entries[i-1])
                        != gen8_pte_encode(addr, level, true));
-#if 0 /* TODO: Still needed on GEN8? */
        /* This next bit makes the above posting read even more important. We
         * want to flush the TLBs only after we're certain all the PTE updates
         * have finished.
         */
        I915_WRITE(GFX_FLSH_CNTL_GEN6, GFX_FLSH_CNTL_EN);
        POSTING_READ(GFX_FLSH_CNTL_GEN6);
-#endif
 }
 /*
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 5d1dedc02f15..f13d5edc39d5 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -2713,6 +2713,8 @@ static void gen8_irq_preinstall(struct drm_device *dev)
 #undef GEN8_IRQ_INIT_NDX
        POSTING_READ(GEN8_PCU_IIR);
+        ibx_irq_preinstall(dev);
 }
 static void ibx_hpd_irq_setup(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_ddi.c b/drivers/gpu/drm/i915/intel_ddi.c
index 526c8ded16b0..b69dc3e66c16 100644
--- a/drivers/gpu/drm/i915/intel_ddi.c
+++ b/drivers/gpu/drm/i915/intel_ddi.c
@@ -1057,12 +1057,18 @@ void intel_ddi_setup_hw_pll_state(struct drm_device *dev)
        enum pipe pipe;
        struct intel_crtc *intel_crtc;
+        dev_priv->ddi_plls.spll_refcount = 0;
+        dev_priv->ddi_plls.wrpll1_refcount = 0;
+        dev_priv->ddi_plls.wrpll2_refcount = 0;
        for_each_pipe(pipe) {
                intel_crtc =
                        to_intel_crtc(dev_priv->pipe_to_crtc_mapping[pipe]);
-                if (!intel_crtc->active)
+                if (!intel_crtc->active) {
+                        intel_crtc->ddi_pll_sel = PORT_CLK_SEL_NONE;
                        continue;
+                }
                intel_crtc->ddi_pll_sel = intel_ddi_get_crtc_pll(dev_priv,
                                                                 pipe);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 8b8bde7dce53..2bde35d34eb9 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -6303,7 +6303,7 @@ static void assert_can_disable_lcpll(struct drm_i915_private *dev_priv)
        uint32_t val;
        list_for_each_entry(crtc, &dev->mode_config.crtc_list, base.head)
-                WARN(crtc->base.enabled, "CRTC for pipe %c enabled\n",
+                WARN(crtc->active, "CRTC for pipe %c enabled\n",
                     pipe_name(crtc->pipe));
        WARN(I915_READ(HSW_PWR_WELL_DRIVER), "Power well on\n");
@@ -10541,11 +10541,20 @@ static struct intel_quirk intel_quirks[] = {
        /* Sony Vaio Y cannot use SSC on LVDS */
        { 0x0046, 0x104d, 0x9076, quirk_ssc_force_disable },
-        /*
+        /* Acer Aspire 5734Z must invert backlight brightness */
-         * All GM45 Acer (and its brands eMachines and Packard Bell) laptops
+        { 0x2a42, 0x1025, 0x0459, quirk_invert_brightness },
-         * seem to use inverted backlight PWM.
-         */
+        /* Acer/eMachines G725 */
-        { 0x2a42, 0x1025, PCI_ANY_ID, quirk_invert_brightness },
+        { 0x2a42, 0x1025, 0x0210, quirk_invert_brightness },
+        /* Acer/eMachines e725 */
+        { 0x2a42, 0x1025, 0x0212, quirk_invert_brightness },
+        /* Acer/Packard Bell NCL20 */
+        { 0x2a42, 0x1025, 0x034b, quirk_invert_brightness },
+        /* Acer Aspire 4736Z */
+        { 0x2a42, 0x1025, 0x0260, quirk_invert_brightness },
        /* Dell XPS13 HD Sandy Bridge */
        { 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable },
@@ -11044,10 +11053,10 @@ void intel_modeset_gem_init(struct drm_device *dev)
        intel_setup_overlay(dev);
-        drm_modeset_lock_all(dev);
+        mutex_lock(&dev->mode_config.mutex);
        drm_mode_config_reset(dev);
        intel_modeset_setup_hw_state(dev, false);
-        drm_modeset_unlock_all(dev);
+        mutex_unlock(&dev->mode_config.mutex);
 }
 void intel_modeset_cleanup(struct drm_device *dev)
@@ -11126,14 +11135,15 @@ void intel_connector_attach_encoder(struct intel_connector *connector,
 int intel_modeset_vga_set_state(struct drm_device *dev, bool state)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
+        unsigned reg = INTEL_INFO(dev)->gen >= 6 ? SNB_GMCH_CTRL : INTEL_GMCH_CTRL;
        u16 gmch_ctrl;
-        pci_read_config_word(dev_priv->bridge_dev, INTEL_GMCH_CTRL, &gmch_ctrl);
+        pci_read_config_word(dev_priv->bridge_dev, reg, &gmch_ctrl);
        if (state)
                gmch_ctrl &= ~INTEL_GMCH_VGA_DISABLE;
        else
                gmch_ctrl |= INTEL_GMCH_VGA_DISABLE;
-        pci_write_config_word(dev_priv->bridge_dev, INTEL_GMCH_CTRL, gmch_ctrl);
+        pci_write_config_word(dev_priv->bridge_dev, reg, gmch_ctrl);
        return 0;
 }
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 3657ab43c8fd..26c29c173221 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -5688,6 +5688,8 @@ static void __intel_set_power_well(struct drm_device *dev, bool enable)
        unsigned long irqflags;
        uint32_t tmp;
+        WARN_ON(dev_priv->pc8.enabled);
        tmp = I915_READ(HSW_PWR_WELL_DRIVER);
        is_enabled = tmp & HSW_PWR_WELL_STATE_ENABLED;
        enable_requested = tmp & HSW_PWR_WELL_ENABLE_REQUEST;
@@ -5747,16 +5749,24 @@ static void __intel_set_power_well(struct drm_device *dev, bool enable)
 static void __intel_power_well_get(struct drm_device *dev,
                                   struct i915_power_well *power_well)
 {
-        if (!power_well->count++)
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        if (!power_well->count++) {
+                hsw_disable_package_c8(dev_priv);
                __intel_set_power_well(dev, true);
+        }
 }
 static void __intel_power_well_put(struct drm_device *dev,
                                   struct i915_power_well *power_well)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
        WARN_ON(!power_well->count);
-        if (!--power_well->count && i915_disable_power_well)
+        if (!--power_well->count && i915_disable_power_well) {
                __intel_set_power_well(dev, false);
+                hsw_enable_package_c8(dev_priv);
+        }
 }
 void intel_display_power_get(struct drm_device *dev,
diff --git a/drivers/gpu/drm/nouveau/core/core/subdev.c b/drivers/gpu/drm/nouveau/core/core/subdev.c
index 48f06378d3f9..2ea5568b6cf5 100644
--- a/drivers/gpu/drm/nouveau/core/core/subdev.c
+++ b/drivers/gpu/drm/nouveau/core/core/subdev.c
@@ -104,11 +104,8 @@ nouveau_subdev_create_(struct nouveau_object *parent,
        if (parent) {
                struct nouveau_device *device = nv_device(parent);
-                int subidx = nv_hclass(subdev) & 0xff;
                subdev->debug = nouveau_dbgopt(device->dbgopt, subname);
                subdev->mmio  = nv_subdev(device)->mmio;
-                device->subdev[subidx] = *pobject;
        }
        return 0;
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/base.c b/drivers/gpu/drm/nouveau/core/engine/device/base.c
index 9135b25a29d0..dd01c6c435d6 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/base.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/base.c
@@ -268,6 +268,8 @@ nouveau_devobj_ctor(struct nouveau_object *parent,
                if (ret)
                        return ret;
+                device->subdev[i] = devobj->subdev[i];
                /* note: can't init *any* subdevs until devinit has been run
                 * due to not knowing exactly what the vbios init tables will
                 * mess with.  devinit also can't be run until all of its
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
index 8d06eef2b9ee..dbc5e33de94f 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
@@ -161,7 +161,7 @@ nvc0_identify(struct nouveau_device *device)
                device->oclass[NVDEV_SUBDEV_THERM  ] = &nva3_therm_oclass;
                device->oclass[NVDEV_SUBDEV_MXM    ] = &nv50_mxm_oclass;
                device->oclass[NVDEV_SUBDEV_DEVINIT] = &nvc0_devinit_oclass;
-                device->oclass[NVDEV_SUBDEV_MC     ] =  nvc3_mc_oclass;
+                device->oclass[NVDEV_SUBDEV_MC     ] =  nvc0_mc_oclass;
                device->oclass[NVDEV_SUBDEV_BUS    ] =  nvc0_bus_oclass;
                device->oclass[NVDEV_SUBDEV_TIMER  ] = &nv04_timer_oclass;
                device->oclass[NVDEV_SUBDEV_FB     ] =  nvc0_fb_oclass;
diff --git a/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
index 434bb4b0fa2e..5c8a63dc506a 100644
--- a/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/graph/nvc0.c
@@ -334,7 +334,7 @@ nvc0_graph_mthd(struct nvc0_graph_priv *priv, struct nvc0_graph_mthd *mthds)
        while ((mthd = &mthds[i++]) && (init = mthd->init)) {
                u32  addr = 0x80000000 | mthd->oclass;
                for (data = 0; init->count; init++) {
-                        if (data != init->data) {
+                        if (init == mthd->init || data != init->data) {
                                nv_wr32(priv, 0x40448c, init->data);
                                data = init->data;
                        }
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/fb.h b/drivers/gpu/drm/nouveau/core/include/subdev/fb.h
index 8541aa382ff2..d89dbdf39b0d 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/fb.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/fb.h
@@ -75,6 +75,11 @@ struct nouveau_fb {
 static inline struct nouveau_fb *
 nouveau_fb(void *obj)
 {
+        /* fbram uses this before device subdev pointer is valid */
+        if (nv_iclass(obj, NV_SUBDEV_CLASS) &&
+            nv_subidx(obj) == NVDEV_SUBDEV_FB)
+                return obj;
        return (void *)nv_device(obj)->subdev[NVDEV_SUBDEV_FB];
 }
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/i2c.h b/drivers/gpu/drm/nouveau/core/include/subdev/i2c.h
index 9fa5da723871..7f50a858b16f 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/i2c.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/i2c.h
@@ -73,7 +73,7 @@ struct nouveau_i2c {
        int (*identify)(struct nouveau_i2c *, int index,
                        const char *what, struct nouveau_i2c_board_info *,
                        bool (*match)(struct nouveau_i2c_port *,
-                                      struct i2c_board_info *));
+                                      struct i2c_board_info *, void *), void *);
        struct list_head ports;
 };
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/instmem.h b/drivers/gpu/drm/nouveau/core/include/subdev/instmem.h
index ec7a54e91a08..4aca33887aaa 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/instmem.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/instmem.h
@@ -50,6 +50,13 @@ struct nouveau_instmem {
 static inline struct nouveau_instmem *
 nouveau_instmem(void *obj)
 {
+        /* nv04/nv40 impls need to create objects in their constructor,
+         * which is before the subdev pointer is valid
+         */
+        if (nv_iclass(obj, NV_SUBDEV_CLASS) &&
+            nv_subidx(obj) == NVDEV_SUBDEV_INSTMEM)
+                return obj;
        return (void *)nv_device(obj)->subdev[NVDEV_SUBDEV_INSTMEM];
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
index 420908cb82b6..df1b1b423093 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
@@ -365,13 +365,13 @@ static u16
 init_script(struct nouveau_bios *bios, int index)
 {
        struct nvbios_init init = { .bios = bios };
-        u16 data;
+        u16 bmp_ver = bmp_version(bios), data;
-        if (bmp_version(bios) && bmp_version(bios) < 0x0510) {
+        if (bmp_ver && bmp_ver < 0x0510) {
-                if (index > 1)
+                if (index > 1 || bmp_ver < 0x0100)
                        return 0x0000;
-                data = bios->bmp_offset + (bios->version.major < 2 ? 14 : 18);
+                data = bios->bmp_offset + (bmp_ver < 0x0200 ? 14 : 18);
                return nv_ro16(bios, data + (index * 2));
        }
@@ -1294,7 +1294,11 @@ init_jump(struct nvbios_init *init)
        u16 offset = nv_ro16(bios, init->offset + 1);
        trace("JUMP\t0x%04x\n", offset);
-        init->offset = offset;
+        if (init_exec(init))
+                init->offset = offset;
+        else
+                init->offset += 3;
 }
 /**
diff --git a/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c b/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c
index 041fd5edaebf..c33c03d2f4af 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/i2c/base.c
@@ -197,7 +197,7 @@ static int
 nouveau_i2c_identify(struct nouveau_i2c *i2c, int index, const char *what,
                     struct nouveau_i2c_board_info *info,
                     bool (*match)(struct nouveau_i2c_port *,
-                                   struct i2c_board_info *))
+                                   struct i2c_board_info *, void *), void *data)
 {
        struct nouveau_i2c_port *port = nouveau_i2c_find(i2c, index);
        int i;
@@ -221,7 +221,7 @@ nouveau_i2c_identify(struct nouveau_i2c *i2c, int index, const char *what,
                }
                if (nv_probe_i2c(port, info[i].dev.addr) &&
-                    (!match || match(port, &info[i].dev))) {
+                    (!match || match(port, &info[i].dev, data))) {
                        nv_info(i2c, "detected %s: %s\n", what,
                                info[i].dev.type);
                        return i;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
index af129c2e8113..64f8b4702bf7 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/mxm/nv50.c
@@ -100,7 +100,7 @@ mxm_match_dcb(struct nouveau_mxm *mxm, u8 *data, void *info)
 static int
 mxm_dcb_sanitise_entry(struct nouveau_bios *bios, void *data, int idx, u16 pdcb)
 {
-        struct nouveau_mxm *mxm = nouveau_mxm(bios);
+        struct nouveau_mxm *mxm = data;
        struct context ctx = { .outp = (u32 *)(bios->data + pdcb) };
        u8 type, i2cidx, link, ver, len;
        u8 *conn;
@@ -199,7 +199,7 @@ mxm_dcb_sanitise(struct nouveau_mxm *mxm)
                return;
        }
-        dcb_outp_foreach(bios, NULL, mxm_dcb_sanitise_entry);
+        dcb_outp_foreach(bios, mxm, mxm_dcb_sanitise_entry);
        mxms_foreach(mxm, 0x01, mxm_show_unmatched, NULL);
 }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c b/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c
index e44ed7b93c6d..7610fc5f8fa2 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/therm/ic.c
@@ -29,9 +29,9 @@
 static bool
 probe_monitoring_device(struct nouveau_i2c_port *i2c,
-                        struct i2c_board_info *info)
+                        struct i2c_board_info *info, void *data)
 {
-        struct nouveau_therm_priv *priv = (void *)nouveau_therm(i2c);
+        struct nouveau_therm_priv *priv = data;
        struct nvbios_therm_sensor *sensor = &priv->bios_sensor;
        struct i2c_client *client;
@@ -96,7 +96,7 @@ nouveau_therm_ic_ctor(struct nouveau_therm *therm)
                };
                i2c->identify(i2c, NV_I2C_DEFAULT(0), "monitoring device",
-                                  board, probe_monitoring_device);
+                              board, probe_monitoring_device, therm);
                if (priv->ic)
                        return;
        }
@@ -108,7 +108,7 @@ nouveau_therm_ic_ctor(struct nouveau_therm *therm)
                };
                i2c->identify(i2c, NV_I2C_DEFAULT(0), "monitoring device",
-                                  board, probe_monitoring_device);
+                              board, probe_monitoring_device, therm);
                if (priv->ic)
                        return;
        }
@@ -117,5 +117,5 @@ nouveau_therm_ic_ctor(struct nouveau_therm *therm)
           device. Let's try our static list.
         */
        i2c->identify(i2c, NV_I2C_DEFAULT(0), "monitoring device",
-                      nv_board_infos, probe_monitoring_device);
+                      nv_board_infos, probe_monitoring_device, therm);
 }
diff --git a/drivers/gpu/drm/nouveau/dispnv04/dfp.c b/drivers/gpu/drm/nouveau/dispnv04/dfp.c
index 936a71c59080..7fdc51e2a571 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/dfp.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/dfp.c
@@ -643,7 +643,7 @@ static void nv04_tmds_slave_init(struct drm_encoder *encoder)
            get_tmds_slave(encoder))
                return;
-        type = i2c->identify(i2c, 2, "TMDS transmitter", info, NULL);
+        type = i2c->identify(i2c, 2, "TMDS transmitter", info, NULL, NULL);
        if (type < 0)
                return;
diff --git a/drivers/gpu/drm/nouveau/dispnv04/tvnv04.c b/drivers/gpu/drm/nouveau/dispnv04/tvnv04.c
index cc4b208ce546..244822df8ffc 100644
--- a/drivers/gpu/drm/nouveau/dispnv04/tvnv04.c
+++ b/drivers/gpu/drm/nouveau/dispnv04/tvnv04.c
@@ -59,7 +59,7 @@ int nv04_tv_identify(struct drm_device *dev, int i2c_index)
        struct nouveau_i2c *i2c = nouveau_i2c(drm->device);
        return i2c->identify(i2c, i2c_index, "TV encoder",
-                             nv04_tv_encoder_info, NULL);
+                             nv04_tv_encoder_info, NULL, NULL);
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_abi16.c b/drivers/gpu/drm/nouveau/nouveau_abi16.c
index 6828d81ed7b9..900fae01793e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_abi16.c
+++ b/drivers/gpu/drm/nouveau/nouveau_abi16.c
@@ -447,6 +447,8 @@ nouveau_abi16_ioctl_notifierobj_alloc(ABI16_IOCTL_ARGS)
        if (ret)
                goto done;
+        info->offset = ntfy->node->offset;
 done:
        if (ret)
                nouveau_abi16_ntfy_fini(chan, ntfy);
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 95c740454049..ba0183fb84f3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -51,6 +51,7 @@ static struct nouveau_dsm_priv {
        bool dsm_detected;
        bool optimus_detected;
        acpi_handle dhandle;
+        acpi_handle other_handle;
        acpi_handle rom_handle;
 } nouveau_dsm_priv;
@@ -260,9 +261,10 @@ static int nouveau_dsm_pci_probe(struct pci_dev *pdev)
        if (!dhandle)
                return false;
-        if (!acpi_has_method(dhandle, "_DSM"))
+        if (!acpi_has_method(dhandle, "_DSM")) {
+                nouveau_dsm_priv.other_handle = dhandle;
                return false;
+        }
        if (nouveau_test_dsm(dhandle, nouveau_dsm, NOUVEAU_DSM_POWER))
                retval |= NOUVEAU_DSM_HAS_MUX;
@@ -338,6 +340,16 @@ static bool nouveau_dsm_detect(void)
                printk(KERN_INFO "VGA switcheroo: detected DSM switching method %s handle\n",
                        acpi_method_name);
                nouveau_dsm_priv.dsm_detected = true;
+                /*
+                 * On some systems hotplug events are generated for the device
+                 * being switched off when _DSM is executed.  They cause ACPI
+                 * hotplug to trigger and attempt to remove the device from
+                 * the system, which causes it to break down.  Prevent that from
+                 * happening by setting the no_hotplug flag for the involved
+                 * ACPI device objects.
+                 */
+                acpi_bus_no_hotplug(nouveau_dsm_priv.dhandle);
+                acpi_bus_no_hotplug(nouveau_dsm_priv.other_handle);
                ret = true;
        }
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index 29c3efdfc7dd..25ea82f8def3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -610,7 +610,7 @@ nouveau_crtc_page_flip(struct drm_crtc *crtc, struct drm_framebuffer *fb,
        ret = nouveau_fence_sync(fence, chan);
        nouveau_fence_unref(&fence);
        if (ret)
-                return ret;
+                goto fail_free;
        if (new_bo != old_bo) {
                ret = nouveau_bo_pin(new_bo, TTM_PL_FLAG_VRAM);
diff --git a/drivers/gpu/drm/qxl/Kconfig b/drivers/gpu/drm/qxl/Kconfig
index 037d324bf58f..66ac0ff95f5a 100644
--- a/drivers/gpu/drm/qxl/Kconfig
+++ b/drivers/gpu/drm/qxl/Kconfig
@@ -8,5 +8,6 @@ config DRM_QXL
        select DRM_KMS_HELPER
        select DRM_KMS_FB_HELPER
        select DRM_TTM
+        select CRC32
        help
                QXL virtual GPU for Spice virtualization desktop integration. Do not enable this driver unless your distro ships a corresponding X.org QXL driver that can handle kernel modesetting.
diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c
index 5e827c29d194..d70aafb83307 100644
--- a/drivers/gpu/drm/qxl/qxl_display.c
+++ b/drivers/gpu/drm/qxl/qxl_display.c
@@ -24,7 +24,7 @@
 */
-#include "linux/crc32.h"
+#include <linux/crc32.h>
 #include "qxl_drv.h"
 #include "qxl_object.h"
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index b1970596a782..0b9621c9aeea 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -1143,31 +1143,53 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
        }
        if (tiling_flags & RADEON_TILING_MACRO) {
-                if (rdev->family >= CHIP_BONAIRE)
+                evergreen_tiling_fields(tiling_flags, &bankw, &bankh, &mtaspect, &tile_split);
-                        tmp = rdev->config.cik.tile_config;
-                else if (rdev->family >= CHIP_TAHITI)
-                        tmp = rdev->config.si.tile_config;
-                else if (rdev->family >= CHIP_CAYMAN)
-                        tmp = rdev->config.cayman.tile_config;
-                else
-                        tmp = rdev->config.evergreen.tile_config;
-                switch ((tmp & 0xf0) >> 4) {
+                /* Set NUM_BANKS. */
-                case 0: /* 4 banks */
+                if (rdev->family >= CHIP_BONAIRE) {
-                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_4_BANK);
+                        unsigned tileb, index, num_banks, tile_split_bytes;
-                        break;
-                case 1: /* 8 banks */
+                        /* Calculate the macrotile mode index. */
-                default:
+                        tile_split_bytes = 64 << tile_split;
-                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_8_BANK);
+                        tileb = 8 * 8 * target_fb->bits_per_pixel / 8;
-                        break;
+                        tileb = min(tile_split_bytes, tileb);
-                case 2: /* 16 banks */
-                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_16_BANK);
+                        for (index = 0; tileb > 64; index++) {
-                        break;
+                                tileb >>= 1;
+                        }
+                        if (index >= 16) {
+                                DRM_ERROR("Wrong screen bpp (%u) or tile split (%u)\n",
+                                          target_fb->bits_per_pixel, tile_split);
+                                return -EINVAL;
+                        }
+                        num_banks = (rdev->config.cik.macrotile_mode_array[index] >> 6) & 0x3;
+                        fb_format |= EVERGREEN_GRPH_NUM_BANKS(num_banks);
+                } else {
+                        /* SI and older. */
+                        if (rdev->family >= CHIP_TAHITI)
+                                tmp = rdev->config.si.tile_config;
+                        else if (rdev->family >= CHIP_CAYMAN)
+                                tmp = rdev->config.cayman.tile_config;
+                        else
+                                tmp = rdev->config.evergreen.tile_config;
+                        switch ((tmp & 0xf0) >> 4) {
+                        case 0: /* 4 banks */
+                                fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_4_BANK);
+                                break;
+                        case 1: /* 8 banks */
+                        default:
+                                fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_8_BANK);
+                                break;
+                        case 2: /* 16 banks */
+                                fb_format |= EVERGREEN_GRPH_NUM_BANKS(EVERGREEN_ADDR_SURF_16_BANK);
+                                break;
+                        }
                }
                fb_format |= EVERGREEN_GRPH_ARRAY_MODE(EVERGREEN_GRPH_ARRAY_2D_TILED_THIN1);
-                evergreen_tiling_fields(tiling_flags, &bankw, &bankh, &mtaspect, &tile_split);
                fb_format |= EVERGREEN_GRPH_TILE_SPLIT(tile_split);
                fb_format |= EVERGREEN_GRPH_BANK_WIDTH(bankw);
                fb_format |= EVERGREEN_GRPH_BANK_HEIGHT(bankh);
@@ -1180,19 +1202,12 @@ static int dce4_crtc_do_set_base(struct drm_crtc *crtc,
                fb_format |= EVERGREEN_GRPH_ARRAY_MODE(EVERGREEN_GRPH_ARRAY_1D_TILED_THIN1);
        if (rdev->family >= CHIP_BONAIRE) {
-                u32 num_pipe_configs = rdev->config.cik.max_tile_pipes;
+                /* Read the pipe config from the 2D TILED SCANOUT mode.
-                u32 num_rb = rdev->config.cik.max_backends_per_se;
+                 * It should be the same for the other modes too, but not all
-                if (num_pipe_configs > 8)
+                 * modes set the pipe config field. */
-                        num_pipe_configs = 8;
+                u32 pipe_config = (rdev->config.cik.tile_mode_array[10] >> 6) & 0x1f;
-                if (num_pipe_configs == 8)
-                        fb_format |= CIK_GRPH_PIPE_CONFIG(CIK_ADDR_SURF_P8_32x32_16x16);
+                fb_format |= CIK_GRPH_PIPE_CONFIG(pipe_config);
-                else if (num_pipe_configs == 4) {
-                        if (num_rb == 4)
-                                fb_format |= CIK_GRPH_PIPE_CONFIG(CIK_ADDR_SURF_P4_16x16);
-                        else if (num_rb < 4)
-                                fb_format |= CIK_GRPH_PIPE_CONFIG(CIK_ADDR_SURF_P4_8x16);
-                } else if (num_pipe_configs == 2)
-                        fb_format |= CIK_GRPH_PIPE_CONFIG(CIK_ADDR_SURF_P2);
        } else if ((rdev->family == CHIP_TAHITI) ||
                   (rdev->family == CHIP_PITCAIRN))
                fb_format |= SI_GRPH_PIPE_CONFIG(SI_ADDR_SURF_P8_32x32_8x16);
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index b43a3a3c9067..e950fabd7f5e 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -3057,7 +3057,7 @@ static u32 cik_create_bitmask(u32 bit_width)
 * Returns the disabled RB bitmask.
 */
 static u32 cik_get_rb_disabled(struct radeon_device *rdev,
-                              u32 max_rb_num, u32 se_num,
+                              u32 max_rb_num_per_se,
                              u32 sh_per_se)
 {
        u32 data, mask;
@@ -3071,7 +3071,7 @@ static u32 cik_get_rb_disabled(struct radeon_device *rdev,
        data >>= BACKEND_DISABLE_SHIFT;
-        mask = cik_create_bitmask(max_rb_num / se_num / sh_per_se);
+        mask = cik_create_bitmask(max_rb_num_per_se / sh_per_se);
        return data & mask;
 }
@@ -3088,7 +3088,7 @@ static u32 cik_get_rb_disabled(struct radeon_device *rdev,
 */
 static void cik_setup_rb(struct radeon_device *rdev,
                         u32 se_num, u32 sh_per_se,
-                         u32 max_rb_num)
+                         u32 max_rb_num_per_se)
 {
        int i, j;
        u32 data, mask;
@@ -3098,7 +3098,7 @@ static void cik_setup_rb(struct radeon_device *rdev,
        for (i = 0; i < se_num; i++) {
                for (j = 0; j < sh_per_se; j++) {
                        cik_select_se_sh(rdev, i, j);
-                        data = cik_get_rb_disabled(rdev, max_rb_num, se_num, sh_per_se);
+                        data = cik_get_rb_disabled(rdev, max_rb_num_per_se, sh_per_se);
                        if (rdev->family == CHIP_HAWAII)
                                disabled_rbs |= data << ((i * sh_per_se + j) * HAWAII_RB_BITMAP_WIDTH_PER_SH);
                        else
@@ -3108,12 +3108,14 @@ static void cik_setup_rb(struct radeon_device *rdev,
        cik_select_se_sh(rdev, 0xffffffff, 0xffffffff);
        mask = 1;
-        for (i = 0; i < max_rb_num; i++) {
+        for (i = 0; i < max_rb_num_per_se * se_num; i++) {
                if (!(disabled_rbs & mask))
                        enabled_rbs |= mask;
                mask <<= 1;
        }
+        rdev->config.cik.backend_enable_mask = enabled_rbs;
        for (i = 0; i < se_num; i++) {
                cik_select_se_sh(rdev, i, 0xffffffff);
                data = 0;
diff --git a/drivers/gpu/drm/radeon/dce6_afmt.c b/drivers/gpu/drm/radeon/dce6_afmt.c
index de86493cbc44..713a5d359901 100644
--- a/drivers/gpu/drm/radeon/dce6_afmt.c
+++ b/drivers/gpu/drm/radeon/dce6_afmt.c
@@ -174,7 +174,7 @@ void dce6_afmt_write_speaker_allocation(struct drm_encoder *encoder)
        }
        sad_count = drm_edid_to_speaker_allocation(radeon_connector->edid, &sadb);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
                return;
        }
@@ -235,7 +235,7 @@ void dce6_afmt_write_sad_regs(struct drm_encoder *encoder)
        }
        sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
                return;
        }
@@ -308,7 +308,9 @@ int dce6_audio_init(struct radeon_device *rdev)
        rdev->audio.enabled = true;
        if (ASIC_IS_DCE8(rdev))
-                rdev->audio.num_pins = 7;
+                rdev->audio.num_pins = 6;
+        else if (ASIC_IS_DCE61(rdev))
+                rdev->audio.num_pins = 4;
        else
                rdev->audio.num_pins = 6;
diff --git a/drivers/gpu/drm/radeon/evergreen_hdmi.c b/drivers/gpu/drm/radeon/evergreen_hdmi.c
index aa695c4feb3d..0c6d5cef4cf1 100644
--- a/drivers/gpu/drm/radeon/evergreen_hdmi.c
+++ b/drivers/gpu/drm/radeon/evergreen_hdmi.c
@@ -118,7 +118,7 @@ static void dce4_afmt_write_speaker_allocation(struct drm_encoder *encoder)
        }
        sad_count = drm_edid_to_speaker_allocation(radeon_connector->edid, &sadb);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                DRM_ERROR("Couldn't read Speaker Allocation Data Block: %d\n", sad_count);
                return;
        }
@@ -173,7 +173,7 @@ static void evergreen_hdmi_write_sad_regs(struct drm_encoder *encoder)
        }
        sad_count = drm_edid_to_sad(radeon_connector->edid, &sads);
-        if (sad_count < 0) {
+        if (sad_count <= 0) {
                DRM_ERROR("Couldn't read SADs: %d\n", sad_count);
                return;
        }
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 11aab2ab54ce..f59a9e9fccf8 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -895,6 +895,10 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                    (rdev->pdev->device == 0x999C)) {
                        rdev->config.cayman.max_simds_per_se = 6;
                        rdev->config.cayman.max_backends_per_se = 2;
+                        rdev->config.cayman.max_hw_contexts = 8;
+                        rdev->config.cayman.sx_max_export_size = 256;
+                        rdev->config.cayman.sx_max_export_pos_size = 64;
+                        rdev->config.cayman.sx_max_export_smx_size = 192;
                } else if ((rdev->pdev->device == 0x9903) ||
                           (rdev->pdev->device == 0x9904) ||
                           (rdev->pdev->device == 0x990A) ||
@@ -905,6 +909,10 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                           (rdev->pdev->device == 0x999D)) {
                        rdev->config.cayman.max_simds_per_se = 4;
                        rdev->config.cayman.max_backends_per_se = 2;
+                        rdev->config.cayman.max_hw_contexts = 8;
+                        rdev->config.cayman.sx_max_export_size = 256;
+                        rdev->config.cayman.sx_max_export_pos_size = 64;
+                        rdev->config.cayman.sx_max_export_smx_size = 192;
                } else if ((rdev->pdev->device == 0x9919) ||
                           (rdev->pdev->device == 0x9990) ||
                           (rdev->pdev->device == 0x9991) ||
@@ -915,9 +923,17 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                           (rdev->pdev->device == 0x99A0)) {
                        rdev->config.cayman.max_simds_per_se = 3;
                        rdev->config.cayman.max_backends_per_se = 1;
+                        rdev->config.cayman.max_hw_contexts = 4;
+                        rdev->config.cayman.sx_max_export_size = 128;
+                        rdev->config.cayman.sx_max_export_pos_size = 32;
+                        rdev->config.cayman.sx_max_export_smx_size = 96;
                } else {
                        rdev->config.cayman.max_simds_per_se = 2;
                        rdev->config.cayman.max_backends_per_se = 1;
+                        rdev->config.cayman.max_hw_contexts = 4;
+                        rdev->config.cayman.sx_max_export_size = 128;
+                        rdev->config.cayman.sx_max_export_pos_size = 32;
+                        rdev->config.cayman.sx_max_export_smx_size = 96;
                }
                rdev->config.cayman.max_texture_channel_caches = 2;
                rdev->config.cayman.max_gprs = 256;
@@ -925,10 +941,6 @@ static void cayman_gpu_init(struct radeon_device *rdev)
                rdev->config.cayman.max_gs_threads = 32;
                rdev->config.cayman.max_stack_entries = 512;
                rdev->config.cayman.sx_num_of_sets = 8;
-                rdev->config.cayman.sx_max_export_size = 256;
-                rdev->config.cayman.sx_max_export_pos_size = 64;
-                rdev->config.cayman.sx_max_export_smx_size = 192;
-                rdev->config.cayman.max_hw_contexts = 8;
                rdev->config.cayman.sq_num_cf_insts = 2;
                rdev->config.cayman.sc_prim_fifo_size = 0x40;
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index b1f990d0eaa1..45e1f447bc79 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -1940,7 +1940,7 @@ struct si_asic {
        unsigned sc_earlyz_tile_fifo_size;
        unsigned num_tile_pipes;
-        unsigned num_backends_per_se;
+        unsigned backend_enable_mask;
        unsigned backend_disable_mask_per_asic;
        unsigned backend_map;
        unsigned num_texture_channel_caches;
@@ -1970,7 +1970,7 @@ struct cik_asic {
        unsigned sc_earlyz_tile_fifo_size;
        unsigned num_tile_pipes;
-        unsigned num_backends_per_se;
+        unsigned backend_enable_mask;
        unsigned backend_disable_mask_per_asic;
        unsigned backend_map;
        unsigned num_texture_channel_caches;
diff --git a/drivers/gpu/drm/radeon/radeon_atpx_handler.c b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
index 9d302eaeea15..485848f889f5 100644
--- a/drivers/gpu/drm/radeon/radeon_atpx_handler.c
+++ b/drivers/gpu/drm/radeon/radeon_atpx_handler.c
@@ -33,6 +33,7 @@ static struct radeon_atpx_priv {
        bool atpx_detected;
        /* handle for device - and atpx */
        acpi_handle dhandle;
+        acpi_handle other_handle;
        struct radeon_atpx atpx;
 } radeon_atpx_priv;
@@ -451,9 +452,10 @@ static bool radeon_atpx_pci_probe_handle(struct pci_dev *pdev)
                return false;
        status = acpi_get_handle(dhandle, "ATPX", &atpx_handle);
-        if (ACPI_FAILURE(status))
+        if (ACPI_FAILURE(status)) {
+                radeon_atpx_priv.other_handle = dhandle;
                return false;
+        }
        radeon_atpx_priv.dhandle = dhandle;
        radeon_atpx_priv.atpx.handle = atpx_handle;
        return true;
@@ -530,6 +532,16 @@ static bool radeon_atpx_detect(void)
                printk(KERN_INFO "VGA switcheroo: detected switching method %s handle\n",
                       acpi_method_name);
                radeon_atpx_priv.atpx_detected = true;
+                /*
+                 * On some systems hotplug events are generated for the device
+                 * being switched off when ATPX is executed.  They cause ACPI
+                 * hotplug to trigger and attempt to remove the device from
+                 * the system, which causes it to break down.  Prevent that from
+                 * happening by setting the no_hotplug flag for the involved
+                 * ACPI device objects.
+                 */
+                acpi_bus_no_hotplug(radeon_atpx_priv.dhandle);
+                acpi_bus_no_hotplug(radeon_atpx_priv.other_handle);
                return true;
        }
        return false;
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index 1958b36ad0e5..db39ea36bf22 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -77,9 +77,10 @@
 *   2.33.0 - Add SI tiling mode array query
 *   2.34.0 - Add CIK tiling mode array query
 *   2.35.0 - Add CIK macrotile mode array query
+ *   2.36.0 - Fix CIK DCE tiling setup
 */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        35
+#define KMS_DRIVER_MINOR        36
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 55d0b474bd37..21d593c0ecaf 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -461,6 +461,15 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
        case RADEON_INFO_SI_CP_DMA_COMPUTE:
                *value = 1;
                break;
+        case RADEON_INFO_SI_BACKEND_ENABLED_MASK:
+                if (rdev->family >= CHIP_BONAIRE) {
+                        *value = rdev->config.cik.backend_enable_mask;
+                } else if (rdev->family >= CHIP_TAHITI) {
+                        *value = rdev->config.si.backend_enable_mask;
+                } else {
+                        DRM_DEBUG_KMS("BACKEND_ENABLED_MASK is si+ only!\n");
+                }
+                break;
        default:
                DRM_DEBUG_KMS("Invalid request %d\n", info->request);
                return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c
index 373d088bac66..b9c0529b4a2e 100644
--- a/drivers/gpu/drm/radeon/radeon_uvd.c
+++ b/drivers/gpu/drm/radeon/radeon_uvd.c
@@ -473,7 +473,7 @@ static int radeon_uvd_cs_reloc(struct radeon_cs_parser *p,
                return -EINVAL;
        }
-        if ((start >> 28) != (end >> 28)) {
+        if ((start >> 28) != ((end - 1) >> 28)) {
                DRM_ERROR("reloc %LX-%LX crossing 256MB boundary!\n",
                          start, end);
                return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/rv770_dpm.c b/drivers/gpu/drm/radeon/rv770_dpm.c
index 913b025ae9b3..374499db20c7 100644
--- a/drivers/gpu/drm/radeon/rv770_dpm.c
+++ b/drivers/gpu/drm/radeon/rv770_dpm.c
@@ -2328,6 +2328,12 @@ void rv770_get_engine_memory_ss(struct radeon_device *rdev)
        pi->mclk_ss = radeon_atombios_get_asic_ss_info(rdev, &ss,
                                                       ASIC_INTERNAL_MEMORY_SS, 0);
+        /* disable ss, causes hangs on some cayman boards */
+        if (rdev->family == CHIP_CAYMAN) {
+                pi->sclk_ss = false;
+                pi->mclk_ss = false;
+        }
        if (pi->sclk_ss || pi->mclk_ss)
                pi->dynamic_ss = true;
        else
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index a36736dab5e0..85e1edfaa3be 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2811,7 +2811,7 @@ static void si_setup_spi(struct radeon_device *rdev,
 }
 static u32 si_get_rb_disabled(struct radeon_device *rdev,
-                              u32 max_rb_num, u32 se_num,
+                              u32 max_rb_num_per_se,
                              u32 sh_per_se)
 {
        u32 data, mask;
@@ -2825,14 +2825,14 @@ static u32 si_get_rb_disabled(struct radeon_device *rdev,
        data >>= BACKEND_DISABLE_SHIFT;
-        mask = si_create_bitmask(max_rb_num / se_num / sh_per_se);
+        mask = si_create_bitmask(max_rb_num_per_se / sh_per_se);
        return data & mask;
 }
 static void si_setup_rb(struct radeon_device *rdev,
                        u32 se_num, u32 sh_per_se,
-                        u32 max_rb_num)
+                        u32 max_rb_num_per_se)
 {
        int i, j;
        u32 data, mask;
@@ -2842,19 +2842,21 @@ static void si_setup_rb(struct radeon_device *rdev,
        for (i = 0; i < se_num; i++) {
                for (j = 0; j < sh_per_se; j++) {
                        si_select_se_sh(rdev, i, j);
-                        data = si_get_rb_disabled(rdev, max_rb_num, se_num, sh_per_se);
+                        data = si_get_rb_disabled(rdev, max_rb_num_per_se, sh_per_se);
                        disabled_rbs |= data << ((i * sh_per_se + j) * TAHITI_RB_BITMAP_WIDTH_PER_SH);
                }
        }
        si_select_se_sh(rdev, 0xffffffff, 0xffffffff);
        mask = 1;
-        for (i = 0; i < max_rb_num; i++) {
+        for (i = 0; i < max_rb_num_per_se * se_num; i++) {
                if (!(disabled_rbs & mask))
                        enabled_rbs |= mask;
                mask <<= 1;
        }
+        rdev->config.si.backend_enable_mask = enabled_rbs;
        for (i = 0; i < se_num; i++) {
                si_select_se_sh(rdev, i, 0xffffffff);
                data = 0;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 15b86a94949d..406152152315 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -353,7 +353,8 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
         * Don't move nonexistent data. Clear destination instead.
         */
        if (old_iomap == NULL &&
-            (ttm == NULL || ttm->state == tt_unpopulated)) {
+            (ttm == NULL || (ttm->state == tt_unpopulated &&
+                             !(ttm->page_flags & TTM_PAGE_FLAG_SWAPPED)))) {
                memset_io(new_iomap, 0, new_mem->num_pages*PAGE_SIZE);
                goto out2;
        }
diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c
index f0c5e07c25ec..bcb49502c3bf 100644
--- a/drivers/hv/hv.c
+++ b/drivers/hv/hv.c
@@ -301,7 +301,7 @@ err:
        return -ENOMEM;
 }
-void hv_synic_free_cpu(int cpu)
+static void hv_synic_free_cpu(int cpu)
 {
        kfree(hv_context.event_dpc[cpu]);
        if (hv_context.synic_event_page[cpu])
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index 78be66176840..bbb0b0d463f7 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -36,6 +36,7 @@
 #include <linux/cpu.h>
 #include <linux/smp.h>
 #include <linux/moduleparam.h>
+#include <linux/pci.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
 #include <asm/cpu_device_id.h>
@@ -52,7 +53,7 @@ MODULE_PARM_DESC(tjmax, "TjMax value in degrees Celsius");
 #define BASE_SYSFS_ATTR_NO      2       /* Sysfs Base attr no for coretemp */
 #define NUM_REAL_CORES          32      /* Number of Real cores per cpu */
-#define CORETEMP_NAME_LENGTH    17      /* String Length of attrs */
+#define CORETEMP_NAME_LENGTH    19      /* String Length of attrs */
 #define MAX_CORE_ATTRS          4       /* Maximum no of basic attrs */
 #define TOTAL_ATTRS             (MAX_CORE_ATTRS + 1)
 #define MAX_CORE_DATA           (NUM_REAL_CORES + BASE_SYSFS_ATTR_NO)
@@ -176,20 +177,33 @@ static ssize_t show_temp(struct device *dev,
        /* Check whether the time interval has elapsed */
        if (!tdata->valid || time_after(jiffies, tdata->last_updated + HZ)) {
                rdmsr_on_cpu(tdata->cpu, tdata->status_reg, &eax, &edx);
-                tdata->valid = 0;
+                /*
-                /* Check whether the data is valid */
+                 * Ignore the valid bit. In all observed cases the register
-                if (eax & 0x80000000) {
+                 * value is either low or zero if the valid bit is 0.
-                        tdata->temp = tdata->tjmax -
+                 * Return it instead of reporting an error which doesn't
-                                        ((eax >> 16) & 0x7f) * 1000;
+                 * really help at all.
-                        tdata->valid = 1;
+                 */
-                }
+                tdata->temp = tdata->tjmax - ((eax >> 16) & 0x7f) * 1000;
+                tdata->valid = 1;
                tdata->last_updated = jiffies;
        }
        mutex_unlock(&tdata->update_lock);
-        return tdata->valid ? sprintf(buf, "%d\n", tdata->temp) : -EAGAIN;
+        return sprintf(buf, "%d\n", tdata->temp);
 }
+struct tjmax_pci {
+        unsigned int device;
+        int tjmax;
+};
+static const struct tjmax_pci tjmax_pci_table[] = {
+        { 0x0708, 110000 },     /* CE41x0 (Sodaville ) */
+        { 0x0c72, 102000 },     /* Atom S1240 (Centerton) */
+        { 0x0c73, 95000 },      /* Atom S1220 (Centerton) */
+        { 0x0c75, 95000 },      /* Atom S1260 (Centerton) */
+};
 struct tjmax {
        char const *id;
        int tjmax;
@@ -198,9 +212,6 @@ struct tjmax {
 static const struct tjmax tjmax_table[] = {
        { "CPU  230", 100000 },         /* Model 0x1c, stepping 2       */
        { "CPU  330", 125000 },         /* Model 0x1c, stepping 2       */
-        { "CPU CE4110", 110000 },       /* Model 0x1c, stepping 10 Sodaville */
-        { "CPU CE4150", 110000 },       /* Model 0x1c, stepping 10      */
-        { "CPU CE4170", 110000 },       /* Model 0x1c, stepping 10      */
 };
 struct tjmax_model {
@@ -222,8 +233,11 @@ static const struct tjmax_model tjmax_model_table[] = {
                                 * is undetectable by software
                                 */
        { 0x27, ANY, 90000 },   /* Atom Medfield (Z2460) */
-        { 0x35, ANY, 90000 },   /* Atom Clover Trail/Cloverview (Z2760) */
+        { 0x35, ANY, 90000 },   /* Atom Clover Trail/Cloverview (Z27x0) */
-        { 0x36, ANY, 100000 },  /* Atom Cedar Trail/Cedarview (N2xxx, D2xxx) */
+        { 0x36, ANY, 100000 },  /* Atom Cedar Trail/Cedarview (N2xxx, D2xxx)
+                                 * Also matches S12x0 (stepping 9), covered by
+                                 * PCI table
+                                 */
 };
 static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
@@ -236,8 +250,20 @@ static int adjust_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
        int err;
        u32 eax, edx;
        int i;
+        struct pci_dev *host_bridge = pci_get_bus_and_slot(0, PCI_DEVFN(0, 0));
+        /*
+         * Explicit tjmax table entries override heuristics.
+         * First try PCI host bridge IDs, followed by model ID strings
+         * and model/stepping information.
+         */
+        if (host_bridge && host_bridge->vendor == PCI_VENDOR_ID_INTEL) {
+                for (i = 0; i < ARRAY_SIZE(tjmax_pci_table); i++) {
+                        if (host_bridge->device == tjmax_pci_table[i].device)
+                                return tjmax_pci_table[i].tjmax;
+                }
+        }
-        /* explicit tjmax table entries override heuristics */
        for (i = 0; i < ARRAY_SIZE(tjmax_table); i++) {
                if (strstr(c->x86_model_id, tjmax_table[i].id))
                        return tjmax_table[i].tjmax;
@@ -343,12 +369,12 @@ static int get_tjmax(struct cpuinfo_x86 *c, u32 id, struct device *dev)
                if (cpu_has_tjmax(c))
                        dev_warn(dev, "Unable to read TjMax from CPU %u\n", id);
        } else {
-                val = (eax >> 16) & 0xff;
+                val = (eax >> 16) & 0x7f;
                /*
                 * If the TjMax is not plausible, an assumption
                 * will be used
                 */
-                if (val) {
+                if (val >= 85) {
                        dev_dbg(dev, "TjMax is %d degrees C\n", val);
                        return val * 1000;
                }
diff --git a/drivers/hwmon/da9052-hwmon.c b/drivers/hwmon/da9052-hwmon.c
index 960fac3fb166..afd31042b452 100644
--- a/drivers/hwmon/da9052-hwmon.c
+++ b/drivers/hwmon/da9052-hwmon.c
@@ -45,7 +45,7 @@ static const char * const input_names[] = {
 /* Conversion function for VDDOUT and VBAT */
 static inline int volt_reg_to_mv(int value)
 {
-        return DIV_ROUND_CLOSEST(value * 1000, 512) + 2500;
+        return DIV_ROUND_CLOSEST(value * 2000, 1023) + 2500;
 }
 /* Conversion function for ADC channels 4, 5 and 6 */
@@ -57,7 +57,7 @@ static inline int input_reg_to_mv(int value)
 /* Conversion function for VBBAT */
 static inline int vbbat_reg_to_mv(int value)
 {
-        return DIV_ROUND_CLOSEST(value * 2500, 512);
+        return DIV_ROUND_CLOSEST(value * 5000, 1023);
 }
 static inline int da9052_enable_vddout_channel(struct da9052 *da9052)
diff --git a/drivers/hwmon/fam15h_power.c b/drivers/hwmon/fam15h_power.c
index dff841085baf..6040121a405a 100644
--- a/drivers/hwmon/fam15h_power.c
+++ b/drivers/hwmon/fam15h_power.c
@@ -249,7 +249,7 @@ static void fam15h_power_remove(struct pci_dev *pdev)
        sysfs_remove_group(&dev->kobj, &fam15h_power_attr_group);
 }
-static DEFINE_PCI_DEVICE_TABLE(fam15h_power_id_table) = {
+static const struct pci_device_id fam15h_power_id_table[] = {
        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F4) },
        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F4) },
        {}
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
index d65f3fd895dd..baf375b5ab0d 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -204,12 +204,13 @@ static void k10temp_remove(struct pci_dev *pdev)
                           &sensor_dev_attr_temp1_crit_hyst.dev_attr);
 }
-static DEFINE_PCI_DEVICE_TABLE(k10temp_id_table) = {
+static const struct pci_device_id k10temp_id_table[] = {
        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_10H_NB_MISC) },
        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_11H_NB_MISC) },
        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CNB17H_F3) },
        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_NB_F3) },
        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M10H_F3) },
+        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_15H_M30H_NB_F3) },
        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
        {}
 };
diff --git a/drivers/hwmon/k8temp.c b/drivers/hwmon/k8temp.c
index 5b50e9e4f96b..734d55d48cc8 100644
--- a/drivers/hwmon/k8temp.c
+++ b/drivers/hwmon/k8temp.c
@@ -135,7 +135,7 @@ static SENSOR_DEVICE_ATTR_2(temp3_input, S_IRUGO, show_temp, NULL, 1, 0);
 static SENSOR_DEVICE_ATTR_2(temp4_input, S_IRUGO, show_temp, NULL, 1, 1);
 static DEVICE_ATTR(name, S_IRUGO, show_name, NULL);
-static DEFINE_PCI_DEVICE_TABLE(k8temp_ids) = {
+static const struct pci_device_id k8temp_ids[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB_MISC) },
        { 0 },
 };
diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c
index cf811c1a1475..8686e966fa28 100644
--- a/drivers/hwmon/nct6775.c
+++ b/drivers/hwmon/nct6775.c
@@ -3936,6 +3936,18 @@ static int nct6775_probe(struct platform_device *pdev)
        return PTR_ERR_OR_ZERO(hwmon_dev);
 }
+static void nct6791_enable_io_mapping(int sioaddr)
+{
+        int val;
+        val = superio_inb(sioaddr, NCT6791_REG_HM_IO_SPACE_LOCK_ENABLE);
+        if (val & 0x10) {
+                pr_info("Enabling hardware monitor logical device mappings.\n");
+                superio_outb(sioaddr, NCT6791_REG_HM_IO_SPACE_LOCK_ENABLE,
+                             val & ~0x10);
+        }
+}
 #ifdef CONFIG_PM
 static int nct6775_suspend(struct device *dev)
 {
@@ -3955,11 +3967,20 @@ static int nct6775_suspend(struct device *dev)
 static int nct6775_resume(struct device *dev)
 {
        struct nct6775_data *data = dev_get_drvdata(dev);
-        int i, j;
+        int i, j, err = 0;
        mutex_lock(&data->update_lock);
        data->bank = 0xff;              /* Force initial bank selection */
+        if (data->kind == nct6791) {
+                err = superio_enter(data->sioreg);
+                if (err)
+                        goto abort;
+                nct6791_enable_io_mapping(data->sioreg);
+                superio_exit(data->sioreg);
+        }
        /* Restore limits */
        for (i = 0; i < data->in_num; i++) {
                if (!(data->have_in & (1 << i)))
@@ -3996,11 +4017,12 @@ static int nct6775_resume(struct device *dev)
                nct6775_write_value(data, NCT6775_REG_FANDIV2, data->fandiv2);
        }
+abort:
        /* Force re-reading all values */
        data->valid = false;
        mutex_unlock(&data->update_lock);
-        return 0;
+        return err;
 }
 static const struct dev_pm_ops nct6775_dev_pm_ops = {
@@ -4088,15 +4110,9 @@ static int __init nct6775_find(int sioaddr, struct nct6775_sio_data *sio_data)
                pr_warn("Forcibly enabling Super-I/O. Sensor is probably unusable.\n");
                superio_outb(sioaddr, SIO_REG_ENABLE, val | 0x01);
        }
-        if (sio_data->kind == nct6791) {
-                val = superio_inb(sioaddr, NCT6791_REG_HM_IO_SPACE_LOCK_ENABLE);
+        if (sio_data->kind == nct6791)
-                if (val & 0x10) {
+                nct6791_enable_io_mapping(sioaddr);
-                        pr_info("Enabling hardware monitor logical device mappings.\n");
-                        superio_outb(sioaddr,
-                                     NCT6791_REG_HM_IO_SPACE_LOCK_ENABLE,
-                                     val & ~0x10);
-                }
-        }
        superio_exit(sioaddr);
        pr_info("Found %s or compatible chip at %#x:%#x\n",
diff --git a/drivers/hwmon/sis5595.c b/drivers/hwmon/sis5595.c
index 72a889702f0d..e74bd7e620e8 100644
--- a/drivers/hwmon/sis5595.c
+++ b/drivers/hwmon/sis5595.c
@@ -754,7 +754,7 @@ static struct sis5595_data *sis5595_update_device(struct device *dev)
        return data;
 }
-static DEFINE_PCI_DEVICE_TABLE(sis5595_pci_ids) = {
+static const struct pci_device_id sis5595_pci_ids[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
        { 0, }
 };
diff --git a/drivers/hwmon/via686a.c b/drivers/hwmon/via686a.c
index c9dcce8c3dc3..babd732b4e18 100644
--- a/drivers/hwmon/via686a.c
+++ b/drivers/hwmon/via686a.c
@@ -824,7 +824,7 @@ static struct via686a_data *via686a_update_device(struct device *dev)
        return data;
 }
-static DEFINE_PCI_DEVICE_TABLE(via686a_pci_ids) = {
+static const struct pci_device_id via686a_pci_ids[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4) },
        { }
 };
diff --git a/drivers/hwmon/vt8231.c b/drivers/hwmon/vt8231.c
index aee14e2192f8..b3babe3326fb 100644
--- a/drivers/hwmon/vt8231.c
+++ b/drivers/hwmon/vt8231.c
@@ -766,7 +766,7 @@ static struct platform_driver vt8231_driver = {
        .remove = vt8231_remove,
 };
-static DEFINE_PCI_DEVICE_TABLE(vt8231_pci_ids) = {
+static const struct pci_device_id vt8231_pci_ids[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8231_4) },
        { 0, }
 };
diff --git a/drivers/ide/buddha.c b/drivers/ide/buddha.c
index b1d38590ac01..46eaf58d881b 100644
--- a/drivers/ide/buddha.c
+++ b/drivers/ide/buddha.c
@@ -198,7 +198,7 @@ fail_base2:
                                continue;
                        }
                }         
-                buddha_board = ZTWO_VADDR(board);
+                buddha_board = (unsigned long)ZTWO_VADDR(board);
                
                /* write to BUDDHA_IRQ_MR to enable the board IRQ */
                /* X-Surf doesn't have this.  IRQs are always on */
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 92d1206482a6..6c0e0452dd9b 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -123,7 +123,7 @@ static struct cpuidle_state *cpuidle_state_table;
 * which is also the index into the MWAIT hint array.
 * Thus C0 is a dummy.
 */
-static struct cpuidle_state nehalem_cstates[] __initdata = {
+static struct cpuidle_state nehalem_cstates[] = {
        {
                .name = "C1-NHM",
                .desc = "MWAIT 0x00",
@@ -156,7 +156,7 @@ static struct cpuidle_state nehalem_cstates[] __initdata = {
                .enter = NULL }
 };
-static struct cpuidle_state snb_cstates[] __initdata = {
+static struct cpuidle_state snb_cstates[] = {
        {
                .name = "C1-SNB",
                .desc = "MWAIT 0x00",
@@ -196,7 +196,7 @@ static struct cpuidle_state snb_cstates[] __initdata = {
                .enter = NULL }
 };
-static struct cpuidle_state ivb_cstates[] __initdata = {
+static struct cpuidle_state ivb_cstates[] = {
        {
                .name = "C1-IVB",
                .desc = "MWAIT 0x00",
@@ -236,7 +236,7 @@ static struct cpuidle_state ivb_cstates[] __initdata = {
                .enter = NULL }
 };
-static struct cpuidle_state hsw_cstates[] __initdata = {
+static struct cpuidle_state hsw_cstates[] = {
        {
                .name = "C1-HSW",
                .desc = "MWAIT 0x00",
@@ -297,7 +297,7 @@ static struct cpuidle_state hsw_cstates[] __initdata = {
                .enter = NULL }
 };
-static struct cpuidle_state atom_cstates[] __initdata = {
+static struct cpuidle_state atom_cstates[] = {
        {
                .name = "C1E-ATM",
                .desc = "MWAIT 0x00",
@@ -329,7 +329,7 @@ static struct cpuidle_state atom_cstates[] __initdata = {
        {
                .enter = NULL }
 };
-static struct cpuidle_state avn_cstates[] __initdata = {
+static struct cpuidle_state avn_cstates[] = {
        {
                .name = "C1-AVN",
                .desc = "MWAIT 0x00",
@@ -344,6 +344,8 @@ static struct cpuidle_state avn_cstates[] __initdata = {
                .exit_latency = 15,
                .target_residency = 45,
                .enter = &intel_idle },
+        {
+                .enter = NULL }
 };
 /**
@@ -375,13 +377,7 @@ static int intel_idle(struct cpuidle_device *dev,
        if (!(lapic_timer_reliable_states & (1 << (cstate))))
                clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu);
-        if (!current_set_polling_and_test()) {
+        mwait_idle_with_hints(eax, ecx);
-                __monitor((void *)&current_thread_info()->flags, 0, 0);
-                smp_mb();
-                if (!need_resched())
-                        __mwait(eax, ecx);
-        }
        if (!(lapic_timer_reliable_states & (1 << (cstate))))
                clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_EXIT, &cpu);
diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c
index c47c2034ca71..0717940ec3b5 100644
--- a/drivers/infiniband/core/iwcm.c
+++ b/drivers/infiniband/core/iwcm.c
@@ -181,9 +181,16 @@ static void add_ref(struct iw_cm_id *cm_id)
 static void rem_ref(struct iw_cm_id *cm_id)
 {
        struct iwcm_id_private *cm_id_priv;
+        int cb_destroy;
        cm_id_priv = container_of(cm_id, struct iwcm_id_private, id);
-        if (iwcm_deref_id(cm_id_priv) &&
-            test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags)) {
+        /*
+         * Test bit before deref in case the cm_id gets freed on another
+         * thread.
+         */
+        cb_destroy = test_bit(IWCM_F_CALLBACK_DESTROY, &cm_id_priv->flags);
+        if (iwcm_deref_id(cm_id_priv) && cb_destroy) {
                BUG_ON(!list_empty(&cm_id_priv->work_list));
                free_cm_id(cm_id_priv);
        }
diff --git a/drivers/infiniband/core/uverbs.h b/drivers/infiniband/core/uverbs.h
index bdc842e9faef..a283274a5a09 100644
--- a/drivers/infiniband/core/uverbs.h
+++ b/drivers/infiniband/core/uverbs.h
@@ -49,12 +49,20 @@
 #define INIT_UDATA(udata, ibuf, obuf, ilen, olen)                       \
        do {                                                            \
-                (udata)->inbuf  = (void __user *) (ibuf);               \
+                (udata)->inbuf  = (const void __user *) (ibuf);         \
                (udata)->outbuf = (void __user *) (obuf);               \
                (udata)->inlen  = (ilen);                               \
                (udata)->outlen = (olen);                               \
        } while (0)
+#define INIT_UDATA_BUF_OR_NULL(udata, ibuf, obuf, ilen, olen)                   \
+        do {                                                                    \
+                (udata)->inbuf  = (ilen) ? (const void __user *) (ibuf) : NULL; \
+                (udata)->outbuf = (olen) ? (void __user *) (obuf) : NULL;       \
+                (udata)->inlen  = (ilen);                                       \
+                (udata)->outlen = (olen);                                       \
+        } while (0)
 /*
 * Our lifetime rules for these structs are the following:
 *
diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c
index 65f6e7dc380c..f1cc83855af6 100644
--- a/drivers/infiniband/core/uverbs_cmd.c
+++ b/drivers/infiniband/core/uverbs_cmd.c
@@ -2593,6 +2593,9 @@ out_put:
 static int kern_spec_to_ib_spec(struct ib_uverbs_flow_spec *kern_spec,
                                union ib_flow_spec *ib_spec)
 {
+        if (kern_spec->reserved)
+                return -EINVAL;
        ib_spec->type = kern_spec->type;
        switch (ib_spec->type) {
@@ -2646,6 +2649,9 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
        void *ib_spec;
        int i;
+        if (ucore->inlen < sizeof(cmd))
+                return -EINVAL;
        if (ucore->outlen < sizeof(resp))
                return -ENOSPC;
@@ -2671,6 +2677,10 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
            (cmd.flow_attr.num_of_specs * sizeof(struct ib_uverbs_flow_spec)))
                return -EINVAL;
+        if (cmd.flow_attr.reserved[0] ||
+            cmd.flow_attr.reserved[1])
+                return -EINVAL;
        if (cmd.flow_attr.num_of_specs) {
                kern_flow_attr = kmalloc(sizeof(*kern_flow_attr) + cmd.flow_attr.size,
                                         GFP_KERNEL);
@@ -2731,6 +2741,7 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file,
        if (cmd.flow_attr.size || (i != flow_attr->num_of_specs)) {
                pr_warn("create flow failed, flow %d: %d bytes left from uverb cmd\n",
                        i, cmd.flow_attr.size);
+                err = -EINVAL;
                goto err_free;
        }
        flow_id = ib_create_flow(qp, flow_attr, IB_FLOW_DOMAIN_USER);
@@ -2791,10 +2802,16 @@ int ib_uverbs_ex_destroy_flow(struct ib_uverbs_file *file,
        struct ib_uobject               *uobj;
        int                             ret;
+        if (ucore->inlen < sizeof(cmd))
+                return -EINVAL;
        ret = ib_copy_from_udata(&cmd, ucore, sizeof(cmd));
        if (ret)
                return ret;
+        if (cmd.comp_mask)
+                return -EINVAL;
        uobj = idr_write_uobj(&ib_uverbs_rule_idr, cmd.flow_handle,
                              file->ucontext);
        if (!uobj)
diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
index 34386943ebcf..08219fb3338b 100644
--- a/drivers/infiniband/core/uverbs_main.c
+++ b/drivers/infiniband/core/uverbs_main.c
@@ -668,25 +668,30 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf,
                if ((hdr.in_words + ex_hdr.provider_in_words) * 8 != count)
                        return -EINVAL;
+                if (ex_hdr.cmd_hdr_reserved)
+                        return -EINVAL;
                if (ex_hdr.response) {
                        if (!hdr.out_words && !ex_hdr.provider_out_words)
                                return -EINVAL;
+                        if (!access_ok(VERIFY_WRITE,
+                                       (void __user *) (unsigned long) ex_hdr.response,
+                                       (hdr.out_words + ex_hdr.provider_out_words) * 8))
+                                return -EFAULT;
                } else {
                        if (hdr.out_words || ex_hdr.provider_out_words)
                                return -EINVAL;
                }
-                INIT_UDATA(&ucore,
+                INIT_UDATA_BUF_OR_NULL(&ucore, buf, (unsigned long) ex_hdr.response,
-                           (hdr.in_words) ? buf : 0,
+                                       hdr.in_words * 8, hdr.out_words * 8);
-                           (unsigned long)ex_hdr.response,
-                           hdr.in_words * 8,
+                INIT_UDATA_BUF_OR_NULL(&uhw,
-                           hdr.out_words * 8);
+                                       buf + ucore.inlen,
+                                       (unsigned long) ex_hdr.response + ucore.outlen,
-                INIT_UDATA(&uhw,
+                                       ex_hdr.provider_in_words * 8,
-                           (ex_hdr.provider_in_words) ? buf + ucore.inlen : 0,
+                                       ex_hdr.provider_out_words * 8);
-                           (ex_hdr.provider_out_words) ? (unsigned long)ex_hdr.response + ucore.outlen : 0,
-                           ex_hdr.provider_in_words * 8,
-                           ex_hdr.provider_out_words * 8);
                err = uverbs_ex_cmd_table[command](file,
                                                   &ucore,
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index 12fef76c791c..45126879ad28 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -524,50 +524,6 @@ static int send_abort(struct c4iw_ep *ep, struct sk_buff *skb, gfp_t gfp)
        return c4iw_l2t_send(&ep->com.dev->rdev, skb, ep->l2t);
 }
-#define VLAN_NONE 0xfff
-#define FILTER_SEL_VLAN_NONE 0xffff
-#define FILTER_SEL_WIDTH_P_FC (3+1) /* port uses 3 bits, FCoE one bit */
-#define FILTER_SEL_WIDTH_VIN_P_FC \
-        (6 + 7 + FILTER_SEL_WIDTH_P_FC) /* 6 bits are unused, VF uses 7 bits*/
-#define FILTER_SEL_WIDTH_TAG_P_FC \
-        (3 + FILTER_SEL_WIDTH_VIN_P_FC) /* PF uses 3 bits */
-#define FILTER_SEL_WIDTH_VLD_TAG_P_FC (1 + FILTER_SEL_WIDTH_TAG_P_FC)
-static unsigned int select_ntuple(struct c4iw_dev *dev, struct dst_entry *dst,
-                                  struct l2t_entry *l2t)
-{
-        unsigned int ntuple = 0;
-        u32 viid;
-        switch (dev->rdev.lldi.filt_mode) {
-        /* default filter mode */
-        case HW_TPL_FR_MT_PR_IV_P_FC:
-                if (l2t->vlan == VLAN_NONE)
-                        ntuple |= FILTER_SEL_VLAN_NONE << FILTER_SEL_WIDTH_P_FC;
-                else {
-                        ntuple |= l2t->vlan << FILTER_SEL_WIDTH_P_FC;
-                        ntuple |= 1 << FILTER_SEL_WIDTH_TAG_P_FC;
-                }
-                ntuple |= l2t->lport << S_PORT | IPPROTO_TCP <<
-                          FILTER_SEL_WIDTH_VLD_TAG_P_FC;
-                break;
-        case HW_TPL_FR_MT_PR_OV_P_FC: {
-                viid = cxgb4_port_viid(l2t->neigh->dev);
-                ntuple |= FW_VIID_VIN_GET(viid) << FILTER_SEL_WIDTH_P_FC;
-                ntuple |= FW_VIID_PFN_GET(viid) << FILTER_SEL_WIDTH_VIN_P_FC;
-                ntuple |= FW_VIID_VIVLD_GET(viid) << FILTER_SEL_WIDTH_TAG_P_FC;
-                ntuple |= l2t->lport << S_PORT | IPPROTO_TCP <<
-                          FILTER_SEL_WIDTH_VLD_TAG_P_FC;
-                break;
-        }
-        default:
-                break;
-        }
-        return ntuple;
-}
 static int send_connect(struct c4iw_ep *ep)
 {
        struct cpl_act_open_req *req;
@@ -641,8 +597,9 @@ static int send_connect(struct c4iw_ep *ep)
                        req->local_ip = la->sin_addr.s_addr;
                        req->peer_ip = ra->sin_addr.s_addr;
                        req->opt0 = cpu_to_be64(opt0);
-                        req->params = cpu_to_be32(select_ntuple(ep->com.dev,
+                        req->params = cpu_to_be32(cxgb4_select_ntuple(
-                                                ep->dst, ep->l2t));
+                                                ep->com.dev->rdev.lldi.ports[0],
+                                                ep->l2t));
                        req->opt2 = cpu_to_be32(opt2);
                } else {
                        req6 = (struct cpl_act_open_req6 *)skb_put(skb, wrlen);
@@ -662,9 +619,9 @@ static int send_connect(struct c4iw_ep *ep)
                        req6->peer_ip_lo = *((__be64 *)
                                                (ra6->sin6_addr.s6_addr + 8));
                        req6->opt0 = cpu_to_be64(opt0);
-                        req6->params = cpu_to_be32(
+                        req6->params = cpu_to_be32(cxgb4_select_ntuple(
-                                        select_ntuple(ep->com.dev, ep->dst,
+                                                ep->com.dev->rdev.lldi.ports[0],
-                                                      ep->l2t));
+                                                ep->l2t));
                        req6->opt2 = cpu_to_be32(opt2);
                }
        } else {
@@ -681,8 +638,9 @@ static int send_connect(struct c4iw_ep *ep)
                        t5_req->peer_ip = ra->sin_addr.s_addr;
                        t5_req->opt0 = cpu_to_be64(opt0);
                        t5_req->params = cpu_to_be64(V_FILTER_TUPLE(
-                                                select_ntuple(ep->com.dev,
+                                                     cxgb4_select_ntuple(
-                                                ep->dst, ep->l2t)));
+                                             ep->com.dev->rdev.lldi.ports[0],
+                                             ep->l2t)));
                        t5_req->opt2 = cpu_to_be32(opt2);
                } else {
                        t5_req6 = (struct cpl_t5_act_open_req6 *)
@@ -703,7 +661,9 @@ static int send_connect(struct c4iw_ep *ep)
                                                (ra6->sin6_addr.s6_addr + 8));
                        t5_req6->opt0 = cpu_to_be64(opt0);
                        t5_req6->params = (__force __be64)cpu_to_be32(
-                                select_ntuple(ep->com.dev, ep->dst, ep->l2t));
+                                                        cxgb4_select_ntuple(
+                                                ep->com.dev->rdev.lldi.ports[0],
+                                                ep->l2t));
                        t5_req6->opt2 = cpu_to_be32(opt2);
                }
        }
@@ -1630,7 +1590,8 @@ static void send_fw_act_open_req(struct c4iw_ep *ep, unsigned int atid)
        memset(req, 0, sizeof(*req));
        req->op_compl = htonl(V_WR_OP(FW_OFLD_CONNECTION_WR));
        req->len16_pkd = htonl(FW_WR_LEN16(DIV_ROUND_UP(sizeof(*req), 16)));
-        req->le.filter = cpu_to_be32(select_ntuple(ep->com.dev, ep->dst,
+        req->le.filter = cpu_to_be32(cxgb4_select_ntuple(
+                                     ep->com.dev->rdev.lldi.ports[0],
                                     ep->l2t));
        sin = (struct sockaddr_in *)&ep->com.local_addr;
        req->le.lport = sin->sin_port;
@@ -2938,7 +2899,8 @@ int c4iw_create_listen(struct iw_cm_id *cm_id, int backlog)
        /*
         * Allocate a server TID.
         */
-        if (dev->rdev.lldi.enable_fw_ofld_conn)
+        if (dev->rdev.lldi.enable_fw_ofld_conn &&
+            ep->com.local_addr.ss_family == AF_INET)
                ep->stid = cxgb4_alloc_sftid(dev->rdev.lldi.tids,
                                             cm_id->local_addr.ss_family, ep);
        else
@@ -3323,9 +3285,7 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
        /*
         * Calculate the server tid from filter hit index from cpl_rx_pkt.
         */
-        stid = (__force int) cpu_to_be32((__force u32) rss->hash_val)
+        stid = (__force int) cpu_to_be32((__force u32) rss->hash_val);
-                                          - dev->rdev.lldi.tids->sftid_base
-                                          + dev->rdev.lldi.tids->nstids;
        lep = (struct c4iw_ep *)lookup_stid(dev->rdev.lldi.tids, stid);
        if (!lep) {
@@ -3397,7 +3357,9 @@ static int rx_pkt(struct c4iw_dev *dev, struct sk_buff *skb)
        window = (__force u16) htons((__force u16)tcph->window);
        /* Calcuate filter portion for LE region. */
-        filter = (__force unsigned int) cpu_to_be32(select_ntuple(dev, dst, e));
+        filter = (__force unsigned int) cpu_to_be32(cxgb4_select_ntuple(
+                                                    dev->rdev.lldi.ports[0],
+                                                    e));
        /*
         * Synthesize the cpl_pass_accept_req. We have everything except the
diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index 4cb8eb24497c..84e45006451c 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -173,7 +173,7 @@ static int _c4iw_write_mem_inline(struct c4iw_rdev *rdev, u32 addr, u32 len,
        return ret;
 }
-int _c4iw_write_mem_dma(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
+static int _c4iw_write_mem_dma(struct c4iw_rdev *rdev, u32 addr, u32 len, void *data)
 {
        u32 remain = len;
        u32 dmalen;
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
index c29b5c838833..cdc7df4fdb8a 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_netlink.c
@@ -31,6 +31,7 @@
 */
 #include <linux/netdevice.h>
+#include <linux/if_arp.h>      /* For ARPHRD_xxx */
 #include <linux/module.h>
 #include <net/rtnetlink.h>
 #include "ipoib.h"
@@ -103,7 +104,7 @@ static int ipoib_new_child_link(struct net *src_net, struct net_device *dev,
                return -EINVAL;
        pdev = __dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK]));
-        if (!pdev)
+        if (!pdev || pdev->type != ARPHRD_INFINIBAND)
                return -ENODEV;
        ppriv = netdev_priv(pdev);
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 846ccdd905b1..d2965e4b3224 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1871,6 +1871,10 @@ void input_set_capability(struct input_dev *dev, unsigned int type, unsigned int
                break;
        case EV_ABS:
+                input_alloc_absinfo(dev);
+                if (!dev->absinfo)
+                        return;
                __set_bit(code, dev->absbit);
                break;
diff --git a/drivers/input/touchscreen/zforce_ts.c b/drivers/input/touchscreen/zforce_ts.c
index 75762d6ff3ba..aa127ba392a4 100644
--- a/drivers/input/touchscreen/zforce_ts.c
+++ b/drivers/input/touchscreen/zforce_ts.c
@@ -455,7 +455,18 @@ static void zforce_complete(struct zforce_ts *ts, int cmd, int result)
        }
 }
-static irqreturn_t zforce_interrupt(int irq, void *dev_id)
+static irqreturn_t zforce_irq(int irq, void *dev_id)
+{
+        struct zforce_ts *ts = dev_id;
+        struct i2c_client *client = ts->client;
+        if (ts->suspended && device_may_wakeup(&client->dev))
+                pm_wakeup_event(&client->dev, 500);
+        return IRQ_WAKE_THREAD;
+}
+static irqreturn_t zforce_irq_thread(int irq, void *dev_id)
 {
        struct zforce_ts *ts = dev_id;
        struct i2c_client *client = ts->client;
@@ -465,12 +476,10 @@ static irqreturn_t zforce_interrupt(int irq, void *dev_id)
        u8 *payload;
        /*
-         * When suspended, emit a wakeup signal if necessary and return.
+         * When still suspended, return.
         * Due to the level-interrupt we will get re-triggered later.
         */
        if (ts->suspended) {
-                if (device_may_wakeup(&client->dev))
-                        pm_wakeup_event(&client->dev, 500);
                msleep(20);
                return IRQ_HANDLED;
        }
@@ -763,8 +772,8 @@ static int zforce_probe(struct i2c_client *client,
         * Therefore we can trigger the interrupt anytime it is low and do
         * not need to limit it to the interrupt edge.
         */
-        ret = devm_request_threaded_irq(&client->dev, client->irq, NULL,
+        ret = devm_request_threaded_irq(&client->dev, client->irq,
-                                        zforce_interrupt,
+                                        zforce_irq, zforce_irq_thread,
                                        IRQF_TRIGGER_LOW | IRQF_ONESHOT,
                                        input_dev->name, ts);
        if (ret) {
diff --git a/drivers/isdn/hisax/hfc_pci.c b/drivers/isdn/hisax/hfc_pci.c
index 497bd026c237..4a4825528188 100644
--- a/drivers/isdn/hisax/hfc_pci.c
+++ b/drivers/isdn/hisax/hfc_pci.c
@@ -1643,10 +1643,6 @@ setup_hfcpci(struct IsdnCard *card)
        int i;
        struct pci_dev *tmp_hfcpci = NULL;
-#ifdef __BIG_ENDIAN
-#error "not running on big endian machines now"
-#endif
        strcpy(tmp, hfcpci_revision);
        printk(KERN_INFO "HiSax: HFC-PCI driver Rev. %s\n", HiSax_getrev(tmp));
diff --git a/drivers/isdn/hisax/telespci.c b/drivers/isdn/hisax/telespci.c
index f6ab63aa6995..33eeb4602c7e 100644
--- a/drivers/isdn/hisax/telespci.c
+++ b/drivers/isdn/hisax/telespci.c
@@ -290,10 +290,6 @@ int setup_telespci(struct IsdnCard *card)
        struct IsdnCardState *cs = card->cs;
        char tmp[64];
-#ifdef __BIG_ENDIAN
-#error "not running on big endian machines now"
-#endif
        strcpy(tmp, telespci_revision);
        printk(KERN_INFO "HiSax: Teles/PCI driver Rev. %s\n", HiSax_getrev(tmp));
        if (cs->typ != ISDN_CTYPE_TELESPCI)
diff --git a/drivers/leds/leds-lp5521.c b/drivers/leds/leds-lp5521.c
index 05188351711d..a97263e902ff 100644
--- a/drivers/leds/leds-lp5521.c
+++ b/drivers/leds/leds-lp5521.c
@@ -244,18 +244,12 @@ static int lp5521_update_program_memory(struct lp55xx_chip *chip,
        if (i % 2)
                goto err;
-        mutex_lock(&chip->lock);
        for (i = 0; i < LP5521_PROGRAM_LENGTH; i++) {
                ret = lp55xx_write(chip, addr[idx] + i, pattern[i]);
-                if (ret) {
+                if (ret)
-                        mutex_unlock(&chip->lock);
                        return -EINVAL;
-                }
        }
-        mutex_unlock(&chip->lock);
        return size;
 err:
@@ -427,15 +421,17 @@ static ssize_t store_engine_load(struct device *dev,
 {
        struct lp55xx_led *led = i2c_get_clientdata(to_i2c_client(dev));
        struct lp55xx_chip *chip = led->chip;
+        int ret;
        mutex_lock(&chip->lock);
        chip->engine_idx = nr;
        lp5521_load_engine(chip);
+        ret = lp5521_update_program_memory(chip, buf, len);
        mutex_unlock(&chip->lock);
-        return lp5521_update_program_memory(chip, buf, len);
+        return ret;
 }
 store_load(1)
 store_load(2)
diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
index 6b553d9f4266..fd9ab5f61441 100644
--- a/drivers/leds/leds-lp5523.c
+++ b/drivers/leds/leds-lp5523.c
@@ -337,18 +337,12 @@ static int lp5523_update_program_memory(struct lp55xx_chip *chip,
        if (i % 2)
                goto err;
-        mutex_lock(&chip->lock);
        for (i = 0; i < LP5523_PROGRAM_LENGTH; i++) {
                ret = lp55xx_write(chip, LP5523_REG_PROG_MEM + i, pattern[i]);
-                if (ret) {
+                if (ret)
-                        mutex_unlock(&chip->lock);
                        return -EINVAL;
-                }
        }
-        mutex_unlock(&chip->lock);
        return size;
 err:
@@ -548,15 +542,17 @@ static ssize_t store_engine_load(struct device *dev,
 {
        struct lp55xx_led *led = i2c_get_clientdata(to_i2c_client(dev));
        struct lp55xx_chip *chip = led->chip;
+        int ret;
        mutex_lock(&chip->lock);
        chip->engine_idx = nr;
        lp5523_load_engine_and_select_page(chip);
+        ret = lp5523_update_program_memory(chip, buf, len);
        mutex_unlock(&chip->lock);
-        return lp5523_update_program_memory(chip, buf, len);
+        return ret;
 }
 store_load(1)
 store_load(2)
diff --git a/drivers/macintosh/Kconfig b/drivers/macintosh/Kconfig
index d26a312f117a..3067d56b11a6 100644
--- a/drivers/macintosh/Kconfig
+++ b/drivers/macintosh/Kconfig
@@ -32,7 +32,7 @@ config ADB_MACII
 config ADB_MACIISI
        bool "Include Mac IIsi ADB driver"
-        depends on ADB && MAC
+        depends on ADB && MAC && BROKEN
        help
          Say Y here if want your kernel to support Macintosh systems that use
          the Mac IIsi style ADB.  This includes the IIsi, IIvi, IIvx, Classic
diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c
index 2b46bf1d7e40..4c9852d92b0a 100644
--- a/drivers/md/bcache/alloc.c
+++ b/drivers/md/bcache/alloc.c
@@ -421,9 +421,11 @@ out:
        if (watermark <= WATERMARK_METADATA) {
                SET_GC_MARK(b, GC_MARK_METADATA);
+                SET_GC_MOVE(b, 0);
                b->prio = BTREE_PRIO;
        } else {
                SET_GC_MARK(b, GC_MARK_RECLAIMABLE);
+                SET_GC_MOVE(b, 0);
                b->prio = INITIAL_PRIO;
        }
diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h
index 4beb55a0ff30..754f43177483 100644
--- a/drivers/md/bcache/bcache.h
+++ b/drivers/md/bcache/bcache.h
@@ -197,7 +197,7 @@ struct bucket {
        uint8_t         disk_gen;
        uint8_t         last_gc; /* Most out of date gen in the btree */
        uint8_t         gc_gen;
-        uint16_t        gc_mark;
+        uint16_t        gc_mark; /* Bitfield used by GC. See below for field */
 };
 /*
@@ -209,7 +209,8 @@ BITMASK(GC_MARK,	 struct bucket, gc_mark, 0, 2);
 #define GC_MARK_RECLAIMABLE     0
 #define GC_MARK_DIRTY           1
 #define GC_MARK_METADATA        2
-BITMASK(GC_SECTORS_USED, struct bucket, gc_mark, 2, 14);
+BITMASK(GC_SECTORS_USED, struct bucket, gc_mark, 2, 13);
+BITMASK(GC_MOVE, struct bucket, gc_mark, 15, 1);
 #include "journal.h"
 #include "stats.h"
@@ -372,14 +373,14 @@ struct cached_dev {
        unsigned char           writeback_percent;
        unsigned                writeback_delay;
-        int                     writeback_rate_change;
-        int64_t                 writeback_rate_derivative;
        uint64_t                writeback_rate_target;
+        int64_t                 writeback_rate_proportional;
+        int64_t                 writeback_rate_derivative;
+        int64_t                 writeback_rate_change;
        unsigned                writeback_rate_update_seconds;
        unsigned                writeback_rate_d_term;
        unsigned                writeback_rate_p_term_inverse;
-        unsigned                writeback_rate_d_smooth;
 };
 enum alloc_watermarks {
@@ -445,7 +446,6 @@ struct cache {
         * call prio_write() to keep gens from wrapping.
         */
        uint8_t                 need_save_prio;
-        unsigned                gc_move_threshold;
        /*
         * If nonzero, we know we aren't going to find any buckets to invalidate
diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c
index 5e2765aadce1..31bb53fcc67a 100644
--- a/drivers/md/bcache/btree.c
+++ b/drivers/md/bcache/btree.c
@@ -1561,6 +1561,28 @@ size_t bch_btree_gc_finish(struct cache_set *c)
                SET_GC_MARK(PTR_BUCKET(c, &c->uuid_bucket, i),
                            GC_MARK_METADATA);
+        /* don't reclaim buckets to which writeback keys point */
+        rcu_read_lock();
+        for (i = 0; i < c->nr_uuids; i++) {
+                struct bcache_device *d = c->devices[i];
+                struct cached_dev *dc;
+                struct keybuf_key *w, *n;
+                unsigned j;
+                if (!d || UUID_FLASH_ONLY(&c->uuids[i]))
+                        continue;
+                dc = container_of(d, struct cached_dev, disk);
+                spin_lock(&dc->writeback_keys.lock);
+                rbtree_postorder_for_each_entry_safe(w, n,
+                                        &dc->writeback_keys.keys, node)
+                        for (j = 0; j < KEY_PTRS(&w->key); j++)
+                                SET_GC_MARK(PTR_BUCKET(c, &w->key, j),
+                                            GC_MARK_DIRTY);
+                spin_unlock(&dc->writeback_keys.lock);
+        }
+        rcu_read_unlock();
        for_each_cache(ca, c, i) {
                uint64_t *i;
@@ -1817,7 +1839,8 @@ static bool fix_overlapping_extents(struct btree *b, struct bkey *insert,
                        if (KEY_START(k) > KEY_START(insert) + sectors_found)
                                goto check_failed;
-                        if (KEY_PTRS(replace_key) != KEY_PTRS(k))
+                        if (KEY_PTRS(k) != KEY_PTRS(replace_key) ||
+                            KEY_DIRTY(k) != KEY_DIRTY(replace_key))
                                goto check_failed;
                        /* skip past gen */
@@ -2217,7 +2240,7 @@ struct btree_insert_op {
        struct bkey     *replace_key;
 };
-int btree_insert_fn(struct btree_op *b_op, struct btree *b)
+static int btree_insert_fn(struct btree_op *b_op, struct btree *b)
 {
        struct btree_insert_op *op = container_of(b_op,
                                        struct btree_insert_op, op);
diff --git a/drivers/md/bcache/movinggc.c b/drivers/md/bcache/movinggc.c
index 7c1275e66025..f2f0998c4a91 100644
--- a/drivers/md/bcache/movinggc.c
+++ b/drivers/md/bcache/movinggc.c
@@ -25,10 +25,9 @@ static bool moving_pred(struct keybuf *buf, struct bkey *k)
        unsigned i;
        for (i = 0; i < KEY_PTRS(k); i++) {
-                struct cache *ca = PTR_CACHE(c, k, i);
                struct bucket *g = PTR_BUCKET(c, k, i);
-                if (GC_SECTORS_USED(g) < ca->gc_move_threshold)
+                if (GC_MOVE(g))
                        return true;
        }
@@ -65,11 +64,16 @@ static void write_moving_finish(struct closure *cl)
 static void read_moving_endio(struct bio *bio, int error)
 {
+        struct bbio *b = container_of(bio, struct bbio, bio);
        struct moving_io *io = container_of(bio->bi_private,
                                            struct moving_io, cl);
        if (error)
                io->op.error = error;
+        else if (!KEY_DIRTY(&b->key) &&
+                 ptr_stale(io->op.c, &b->key, 0)) {
+                io->op.error = -EINTR;
+        }
        bch_bbio_endio(io->op.c, bio, error, "reading data to move");
 }
@@ -141,6 +145,11 @@ static void read_moving(struct cache_set *c)
                if (!w)
                        break;
+                if (ptr_stale(c, &w->key, 0)) {
+                        bch_keybuf_del(&c->moving_gc_keys, w);
+                        continue;
+                }
                io = kzalloc(sizeof(struct moving_io) + sizeof(struct bio_vec)
                             * DIV_ROUND_UP(KEY_SIZE(&w->key), PAGE_SECTORS),
                             GFP_KERNEL);
@@ -184,7 +193,8 @@ static bool bucket_cmp(struct bucket *l, struct bucket *r)
 static unsigned bucket_heap_top(struct cache *ca)
 {
-        return GC_SECTORS_USED(heap_peek(&ca->heap));
+        struct bucket *b;
+        return (b = heap_peek(&ca->heap)) ? GC_SECTORS_USED(b) : 0;
 }
 void bch_moving_gc(struct cache_set *c)
@@ -226,9 +236,8 @@ void bch_moving_gc(struct cache_set *c)
                        sectors_to_move -= GC_SECTORS_USED(b);
                }
-                ca->gc_move_threshold = bucket_heap_top(ca);
+                while (heap_pop(&ca->heap, b, bucket_cmp))
+                        SET_GC_MOVE(b, 1);
-                pr_debug("threshold %u", ca->gc_move_threshold);
        }
        mutex_unlock(&c->bucket_lock);
diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c
index dec15cd2d797..c57bfa071a57 100644
--- a/drivers/md/bcache/super.c
+++ b/drivers/md/bcache/super.c
@@ -1676,7 +1676,7 @@ err:
 static bool can_attach_cache(struct cache *ca, struct cache_set *c)
 {
        return ca->sb.block_size        == c->sb.block_size &&
-                ca->sb.bucket_size      == c->sb.block_size &&
+                ca->sb.bucket_size      == c->sb.bucket_size &&
                ca->sb.nr_in_set        == c->sb.nr_in_set;
 }
diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
index 80d4c2bee18a..a1f85612f0b3 100644
--- a/drivers/md/bcache/sysfs.c
+++ b/drivers/md/bcache/sysfs.c
@@ -83,7 +83,6 @@ rw_attribute(writeback_rate);
 rw_attribute(writeback_rate_update_seconds);
 rw_attribute(writeback_rate_d_term);
 rw_attribute(writeback_rate_p_term_inverse);
-rw_attribute(writeback_rate_d_smooth);
 read_attribute(writeback_rate_debug);
 read_attribute(stripe_size);
@@ -129,31 +128,41 @@ SHOW(__bch_cached_dev)
        var_printf(writeback_running,   "%i");
        var_print(writeback_delay);
        var_print(writeback_percent);
-        sysfs_print(writeback_rate,     dc->writeback_rate.rate);
+        sysfs_hprint(writeback_rate,    dc->writeback_rate.rate << 9);
        var_print(writeback_rate_update_seconds);
        var_print(writeback_rate_d_term);
        var_print(writeback_rate_p_term_inverse);
-        var_print(writeback_rate_d_smooth);
        if (attr == &sysfs_writeback_rate_debug) {
+                char rate[20];
                char dirty[20];
-                char derivative[20];
                char target[20];
-                bch_hprint(dirty,
+                char proportional[20];
-                           bcache_dev_sectors_dirty(&dc->disk) << 9);
+                char derivative[20];
-                bch_hprint(derivative,  dc->writeback_rate_derivative << 9);
+                char change[20];
+                s64 next_io;
+                bch_hprint(rate,        dc->writeback_rate.rate << 9);
+                bch_hprint(dirty,       bcache_dev_sectors_dirty(&dc->disk) << 9);
                bch_hprint(target,      dc->writeback_rate_target << 9);
+                bch_hprint(proportional,dc->writeback_rate_proportional << 9);
+                bch_hprint(derivative,  dc->writeback_rate_derivative << 9);
+                bch_hprint(change,      dc->writeback_rate_change << 9);
+                next_io = div64_s64(dc->writeback_rate.next - local_clock(),
+                                    NSEC_PER_MSEC);
                return sprintf(buf,
-                               "rate:\t\t%u\n"
+                               "rate:\t\t%s/sec\n"
-                               "change:\t\t%i\n"
                               "dirty:\t\t%s\n"
+                               "target:\t\t%s\n"
+                               "proportional:\t%s\n"
                               "derivative:\t%s\n"
-                               "target:\t\t%s\n",
+                               "change:\t\t%s/sec\n"
-                               dc->writeback_rate.rate,
+                               "next io:\t%llims\n",
-                               dc->writeback_rate_change,
+                               rate, dirty, target, proportional,
-                               dirty, derivative, target);
+                               derivative, change, next_io);
        }
        sysfs_hprint(dirty_data,
@@ -189,6 +198,7 @@ STORE(__cached_dev)
        struct kobj_uevent_env *env;
 #define d_strtoul(var)          sysfs_strtoul(var, dc->var)
+#define d_strtoul_nonzero(var)  sysfs_strtoul_clamp(var, dc->var, 1, INT_MAX)
 #define d_strtoi_h(var)         sysfs_hatoi(var, dc->var)
        sysfs_strtoul(data_csum,        dc->disk.data_csum);
@@ -197,16 +207,15 @@ STORE(__cached_dev)
        d_strtoul(writeback_metadata);
        d_strtoul(writeback_running);
        d_strtoul(writeback_delay);
-        sysfs_strtoul_clamp(writeback_rate,
-                            dc->writeback_rate.rate, 1, 1000000);
        sysfs_strtoul_clamp(writeback_percent, dc->writeback_percent, 0, 40);
-        d_strtoul(writeback_rate_update_seconds);
+        sysfs_strtoul_clamp(writeback_rate,
+                            dc->writeback_rate.rate, 1, INT_MAX);
+        d_strtoul_nonzero(writeback_rate_update_seconds);
        d_strtoul(writeback_rate_d_term);
-        d_strtoul(writeback_rate_p_term_inverse);
+        d_strtoul_nonzero(writeback_rate_p_term_inverse);
-        sysfs_strtoul_clamp(writeback_rate_p_term_inverse,
-                            dc->writeback_rate_p_term_inverse, 1, INT_MAX);
-        d_strtoul(writeback_rate_d_smooth);
        d_strtoi_h(sequential_cutoff);
        d_strtoi_h(readahead);
@@ -313,7 +322,6 @@ static struct attribute *bch_cached_dev_files[] = {
        &sysfs_writeback_rate_update_seconds,
        &sysfs_writeback_rate_d_term,
        &sysfs_writeback_rate_p_term_inverse,
-        &sysfs_writeback_rate_d_smooth,
        &sysfs_writeback_rate_debug,
        &sysfs_dirty_data,
        &sysfs_stripe_size,
diff --git a/drivers/md/bcache/util.c b/drivers/md/bcache/util.c
index 462214eeacbe..bb37618e7664 100644
--- a/drivers/md/bcache/util.c
+++ b/drivers/md/bcache/util.c
@@ -209,7 +209,13 @@ uint64_t bch_next_delay(struct bch_ratelimit *d, uint64_t done)
 {
        uint64_t now = local_clock();
-        d->next += div_u64(done, d->rate);
+        d->next += div_u64(done * NSEC_PER_SEC, d->rate);
+        if (time_before64(now + NSEC_PER_SEC, d->next))
+                d->next = now + NSEC_PER_SEC;
+        if (time_after64(now - NSEC_PER_SEC * 2, d->next))
+                d->next = now - NSEC_PER_SEC * 2;
        return time_after64(d->next, now)
                ? div_u64(d->next - now, NSEC_PER_SEC / HZ)
diff --git a/drivers/md/bcache/util.h b/drivers/md/bcache/util.h
index 362c4b3f8b4a..1030c6020e98 100644
--- a/drivers/md/bcache/util.h
+++ b/drivers/md/bcache/util.h
@@ -110,7 +110,7 @@ do {									\
        _r;                                                             \
 })
-#define heap_peek(h)    ((h)->size ? (h)->data[0] : NULL)
+#define heap_peek(h)    ((h)->used ? (h)->data[0] : NULL)
 #define heap_full(h)    ((h)->used == (h)->size)
diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c
index 99053b1251be..6c44fe059c27 100644
--- a/drivers/md/bcache/writeback.c
+++ b/drivers/md/bcache/writeback.c
@@ -30,38 +30,40 @@ static void __update_writeback_rate(struct cached_dev *dc)
        /* PD controller */
-        int change = 0;
-        int64_t error;
        int64_t dirty = bcache_dev_sectors_dirty(&dc->disk);
        int64_t derivative = dirty - dc->disk.sectors_dirty_last;
+        int64_t proportional = dirty - target;
+        int64_t change;
        dc->disk.sectors_dirty_last = dirty;
-        derivative *= dc->writeback_rate_d_term;
+        /* Scale to sectors per second */
-        derivative = clamp(derivative, -dirty, dirty);
-        derivative = ewma_add(dc->disk.sectors_dirty_derivative, derivative,
+        proportional *= dc->writeback_rate_update_seconds;
-                              dc->writeback_rate_d_smooth, 0);
+        proportional = div_s64(proportional, dc->writeback_rate_p_term_inverse);
-        /* Avoid divide by zero */
+        derivative = div_s64(derivative, dc->writeback_rate_update_seconds);
-        if (!target)
-                goto out;
-        error = div64_s64((dirty + derivative - target) << 8, target);
+        derivative = ewma_add(dc->disk.sectors_dirty_derivative, derivative,
+                              (dc->writeback_rate_d_term /
+                               dc->writeback_rate_update_seconds) ?: 1, 0);
+        derivative *= dc->writeback_rate_d_term;
+        derivative = div_s64(derivative, dc->writeback_rate_p_term_inverse);
-        change = div_s64((dc->writeback_rate.rate * error) >> 8,
+        change = proportional + derivative;
-                         dc->writeback_rate_p_term_inverse);
        /* Don't increase writeback rate if the device isn't keeping up */
        if (change > 0 &&
            time_after64(local_clock(),
-                         dc->writeback_rate.next + 10 * NSEC_PER_MSEC))
+                         dc->writeback_rate.next + NSEC_PER_MSEC))
                change = 0;
        dc->writeback_rate.rate =
-                clamp_t(int64_t, dc->writeback_rate.rate + change,
+                clamp_t(int64_t, (int64_t) dc->writeback_rate.rate + change,
                        1, NSEC_PER_MSEC);
-out:
+        dc->writeback_rate_proportional = proportional;
        dc->writeback_rate_derivative = derivative;
        dc->writeback_rate_change = change;
        dc->writeback_rate_target = target;
@@ -87,15 +89,11 @@ static void update_writeback_rate(struct work_struct *work)
 static unsigned writeback_delay(struct cached_dev *dc, unsigned sectors)
 {
-        uint64_t ret;
        if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags) ||
            !dc->writeback_percent)
                return 0;
-        ret = bch_next_delay(&dc->writeback_rate, sectors * 10000000ULL);
+        return bch_next_delay(&dc->writeback_rate, sectors);
-        return min_t(uint64_t, ret, HZ);
 }
 struct dirty_io {
@@ -241,7 +239,7 @@ static void read_dirty(struct cached_dev *dc)
                if (KEY_START(&w->key) != dc->last_read ||
                    jiffies_to_msecs(delay) > 50)
                        while (!kthread_should_stop() && delay)
-                                delay = schedule_timeout_interruptible(delay);
+                                delay = schedule_timeout_uninterruptible(delay);
                dc->last_read   = KEY_OFFSET(&w->key);
@@ -438,7 +436,7 @@ static int bch_writeback_thread(void *arg)
                        while (delay &&
                               !kthread_should_stop() &&
                               !test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags))
-                                delay = schedule_timeout_interruptible(delay);
+                                delay = schedule_timeout_uninterruptible(delay);
                }
        }
@@ -476,6 +474,8 @@ void bch_sectors_dirty_init(struct cached_dev *dc)
        bch_btree_map_keys(&op.op, dc->disk.c, &KEY(op.inode, 0, 0),
                           sectors_dirty_init_fn, 0);
+        dc->disk.sectors_dirty_last = bcache_dev_sectors_dirty(&dc->disk);
 }
 int bch_cached_dev_writeback_init(struct cached_dev *dc)
@@ -490,18 +490,15 @@ int bch_cached_dev_writeback_init(struct cached_dev *dc)
        dc->writeback_delay             = 30;
        dc->writeback_rate.rate         = 1024;
-        dc->writeback_rate_update_seconds = 30;
+        dc->writeback_rate_update_seconds = 5;
-        dc->writeback_rate_d_term       = 16;
+        dc->writeback_rate_d_term       = 30;
-        dc->writeback_rate_p_term_inverse = 64;
+        dc->writeback_rate_p_term_inverse = 6000;
-        dc->writeback_rate_d_smooth     = 8;
        dc->writeback_thread = kthread_create(bch_writeback_thread, dc,
                                              "bcache_writeback");
        if (IS_ERR(dc->writeback_thread))
                return PTR_ERR(dc->writeback_thread);
-        set_task_state(dc->writeback_thread, TASK_INTERRUPTIBLE);
        INIT_DELAYED_WORK(&dc->writeback_rate_update, update_writeback_rate);
        schedule_delayed_work(&dc->writeback_rate_update,
                              dc->writeback_rate_update_seconds * HZ);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 21f4d7ff0da2..369d919bdafe 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1077,6 +1077,7 @@ static int super_90_validate(struct mddev *mddev, struct md_rdev *rdev)
        rdev->raid_disk = -1;
        clear_bit(Faulty, &rdev->flags);
        clear_bit(In_sync, &rdev->flags);
+        clear_bit(Bitmap_sync, &rdev->flags);
        clear_bit(WriteMostly, &rdev->flags);
        if (mddev->raid_disks == 0) {
@@ -1155,6 +1156,8 @@ static int super_90_validate(struct mddev *mddev, struct md_rdev *rdev)
                 */
                if (ev1 < mddev->bitmap->events_cleared)
                        return 0;
+                if (ev1 < mddev->events)
+                        set_bit(Bitmap_sync, &rdev->flags);
        } else {
                if (ev1 < mddev->events)
                        /* just a hot-add of a new device, leave raid_disk at -1 */
@@ -1563,6 +1566,7 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
        rdev->raid_disk = -1;
        clear_bit(Faulty, &rdev->flags);
        clear_bit(In_sync, &rdev->flags);
+        clear_bit(Bitmap_sync, &rdev->flags);
        clear_bit(WriteMostly, &rdev->flags);
        if (mddev->raid_disks == 0) {
@@ -1645,6 +1649,8 @@ static int super_1_validate(struct mddev *mddev, struct md_rdev *rdev)
                 */
                if (ev1 < mddev->bitmap->events_cleared)
                        return 0;
+                if (ev1 < mddev->events)
+                        set_bit(Bitmap_sync, &rdev->flags);
        } else {
                if (ev1 < mddev->events)
                        /* just a hot-add of a new device, leave raid_disk at -1 */
@@ -2788,6 +2794,7 @@ slot_store(struct md_rdev *rdev, const char *buf, size_t len)
                else
                        rdev->saved_raid_disk = -1;
                clear_bit(In_sync, &rdev->flags);
+                clear_bit(Bitmap_sync, &rdev->flags);
                err = rdev->mddev->pers->
                        hot_add_disk(rdev->mddev, rdev);
                if (err) {
@@ -5760,6 +5767,7 @@ static int add_new_disk(struct mddev * mddev, mdu_disk_info_t *info)
                            info->raid_disk < mddev->raid_disks) {
                                rdev->raid_disk = info->raid_disk;
                                set_bit(In_sync, &rdev->flags);
+                                clear_bit(Bitmap_sync, &rdev->flags);
                        } else
                                rdev->raid_disk = -1;
                } else
@@ -7706,7 +7714,8 @@ static int remove_and_add_spares(struct mddev *mddev,
                if (test_bit(Faulty, &rdev->flags))
                        continue;
                if (mddev->ro &&
-                    rdev->saved_raid_disk < 0)
+                    ! (rdev->saved_raid_disk >= 0 &&
+                       !test_bit(Bitmap_sync, &rdev->flags)))
                        continue;
                rdev->recovery_offset = 0;
@@ -7787,9 +7796,12 @@ void md_check_recovery(struct mddev *mddev)
                         * As we only add devices that are already in-sync,
                         * we can activate the spares immediately.
                         */
-                        clear_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
                        remove_and_add_spares(mddev, NULL);
-                        mddev->pers->spare_active(mddev);
+                        /* There is no thread, but we need to call
+                         * ->spare_active and clear saved_raid_disk
+                         */
+                        md_reap_sync_thread(mddev);
+                        clear_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
                        goto unlock;
                }
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 389a3c93cdb7..07bba96de260 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -129,6 +129,9 @@ struct md_rdev {
 enum flag_bits {
        Faulty,                 /* device is known to have a fault */
        In_sync,                /* device is in_sync with rest of array */
+        Bitmap_sync,            /* ..actually, not quite In_sync.  Need a
+                                 * bitmap-based recovery to get fully in sync
+                                 */
        Unmerged,               /* device is being added to array and should
                                 * be considerred for bvec_merge_fn but not
                                 * yet for actual IO
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 1e5a540995e9..a49cfcc7a343 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -924,9 +924,8 @@ static sector_t wait_barrier(struct r1conf *conf, struct bio *bio)
                                conf->next_window_requests++;
                        else
                                conf->current_window_requests++;
-                }
-                if (bio->bi_sector >= conf->start_next_window)
                        sector = conf->start_next_window;
+                }
        }
        conf->nr_pending++;
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index c504e8389e69..06eeb99ea6fc 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1319,7 +1319,7 @@ read_again:
                        /* Could not read all from this device, so we will
                         * need another r10_bio.
                         */
-                        sectors_handled = (r10_bio->sectors + max_sectors
+                        sectors_handled = (r10_bio->sector + max_sectors
                                           - bio->bi_sector);
                        r10_bio->sectors = max_sectors;
                        spin_lock_irq(&conf->device_lock);
@@ -1327,7 +1327,7 @@ read_again:
                                bio->bi_phys_segments = 2;
                        else
                                bio->bi_phys_segments++;
-                        spin_unlock(&conf->device_lock);
+                        spin_unlock_irq(&conf->device_lock);
                        /* Cannot call generic_make_request directly
                         * as that will be queued in __generic_make_request
                         * and subsequent mempool_alloc might block
@@ -3218,10 +3218,6 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
                        if (j == conf->copies) {
                                /* Cannot recover, so abort the recovery or
                                 * record a bad block */
-                                put_buf(r10_bio);
-                                if (rb2)
-                                        atomic_dec(&rb2->remaining);
-                                r10_bio = rb2;
                                if (any_working) {
                                        /* problem is that there are bad blocks
                                         * on other device(s)
@@ -3253,6 +3249,10 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr,
                                        mirror->recovery_disabled
                                                = mddev->recovery_disabled;
                                }
+                                put_buf(r10_bio);
+                                if (rb2)
+                                        atomic_dec(&rb2->remaining);
+                                r10_bio = rb2;
                                break;
                        }
                }
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index cc055da02e2a..cbb15716a5db 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -687,7 +687,8 @@ get_active_stripe(struct r5conf *conf, sector_t sector,
                        } else {
                                if (!test_bit(STRIPE_HANDLE, &sh->state))
                                        atomic_inc(&conf->active_stripes);
-                                BUG_ON(list_empty(&sh->lru));
+                                BUG_ON(list_empty(&sh->lru) &&
+                                       !test_bit(STRIPE_EXPANDING, &sh->state));
                                list_del_init(&sh->lru);
                                if (sh->group) {
                                        sh->group->stripes_cnt--;
@@ -3608,7 +3609,7 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
                         */
                        set_bit(R5_Insync, &dev->flags);
-                if (rdev && test_bit(R5_WriteError, &dev->flags)) {
+                if (test_bit(R5_WriteError, &dev->flags)) {
                        /* This flag does not apply to '.replacement'
                         * only to .rdev, so make sure to check that*/
                        struct md_rdev *rdev2 = rcu_dereference(
@@ -3621,7 +3622,7 @@ static void analyse_stripe(struct stripe_head *sh, struct stripe_head_state *s)
                        } else
                                clear_bit(R5_WriteError, &dev->flags);
                }
-                if (rdev && test_bit(R5_MadeGood, &dev->flags)) {
+                if (test_bit(R5_MadeGood, &dev->flags)) {
                        /* This flag does not apply to '.replacement'
                         * only to .rdev, so make sure to check that*/
                        struct md_rdev *rdev2 = rcu_dereference(
diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
index 11e20afbdcac..705698fd2c7e 100644
--- a/drivers/mfd/rtsx_pcr.c
+++ b/drivers/mfd/rtsx_pcr.c
@@ -1228,8 +1228,14 @@ static void rtsx_pci_remove(struct pci_dev *pcidev)
        pcr->remove_pci = true;
-        cancel_delayed_work(&pcr->carddet_work);
+        /* Disable interrupts at the pcr level */
-        cancel_delayed_work(&pcr->idle_work);
+        spin_lock_irq(&pcr->lock);
+        rtsx_pci_writel(pcr, RTSX_BIER, 0);
+        pcr->bier = 0;
+        spin_unlock_irq(&pcr->lock);
+        cancel_delayed_work_sync(&pcr->carddet_work);
+        cancel_delayed_work_sync(&pcr->idle_work);
        mfd_remove_devices(&pcidev->dev);
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index a3e291d0df9a..6cb388e8fb7d 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -525,4 +525,5 @@ source "drivers/misc/altera-stapl/Kconfig"
 source "drivers/misc/mei/Kconfig"
 source "drivers/misc/vmw_vmci/Kconfig"
 source "drivers/misc/mic/Kconfig"
+source "drivers/misc/genwqe/Kconfig"
 endmenu
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index f45473e68bf7..99b9424ce31d 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -53,3 +53,4 @@ obj-$(CONFIG_VMWARE_VMCI)	+= vmw_vmci/
 obj-$(CONFIG_LATTICE_ECP3_CONFIG)       += lattice-ecp3-config.o
 obj-$(CONFIG_SRAM)              += sram.o
 obj-y                           += mic/
+obj-$(CONFIG_GENWQE)            += genwqe/
diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c
index 0daadcf1ed7a..d3eee113baeb 100644
--- a/drivers/misc/ad525x_dpot.c
+++ b/drivers/misc/ad525x_dpot.c
@@ -641,7 +641,7 @@ static const struct attribute_group ad525x_group_commands = {
        .attrs = ad525x_attributes_commands,
 };
-int ad_dpot_add_files(struct device *dev,
+static int ad_dpot_add_files(struct device *dev,
                unsigned features, unsigned rdac)
 {
        int err = sysfs_create_file(&dev->kobj,
@@ -666,7 +666,7 @@ int ad_dpot_add_files(struct device *dev,
        return err;
 }
-inline void ad_dpot_remove_files(struct device *dev,
+static inline void ad_dpot_remove_files(struct device *dev,
                unsigned features, unsigned rdac)
 {
        sysfs_remove_file(&dev->kobj,
diff --git a/drivers/misc/bmp085-i2c.c b/drivers/misc/bmp085-i2c.c
index 3abfcecf8424..a7c16295b816 100644
--- a/drivers/misc/bmp085-i2c.c
+++ b/drivers/misc/bmp085-i2c.c
@@ -49,7 +49,7 @@ static int bmp085_i2c_probe(struct i2c_client *client,
                return err;
        }
-        return bmp085_probe(&client->dev, regmap);
+        return bmp085_probe(&client->dev, regmap, client->irq);
 }
 static int bmp085_i2c_remove(struct i2c_client *client)
diff --git a/drivers/misc/bmp085-spi.c b/drivers/misc/bmp085-spi.c
index d6a52659cf24..864ecac32373 100644
--- a/drivers/misc/bmp085-spi.c
+++ b/drivers/misc/bmp085-spi.c
@@ -41,7 +41,7 @@ static int bmp085_spi_probe(struct spi_device *client)
                return err;
        }
-        return bmp085_probe(&client->dev, regmap);
+        return bmp085_probe(&client->dev, regmap, client->irq);
 }
 static int bmp085_spi_remove(struct spi_device *client)
diff --git a/drivers/misc/bmp085.c b/drivers/misc/bmp085.c
index 2704d885a9b3..820e53d0048f 100644
--- a/drivers/misc/bmp085.c
+++ b/drivers/misc/bmp085.c
@@ -49,9 +49,11 @@
 #include <linux/device.h>
 #include <linux/init.h>
 #include <linux/slab.h>
-#include <linux/delay.h>
 #include <linux/of.h>
 #include "bmp085.h"
+#include <linux/interrupt.h>
+#include <linux/completion.h>
+#include <linux/gpio.h>
 #define BMP085_CHIP_ID                  0x55
 #define BMP085_CALIBRATION_DATA_START   0xAA
@@ -84,8 +86,19 @@ struct bmp085_data {
        unsigned long last_temp_measurement;
        u8      chip_id;
        s32     b6; /* calculated temperature correction coefficient */
+        int     irq;
+        struct  completion done;
 };
+static irqreturn_t bmp085_eoc_isr(int irq, void *devid)
+{
+        struct bmp085_data *data = devid;
+        complete(&data->done);
+        return IRQ_HANDLED;
+}
 static s32 bmp085_read_calibration_data(struct bmp085_data *data)
 {
        u16 tmp[BMP085_CALIBRATION_DATA_LENGTH];
@@ -116,6 +129,9 @@ static s32 bmp085_update_raw_temperature(struct bmp085_data *data)
        s32 status;
        mutex_lock(&data->lock);
+        init_completion(&data->done);
        status = regmap_write(data->regmap, BMP085_CTRL_REG,
                              BMP085_TEMP_MEASUREMENT);
        if (status < 0) {
@@ -123,7 +139,8 @@ static s32 bmp085_update_raw_temperature(struct bmp085_data *data)
                        "Error while requesting temperature measurement.\n");
                goto exit;
        }
-        msleep(BMP085_TEMP_CONVERSION_TIME);
+        wait_for_completion_timeout(&data->done, 1 + msecs_to_jiffies(
+                                            BMP085_TEMP_CONVERSION_TIME));
        status = regmap_bulk_read(data->regmap, BMP085_CONVERSION_REGISTER_MSB,
                                 &tmp, sizeof(tmp));
@@ -147,6 +164,9 @@ static s32 bmp085_update_raw_pressure(struct bmp085_data *data)
        s32 status;
        mutex_lock(&data->lock);
+        init_completion(&data->done);
        status = regmap_write(data->regmap, BMP085_CTRL_REG,
                        BMP085_PRESSURE_MEASUREMENT +
                        (data->oversampling_setting << 6));
@@ -157,8 +177,8 @@ static s32 bmp085_update_raw_pressure(struct bmp085_data *data)
        }
        /* wait for the end of conversion */
-        msleep(2+(3 << data->oversampling_setting));
+        wait_for_completion_timeout(&data->done, 1 + msecs_to_jiffies(
+                                        2+(3 << data->oversampling_setting)));
        /* copy data into a u32 (4 bytes), but skip the first byte. */
        status = regmap_bulk_read(data->regmap, BMP085_CONVERSION_REGISTER_MSB,
                                 ((u8 *)&tmp)+1, 3);
@@ -420,7 +440,7 @@ struct regmap_config bmp085_regmap_config = {
 };
 EXPORT_SYMBOL_GPL(bmp085_regmap_config);
-int bmp085_probe(struct device *dev, struct regmap *regmap)
+int bmp085_probe(struct device *dev, struct regmap *regmap, int irq)
 {
        struct bmp085_data *data;
        int err = 0;
@@ -434,6 +454,15 @@ int bmp085_probe(struct device *dev, struct regmap *regmap)
        dev_set_drvdata(dev, data);
        data->dev = dev;
        data->regmap = regmap;
+        data->irq = irq;
+        if (data->irq > 0) {
+                err = devm_request_irq(dev, data->irq, bmp085_eoc_isr,
+                                              IRQF_TRIGGER_RISING, "bmp085",
+                                              data);
+                if (err < 0)
+                        goto exit_free;
+        }
        /* Initialize the BMP085 chip */
        err = bmp085_init_client(data);
diff --git a/drivers/misc/bmp085.h b/drivers/misc/bmp085.h
index 2b8f615bca92..8b8e3b1f5ca5 100644
--- a/drivers/misc/bmp085.h
+++ b/drivers/misc/bmp085.h
@@ -26,7 +26,7 @@
 extern struct regmap_config bmp085_regmap_config;
-int bmp085_probe(struct device *dev, struct regmap *regmap);
+int bmp085_probe(struct device *dev, struct regmap *regmap, int irq);
 int bmp085_remove(struct device *dev);
 int bmp085_detect(struct device *dev);
diff --git a/drivers/misc/eeprom/eeprom_93xx46.c b/drivers/misc/eeprom/eeprom_93xx46.c
index 3a015abb444a..78e55b501c94 100644
--- a/drivers/misc/eeprom/eeprom_93xx46.c
+++ b/drivers/misc/eeprom/eeprom_93xx46.c
@@ -378,7 +378,6 @@ static int eeprom_93xx46_remove(struct spi_device *spi)
                device_remove_file(&spi->dev, &dev_attr_erase);
        sysfs_remove_bin_file(&spi->dev.kobj, &edev->bin);
-        spi_set_drvdata(spi, NULL);
        kfree(edev);
        return 0;
 }
diff --git a/drivers/misc/genwqe/Kconfig b/drivers/misc/genwqe/Kconfig
new file mode 100644
index 000000000000..6069d8cd79d7
--- /dev/null
+++ b/drivers/misc/genwqe/Kconfig
@@ -0,0 +1,13 @@
+#
+# IBM Accelerator Family 'GenWQE'
+#
+menuconfig GENWQE
+        tristate "GenWQE PCIe Accelerator"
+        depends on PCI && 64BIT
+        select CRC_ITU_T
+        default n
+        help
+          Enables PCIe card driver for IBM GenWQE accelerators.
+          The user-space interface is described in
+          include/linux/genwqe/genwqe_card.h.
diff --git a/drivers/misc/genwqe/Makefile b/drivers/misc/genwqe/Makefile
new file mode 100644
index 000000000000..98a2b4f0b18b
--- /dev/null
+++ b/drivers/misc/genwqe/Makefile
@@ -0,0 +1,7 @@
+#
+# Makefile for GenWQE driver
+#
+obj-$(CONFIG_GENWQE) := genwqe_card.o
+genwqe_card-objs := card_base.o card_dev.o card_ddcb.o card_sysfs.o \
+        card_debugfs.o card_utils.o
diff --git a/drivers/misc/genwqe/card_base.c b/drivers/misc/genwqe/card_base.c
new file mode 100644
index 000000000000..74d51c9bb858
--- /dev/null
+++ b/drivers/misc/genwqe/card_base.c
@@ -0,0 +1,1205 @@
+/**
+ * IBM Accelerator Family 'GenWQE'
+ *
+ * (C) Copyright IBM Corp. 2013
+ *
+ * Author: Frank Haverkamp <haver@linux.vnet.ibm.com>
+ * Author: Joerg-Stephan Vogt <jsvogt@de.ibm.com>
+ * Author: Michael Jung <mijung@de.ibm.com>
+ * Author: Michael Ruettger <michael@ibmra.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (version 2 only)
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+/*
+ * Module initialization and PCIe setup. Card health monitoring and
+ * recovery functionality. Character device creation and deletion are
+ * controlled from here.
+ */
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/pci.h>
+#include <linux/err.h>
+#include <linux/aer.h>
+#include <linux/string.h>
+#include <linux/sched.h>
+#include <linux/wait.h>
+#include <linux/delay.h>
+#include <linux/dma-mapping.h>
+#include <linux/module.h>
+#include <linux/notifier.h>
+#include <linux/device.h>
+#include <linux/log2.h>
+#include <linux/genwqe/genwqe_card.h>
+#include "card_base.h"
+#include "card_ddcb.h"
+MODULE_AUTHOR("Frank Haverkamp <haver@linux.vnet.ibm.com>");
+MODULE_AUTHOR("Michael Ruettger <michael@ibmra.de>");
+MODULE_AUTHOR("Joerg-Stephan Vogt <jsvogt@de.ibm.com>");
+MODULE_AUTHOR("Michal Jung <mijung@de.ibm.com>");
+MODULE_DESCRIPTION("GenWQE Card");
+MODULE_VERSION(DRV_VERS_STRING);
+MODULE_LICENSE("GPL");
+static char genwqe_driver_name[] = GENWQE_DEVNAME;
+static struct class *class_genwqe;
+static struct dentry *debugfs_genwqe;
+static struct genwqe_dev *genwqe_devices[GENWQE_CARD_NO_MAX];
+/* PCI structure for identifying device by PCI vendor and device ID */
+static DEFINE_PCI_DEVICE_TABLE(genwqe_device_table) = {
+        { .vendor      = PCI_VENDOR_ID_IBM,
+          .device      = PCI_DEVICE_GENWQE,
+          .subvendor   = PCI_SUBVENDOR_ID_IBM,
+          .subdevice   = PCI_SUBSYSTEM_ID_GENWQE5,
+          .class       = (PCI_CLASSCODE_GENWQE5 << 8),
+          .class_mask  = ~0,
+          .driver_data = 0 },
+        /* Initial SR-IOV bring-up image */
+        { .vendor      = PCI_VENDOR_ID_IBM,
+          .device      = PCI_DEVICE_GENWQE,
+          .subvendor   = PCI_SUBVENDOR_ID_IBM_SRIOV,
+          .subdevice   = PCI_SUBSYSTEM_ID_GENWQE5_SRIOV,
+          .class       = (PCI_CLASSCODE_GENWQE5_SRIOV << 8),
+          .class_mask  = ~0,
+          .driver_data = 0 },
+        { .vendor      = PCI_VENDOR_ID_IBM,  /* VF Vendor ID */
+          .device      = 0x0000,  /* VF Device ID */
+          .subvendor   = PCI_SUBVENDOR_ID_IBM_SRIOV,
+          .subdevice   = PCI_SUBSYSTEM_ID_GENWQE5_SRIOV,
+          .class       = (PCI_CLASSCODE_GENWQE5_SRIOV << 8),
+          .class_mask  = ~0,
+          .driver_data = 0 },
+        /* Fixed up image */
+        { .vendor      = PCI_VENDOR_ID_IBM,
+          .device      = PCI_DEVICE_GENWQE,
+          .subvendor   = PCI_SUBVENDOR_ID_IBM_SRIOV,
+          .subdevice   = PCI_SUBSYSTEM_ID_GENWQE5,
+          .class       = (PCI_CLASSCODE_GENWQE5_SRIOV << 8),
+          .class_mask  = ~0,
+          .driver_data = 0 },
+        { .vendor      = PCI_VENDOR_ID_IBM,  /* VF Vendor ID */
+          .device      = 0x0000,  /* VF Device ID */
+          .subvendor   = PCI_SUBVENDOR_ID_IBM_SRIOV,
+          .subdevice   = PCI_SUBSYSTEM_ID_GENWQE5,
+          .class       = (PCI_CLASSCODE_GENWQE5_SRIOV << 8),
+          .class_mask  = ~0,
+          .driver_data = 0 },
+        /* Even one more ... */
+        { .vendor      = PCI_VENDOR_ID_IBM,
+          .device      = PCI_DEVICE_GENWQE,
+          .subvendor   = PCI_SUBVENDOR_ID_IBM,
+          .subdevice   = PCI_SUBSYSTEM_ID_GENWQE5_NEW,
+          .class       = (PCI_CLASSCODE_GENWQE5 << 8),
+          .class_mask  = ~0,
+          .driver_data = 0 },
+        { 0, }                  /* 0 terminated list. */
+};
+MODULE_DEVICE_TABLE(pci, genwqe_device_table);
+/**
+ * genwqe_dev_alloc() - Create and prepare a new card descriptor
+ *
+ * Return: Pointer to card descriptor, or ERR_PTR(err) on error
+ */
+static struct genwqe_dev *genwqe_dev_alloc(void)
+{
+        unsigned int i = 0, j;
+        struct genwqe_dev *cd;
+        for (i = 0; i < GENWQE_CARD_NO_MAX; i++) {
+                if (genwqe_devices[i] == NULL)
+                        break;
+        }
+        if (i >= GENWQE_CARD_NO_MAX)
+                return ERR_PTR(-ENODEV);
+        cd = kzalloc(sizeof(struct genwqe_dev), GFP_KERNEL);
+        if (!cd)
+                return ERR_PTR(-ENOMEM);
+        cd->card_idx = i;
+        cd->class_genwqe = class_genwqe;
+        cd->debugfs_genwqe = debugfs_genwqe;
+        init_waitqueue_head(&cd->queue_waitq);
+        spin_lock_init(&cd->file_lock);
+        INIT_LIST_HEAD(&cd->file_list);
+        cd->card_state = GENWQE_CARD_UNUSED;
+        spin_lock_init(&cd->print_lock);
+        cd->ddcb_software_timeout = genwqe_ddcb_software_timeout;
+        cd->kill_timeout = genwqe_kill_timeout;
+        for (j = 0; j < GENWQE_MAX_VFS; j++)
+                cd->vf_jobtimeout_msec[j] = genwqe_vf_jobtimeout_msec;
+        genwqe_devices[i] = cd;
+        return cd;
+}
+static void genwqe_dev_free(struct genwqe_dev *cd)
+{
+        if (!cd)
+                return;
+        genwqe_devices[cd->card_idx] = NULL;
+        kfree(cd);
+}
+/**
+ * genwqe_bus_reset() - Card recovery
+ *
+ * pci_reset_function() will recover the device and ensure that the
+ * registers are accessible again when it completes with success. If
+ * not, the card will stay dead and registers will be unaccessible
+ * still.
+ */
+static int genwqe_bus_reset(struct genwqe_dev *cd)
+{
+        int bars, rc = 0;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        void __iomem *mmio;
+        if (cd->err_inject & GENWQE_INJECT_BUS_RESET_FAILURE)
+                return -EIO;
+        mmio = cd->mmio;
+        cd->mmio = NULL;
+        pci_iounmap(pci_dev, mmio);
+        bars = pci_select_bars(pci_dev, IORESOURCE_MEM);
+        pci_release_selected_regions(pci_dev, bars);
+        /*
+         * Firmware/BIOS might change memory mapping during bus reset.
+         * Settings like enable bus-mastering, ... are backuped and
+         * restored by the pci_reset_function().
+         */
+        dev_dbg(&pci_dev->dev, "[%s] pci_reset function ...\n", __func__);
+        rc = pci_reset_function(pci_dev);
+        if (rc) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: failed reset func (rc %d)\n", __func__, rc);
+                return rc;
+        }
+        dev_dbg(&pci_dev->dev, "[%s] done with rc=%d\n", __func__, rc);
+        /*
+         * Here is the right spot to clear the register read
+         * failure. pci_bus_reset() does this job in real systems.
+         */
+        cd->err_inject &= ~(GENWQE_INJECT_HARDWARE_FAILURE |
+                            GENWQE_INJECT_GFIR_FATAL |
+                            GENWQE_INJECT_GFIR_INFO);
+        rc = pci_request_selected_regions(pci_dev, bars, genwqe_driver_name);
+        if (rc) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: request bars failed (%d)\n", __func__, rc);
+                return -EIO;
+        }
+        cd->mmio = pci_iomap(pci_dev, 0, 0);
+        if (cd->mmio == NULL) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: mapping BAR0 failed\n", __func__);
+                return -ENOMEM;
+        }
+        return 0;
+}
+/*
+ * Hardware circumvention section. Certain bitstreams in our test-lab
+ * had different kinds of problems. Here is where we adjust those
+ * bitstreams to function will with this version of our device driver.
+ *
+ * Thise circumventions are applied to the physical function only.
+ * The magical numbers below are identifying development/manufacturing
+ * versions of the bitstream used on the card.
+ *
+ * Turn off error reporting for old/manufacturing images.
+ */
+bool genwqe_need_err_masking(struct genwqe_dev *cd)
+{
+        return (cd->slu_unitcfg & 0xFFFF0ull) < 0x32170ull;
+}
+static void genwqe_tweak_hardware(struct genwqe_dev *cd)
+{
+        struct pci_dev *pci_dev = cd->pci_dev;
+        /* Mask FIRs for development images */
+        if (((cd->slu_unitcfg & 0xFFFF0ull) >= 0x32000ull) &&
+            ((cd->slu_unitcfg & 0xFFFF0ull) <= 0x33250ull)) {
+                dev_warn(&pci_dev->dev,
+                         "FIRs masked due to bitstream %016llx.%016llx\n",
+                         cd->slu_unitcfg, cd->app_unitcfg);
+                __genwqe_writeq(cd, IO_APP_SEC_LEM_DEBUG_OVR,
+                                0xFFFFFFFFFFFFFFFFull);
+                __genwqe_writeq(cd, IO_APP_ERR_ACT_MASK,
+                                0x0000000000000000ull);
+        }
+}
+/**
+ * genwqe_recovery_on_fatal_gfir_required() - Version depended actions
+ *
+ * Bitstreams older than 2013-02-17 have a bug where fatal GFIRs must
+ * be ignored. This is e.g. true for the bitstream we gave to the card
+ * manufacturer, but also for some old bitstreams we released to our
+ * test-lab.
+ */
+int genwqe_recovery_on_fatal_gfir_required(struct genwqe_dev *cd)
+{
+        return (cd->slu_unitcfg & 0xFFFF0ull) >= 0x32170ull;
+}
+int genwqe_flash_readback_fails(struct genwqe_dev *cd)
+{
+        return (cd->slu_unitcfg & 0xFFFF0ull) < 0x32170ull;
+}
+/**
+ * genwqe_T_psec() - Calculate PF/VF timeout register content
+ *
+ * Note: From a design perspective it turned out to be a bad idea to
+ * use codes here to specifiy the frequency/speed values. An old
+ * driver cannot understand new codes and is therefore always a
+ * problem. Better is to measure out the value or put the
+ * speed/frequency directly into a register which is always a valid
+ * value for old as well as for new software.
+ */
+/* T = 1/f */
+static int genwqe_T_psec(struct genwqe_dev *cd)
+{
+        u16 speed;      /* 1/f -> 250,  200,  166,  175 */
+        static const int T[] = { 4000, 5000, 6000, 5714 };
+        speed = (u16)((cd->slu_unitcfg >> 28) & 0x0full);
+        if (speed >= ARRAY_SIZE(T))
+                return -1;      /* illegal value */
+        return T[speed];
+}
+/**
+ * genwqe_setup_pf_jtimer() - Setup PF hardware timeouts for DDCB execution
+ *
+ * Do this _after_ card_reset() is called. Otherwise the values will
+ * vanish. The settings need to be done when the queues are inactive.
+ *
+ * The max. timeout value is 2^(10+x) * T (6ns for 166MHz) * 15/16.
+ * The min. timeout value is 2^(10+x) * T (6ns for 166MHz) * 14/16.
+ */
+static bool genwqe_setup_pf_jtimer(struct genwqe_dev *cd)
+{
+        u32 T = genwqe_T_psec(cd);
+        u64 x;
+        if (genwqe_pf_jobtimeout_msec == 0)
+                return false;
+        /* PF: large value needed, flash update 2sec per block */
+        x = ilog2(genwqe_pf_jobtimeout_msec *
+                  16000000000uL/(T * 15)) - 10;
+        genwqe_write_vreg(cd, IO_SLC_VF_APPJOB_TIMEOUT,
+                          0xff00 | (x & 0xff), 0);
+        return true;
+}
+/**
+ * genwqe_setup_vf_jtimer() - Setup VF hardware timeouts for DDCB execution
+ */
+static bool genwqe_setup_vf_jtimer(struct genwqe_dev *cd)
+{
+        struct pci_dev *pci_dev = cd->pci_dev;
+        unsigned int vf;
+        u32 T = genwqe_T_psec(cd);
+        u64 x;
+        for (vf = 0; vf < pci_sriov_get_totalvfs(pci_dev); vf++) {
+                if (cd->vf_jobtimeout_msec[vf] == 0)
+                        continue;
+                x = ilog2(cd->vf_jobtimeout_msec[vf] *
+                          16000000000uL/(T * 15)) - 10;
+                genwqe_write_vreg(cd, IO_SLC_VF_APPJOB_TIMEOUT,
+                                  0xff00 | (x & 0xff), vf + 1);
+        }
+        return true;
+}
+static int genwqe_ffdc_buffs_alloc(struct genwqe_dev *cd)
+{
+        unsigned int type, e = 0;
+        for (type = 0; type < GENWQE_DBG_UNITS; type++) {
+                switch (type) {
+                case GENWQE_DBG_UNIT0:
+                        e = genwqe_ffdc_buff_size(cd, 0);
+                        break;
+                case GENWQE_DBG_UNIT1:
+                        e = genwqe_ffdc_buff_size(cd, 1);
+                        break;
+                case GENWQE_DBG_UNIT2:
+                        e = genwqe_ffdc_buff_size(cd, 2);
+                        break;
+                case GENWQE_DBG_REGS:
+                        e = GENWQE_FFDC_REGS;
+                        break;
+                }
+                /* currently support only the debug units mentioned here */
+                cd->ffdc[type].entries = e;
+                cd->ffdc[type].regs = kmalloc(e * sizeof(struct genwqe_reg),
+                                              GFP_KERNEL);
+                /*
+                 * regs == NULL is ok, the using code treats this as no regs,
+                 * Printing warning is ok in this case.
+                 */
+        }
+        return 0;
+}
+static void genwqe_ffdc_buffs_free(struct genwqe_dev *cd)
+{
+        unsigned int type;
+        for (type = 0; type < GENWQE_DBG_UNITS; type++) {
+                kfree(cd->ffdc[type].regs);
+                cd->ffdc[type].regs = NULL;
+        }
+}
+static int genwqe_read_ids(struct genwqe_dev *cd)
+{
+        int err = 0;
+        int slu_id;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        cd->slu_unitcfg = __genwqe_readq(cd, IO_SLU_UNITCFG);
+        if (cd->slu_unitcfg == IO_ILLEGAL_VALUE) {
+                dev_err(&pci_dev->dev,
+                        "err: SLUID=%016llx\n", cd->slu_unitcfg);
+                err = -EIO;
+                goto out_err;
+        }
+        slu_id = genwqe_get_slu_id(cd);
+        if (slu_id < GENWQE_SLU_ARCH_REQ || slu_id == 0xff) {
+                dev_err(&pci_dev->dev,
+                        "err: incompatible SLU Architecture %u\n", slu_id);
+                err = -ENOENT;
+                goto out_err;
+        }
+        cd->app_unitcfg = __genwqe_readq(cd, IO_APP_UNITCFG);
+        if (cd->app_unitcfg == IO_ILLEGAL_VALUE) {
+                dev_err(&pci_dev->dev,
+                        "err: APPID=%016llx\n", cd->app_unitcfg);
+                err = -EIO;
+                goto out_err;
+        }
+        genwqe_read_app_id(cd, cd->app_name, sizeof(cd->app_name));
+        /*
+         * Is access to all registers possible? If we are a VF the
+         * answer is obvious. If we run fully virtualized, we need to
+         * check if we can access all registers. If we do not have
+         * full access we will cause an UR and some informational FIRs
+         * in the PF, but that should not harm.
+         */
+        if (pci_dev->is_virtfn)
+                cd->is_privileged = 0;
+        else
+                cd->is_privileged = (__genwqe_readq(cd, IO_SLU_BITSTREAM)
+                                     != IO_ILLEGAL_VALUE);
+ out_err:
+        return err;
+}
+static int genwqe_start(struct genwqe_dev *cd)
+{
+        int err;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        err = genwqe_read_ids(cd);
+        if (err)
+                return err;
+        if (genwqe_is_privileged(cd)) {
+                /* do this after the tweaks. alloc fail is acceptable */
+                genwqe_ffdc_buffs_alloc(cd);
+                genwqe_stop_traps(cd);
+                /* Collect registers e.g. FIRs, UNITIDs, traces ... */
+                genwqe_read_ffdc_regs(cd, cd->ffdc[GENWQE_DBG_REGS].regs,
+                                      cd->ffdc[GENWQE_DBG_REGS].entries, 0);
+                genwqe_ffdc_buff_read(cd, GENWQE_DBG_UNIT0,
+                                      cd->ffdc[GENWQE_DBG_UNIT0].regs,
+                                      cd->ffdc[GENWQE_DBG_UNIT0].entries);
+                genwqe_ffdc_buff_read(cd, GENWQE_DBG_UNIT1,
+                                      cd->ffdc[GENWQE_DBG_UNIT1].regs,
+                                      cd->ffdc[GENWQE_DBG_UNIT1].entries);
+                genwqe_ffdc_buff_read(cd, GENWQE_DBG_UNIT2,
+                                      cd->ffdc[GENWQE_DBG_UNIT2].regs,
+                                      cd->ffdc[GENWQE_DBG_UNIT2].entries);
+                genwqe_start_traps(cd);
+                if (cd->card_state == GENWQE_CARD_FATAL_ERROR) {
+                        dev_warn(&pci_dev->dev,
+                                 "[%s] chip reload/recovery!\n", __func__);
+                        /*
+                         * Stealth Mode: Reload chip on either hot
+                         * reset or PERST.
+                         */
+                        cd->softreset = 0x7Cull;
+                        __genwqe_writeq(cd, IO_SLC_CFGREG_SOFTRESET,
+                                       cd->softreset);
+                        err = genwqe_bus_reset(cd);
+                        if (err != 0) {
+                                dev_err(&pci_dev->dev,
+                                        "[%s] err: bus reset failed!\n",
+                                        __func__);
+                                goto out;
+                        }
+                        /*
+                         * Re-read the IDs because
+                         * it could happen that the bitstream load
+                         * failed!
+                         */
+                        err = genwqe_read_ids(cd);
+                        if (err)
+                                goto out;
+                }
+        }
+        err = genwqe_setup_service_layer(cd);  /* does a reset to the card */
+        if (err != 0) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: could not setup servicelayer!\n", __func__);
+                err = -ENODEV;
+                goto out;
+        }
+        if (genwqe_is_privileged(cd)) {  /* code is running _after_ reset */
+                genwqe_tweak_hardware(cd);
+                genwqe_setup_pf_jtimer(cd);
+                genwqe_setup_vf_jtimer(cd);
+        }
+        err = genwqe_device_create(cd);
+        if (err < 0) {
+                dev_err(&pci_dev->dev,
+                        "err: chdev init failed! (err=%d)\n", err);
+                goto out_release_service_layer;
+        }
+        return 0;
+ out_release_service_layer:
+        genwqe_release_service_layer(cd);
+ out:
+        if (genwqe_is_privileged(cd))
+                genwqe_ffdc_buffs_free(cd);
+        return -EIO;
+}
+/**
+ * genwqe_stop() - Stop card operation
+ *
+ * Recovery notes:
+ *   As long as genwqe_thread runs we might access registers during
+ *   error data capture. Same is with the genwqe_health_thread.
+ *   When genwqe_bus_reset() fails this function might called two times:
+ *   first by the genwqe_health_thread() and later by genwqe_remove() to
+ *   unbind the device. We must be able to survive that.
+ *
+ * This function must be robust enough to be called twice.
+ */
+static int genwqe_stop(struct genwqe_dev *cd)
+{
+        genwqe_finish_queue(cd);            /* no register access */
+        genwqe_device_remove(cd);           /* device removed, procs killed */
+        genwqe_release_service_layer(cd);   /* here genwqe_thread is stopped */
+        if (genwqe_is_privileged(cd)) {
+                pci_disable_sriov(cd->pci_dev); /* access pci config space */
+                genwqe_ffdc_buffs_free(cd);
+        }
+        return 0;
+}
+/**
+ * genwqe_recover_card() - Try to recover the card if it is possible
+ *
+ * If fatal_err is set no register access is possible anymore. It is
+ * likely that genwqe_start fails in that situation. Proper error
+ * handling is required in this case.
+ *
+ * genwqe_bus_reset() will cause the pci code to call genwqe_remove()
+ * and later genwqe_probe() for all virtual functions.
+ */
+static int genwqe_recover_card(struct genwqe_dev *cd, int fatal_err)
+{
+        int rc;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        genwqe_stop(cd);
+        /*
+         * Make sure chip is not reloaded to maintain FFDC. Write SLU
+         * Reset Register, CPLDReset field to 0.
+         */
+        if (!fatal_err) {
+                cd->softreset = 0x70ull;
+                __genwqe_writeq(cd, IO_SLC_CFGREG_SOFTRESET, cd->softreset);
+        }
+        rc = genwqe_bus_reset(cd);
+        if (rc != 0) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: card recovery impossible!\n", __func__);
+                return rc;
+        }
+        rc = genwqe_start(cd);
+        if (rc < 0) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: failed to launch device!\n", __func__);
+                return rc;
+        }
+        return 0;
+}
+static int genwqe_health_check_cond(struct genwqe_dev *cd, u64 *gfir)
+{
+        *gfir = __genwqe_readq(cd, IO_SLC_CFGREG_GFIR);
+        return (*gfir & GFIR_ERR_TRIGGER) &&
+                genwqe_recovery_on_fatal_gfir_required(cd);
+}
+/**
+ * genwqe_fir_checking() - Check the fault isolation registers of the card
+ *
+ * If this code works ok, can be tried out with help of the genwqe_poke tool:
+ *   sudo ./tools/genwqe_poke 0x8 0xfefefefefef
+ *
+ * Now the relevant FIRs/sFIRs should be printed out and the driver should
+ * invoke recovery (devices are removed and readded).
+ */
+static u64 genwqe_fir_checking(struct genwqe_dev *cd)
+{
+        int j, iterations = 0;
+        u64 mask, fir, fec, uid, gfir, gfir_masked, sfir, sfec;
+        u32 fir_addr, fir_clr_addr, fec_addr, sfir_addr, sfec_addr;
+        struct pci_dev *pci_dev = cd->pci_dev;
+ healthMonitor:
+        iterations++;
+        if (iterations > 16) {
+                dev_err(&pci_dev->dev, "* exit looping after %d times\n",
+                        iterations);
+                goto fatal_error;
+        }
+        gfir = __genwqe_readq(cd, IO_SLC_CFGREG_GFIR);
+        if (gfir != 0x0)
+                dev_err(&pci_dev->dev, "* 0x%08x 0x%016llx\n",
+                                    IO_SLC_CFGREG_GFIR, gfir);
+        if (gfir == IO_ILLEGAL_VALUE)
+                goto fatal_error;
+        /*
+         * Avoid printing when to GFIR bit is on prevents contignous
+         * printout e.g. for the following bug:
+         *   FIR set without a 2ndary FIR/FIR cannot be cleared
+         * Comment out the following if to get the prints:
+         */
+        if (gfir == 0)
+                return 0;
+        gfir_masked = gfir & GFIR_ERR_TRIGGER;  /* fatal errors */
+        for (uid = 0; uid < GENWQE_MAX_UNITS; uid++) { /* 0..2 in zEDC */
+                /* read the primary FIR (pfir) */
+                fir_addr = (uid << 24) + 0x08;
+                fir = __genwqe_readq(cd, fir_addr);
+                if (fir == 0x0)
+                        continue;  /* no error in this unit */
+                dev_err(&pci_dev->dev, "* 0x%08x 0x%016llx\n", fir_addr, fir);
+                if (fir == IO_ILLEGAL_VALUE)
+                        goto fatal_error;
+                /* read primary FEC */
+                fec_addr = (uid << 24) + 0x18;
+                fec = __genwqe_readq(cd, fec_addr);
+                dev_err(&pci_dev->dev, "* 0x%08x 0x%016llx\n", fec_addr, fec);
+                if (fec == IO_ILLEGAL_VALUE)
+                        goto fatal_error;
+                for (j = 0, mask = 1ULL; j < 64; j++, mask <<= 1) {
+                        /* secondary fir empty, skip it */
+                        if ((fir & mask) == 0x0)
+                                continue;
+                        sfir_addr = (uid << 24) + 0x100 + 0x08 * j;
+                        sfir = __genwqe_readq(cd, sfir_addr);
+                        if (sfir == IO_ILLEGAL_VALUE)
+                                goto fatal_error;
+                        dev_err(&pci_dev->dev,
+                                "* 0x%08x 0x%016llx\n", sfir_addr, sfir);
+                        sfec_addr = (uid << 24) + 0x300 + 0x08 * j;
+                        sfec = __genwqe_readq(cd, sfec_addr);
+                        if (sfec == IO_ILLEGAL_VALUE)
+                                goto fatal_error;
+                        dev_err(&pci_dev->dev,
+                                "* 0x%08x 0x%016llx\n", sfec_addr, sfec);
+                        gfir = __genwqe_readq(cd, IO_SLC_CFGREG_GFIR);
+                        if (gfir == IO_ILLEGAL_VALUE)
+                                goto fatal_error;
+                        /* gfir turned on during routine! get out and
+                           start over. */
+                        if ((gfir_masked == 0x0) &&
+                            (gfir & GFIR_ERR_TRIGGER)) {
+                                goto healthMonitor;
+                        }
+                        /* do not clear if we entered with a fatal gfir */
+                        if (gfir_masked == 0x0) {
+                                /* NEW clear by mask the logged bits */
+                                sfir_addr = (uid << 24) + 0x100 + 0x08 * j;
+                                __genwqe_writeq(cd, sfir_addr, sfir);
+                                dev_dbg(&pci_dev->dev,
+                                        "[HM] Clearing  2ndary FIR 0x%08x "
+                                        "with 0x%016llx\n", sfir_addr, sfir);
+                                /*
+                                 * note, these cannot be error-Firs
+                                 * since gfir_masked is 0 after sfir
+                                 * was read. Also, it is safe to do
+                                 * this write if sfir=0. Still need to
+                                 * clear the primary. This just means
+                                 * there is no secondary FIR.
+                                 */
+                                /* clear by mask the logged bit. */
+                                fir_clr_addr = (uid << 24) + 0x10;
+                                __genwqe_writeq(cd, fir_clr_addr, mask);
+                                dev_dbg(&pci_dev->dev,
+                                        "[HM] Clearing primary FIR 0x%08x "
+                                        "with 0x%016llx\n", fir_clr_addr,
+                                        mask);
+                        }
+                }
+        }
+        gfir = __genwqe_readq(cd, IO_SLC_CFGREG_GFIR);
+        if (gfir == IO_ILLEGAL_VALUE)
+                goto fatal_error;
+        if ((gfir_masked == 0x0) && (gfir & GFIR_ERR_TRIGGER)) {
+                /*
+                 * Check once more that it didn't go on after all the
+                 * FIRS were cleared.
+                 */
+                dev_dbg(&pci_dev->dev, "ACK! Another FIR! Recursing %d!\n",
+                        iterations);
+                goto healthMonitor;
+        }
+        return gfir_masked;
+ fatal_error:
+        return IO_ILLEGAL_VALUE;
+}
+/**
+ * genwqe_health_thread() - Health checking thread
+ *
+ * This thread is only started for the PF of the card.
+ *
+ * This thread monitors the health of the card. A critical situation
+ * is when we read registers which contain -1 (IO_ILLEGAL_VALUE). In
+ * this case we need to be recovered from outside. Writing to
+ * registers will very likely not work either.
+ *
+ * This thread must only exit if kthread_should_stop() becomes true.
+ *
+ * Condition for the health-thread to trigger:
+ *   a) when a kthread_stop() request comes in or
+ *   b) a critical GFIR occured
+ *
+ * Informational GFIRs are checked and potentially printed in
+ * health_check_interval seconds.
+ */
+static int genwqe_health_thread(void *data)
+{
+        int rc, should_stop = 0;
+        struct genwqe_dev *cd = data;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        u64 gfir, gfir_masked, slu_unitcfg, app_unitcfg;
+        while (!kthread_should_stop()) {
+                rc = wait_event_interruptible_timeout(cd->health_waitq,
+                         (genwqe_health_check_cond(cd, &gfir) ||
+                          (should_stop = kthread_should_stop())),
+                                genwqe_health_check_interval * HZ);
+                if (should_stop)
+                        break;
+                if (gfir == IO_ILLEGAL_VALUE) {
+                        dev_err(&pci_dev->dev,
+                                "[%s] GFIR=%016llx\n", __func__, gfir);
+                        goto fatal_error;
+                }
+                slu_unitcfg = __genwqe_readq(cd, IO_SLU_UNITCFG);
+                if (slu_unitcfg == IO_ILLEGAL_VALUE) {
+                        dev_err(&pci_dev->dev,
+                                "[%s] SLU_UNITCFG=%016llx\n",
+                                __func__, slu_unitcfg);
+                        goto fatal_error;
+                }
+                app_unitcfg = __genwqe_readq(cd, IO_APP_UNITCFG);
+                if (app_unitcfg == IO_ILLEGAL_VALUE) {
+                        dev_err(&pci_dev->dev,
+                                "[%s] APP_UNITCFG=%016llx\n",
+                                __func__, app_unitcfg);
+                        goto fatal_error;
+                }
+                gfir = __genwqe_readq(cd, IO_SLC_CFGREG_GFIR);
+                if (gfir == IO_ILLEGAL_VALUE) {
+                        dev_err(&pci_dev->dev,
+                                "[%s] %s: GFIR=%016llx\n", __func__,
+                                (gfir & GFIR_ERR_TRIGGER) ? "err" : "info",
+                                gfir);
+                        goto fatal_error;
+                }
+                gfir_masked = genwqe_fir_checking(cd);
+                if (gfir_masked == IO_ILLEGAL_VALUE)
+                        goto fatal_error;
+                /*
+                 * GFIR ErrorTrigger bits set => reset the card!
+                 * Never do this for old/manufacturing images!
+                 */
+                if ((gfir_masked) && !cd->skip_recovery &&
+                    genwqe_recovery_on_fatal_gfir_required(cd)) {
+                        cd->card_state = GENWQE_CARD_FATAL_ERROR;
+                        rc = genwqe_recover_card(cd, 0);
+                        if (rc < 0) {
+                                /* FIXME Card is unusable and needs unbind! */
+                                goto fatal_error;
+                        }
+                }
+                cd->last_gfir = gfir;
+                cond_resched();
+        }
+        return 0;
+ fatal_error:
+        dev_err(&pci_dev->dev,
+                "[%s] card unusable. Please trigger unbind!\n", __func__);
+        /* Bring down logical devices to inform user space via udev remove. */
+        cd->card_state = GENWQE_CARD_FATAL_ERROR;
+        genwqe_stop(cd);
+        /* genwqe_bus_reset failed(). Now wait for genwqe_remove(). */
+        while (!kthread_should_stop())
+                cond_resched();
+        return -EIO;
+}
+static int genwqe_health_check_start(struct genwqe_dev *cd)
+{
+        int rc;
+        if (genwqe_health_check_interval <= 0)
+                return 0;       /* valid for disabling the service */
+        /* moved before request_irq() */
+        /* init_waitqueue_head(&cd->health_waitq); */
+        cd->health_thread = kthread_run(genwqe_health_thread, cd,
+                                        GENWQE_DEVNAME "%d_health",
+                                        cd->card_idx);
+        if (IS_ERR(cd->health_thread)) {
+                rc = PTR_ERR(cd->health_thread);
+                cd->health_thread = NULL;
+                return rc;
+        }
+        return 0;
+}
+static int genwqe_health_thread_running(struct genwqe_dev *cd)
+{
+        return cd->health_thread != NULL;
+}
+static int genwqe_health_check_stop(struct genwqe_dev *cd)
+{
+        int rc;
+        if (!genwqe_health_thread_running(cd))
+                return -EIO;
+        rc = kthread_stop(cd->health_thread);
+        cd->health_thread = NULL;
+        return 0;
+}
+/**
+ * genwqe_pci_setup() - Allocate PCIe related resources for our card
+ */
+static int genwqe_pci_setup(struct genwqe_dev *cd)
+{
+        int err, bars;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        bars = pci_select_bars(pci_dev, IORESOURCE_MEM);
+        err = pci_enable_device_mem(pci_dev);
+        if (err) {
+                dev_err(&pci_dev->dev,
+                        "err: failed to enable pci memory (err=%d)\n", err);
+                goto err_out;
+        }
+        /* Reserve PCI I/O and memory resources */
+        err = pci_request_selected_regions(pci_dev, bars, genwqe_driver_name);
+        if (err) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: request bars failed (%d)\n", __func__, err);
+                err = -EIO;
+                goto err_disable_device;
+        }
+        /* check for 64-bit DMA address supported (DAC) */
+        if (!pci_set_dma_mask(pci_dev, DMA_BIT_MASK(64))) {
+                err = pci_set_consistent_dma_mask(pci_dev, DMA_BIT_MASK(64));
+                if (err) {
+                        dev_err(&pci_dev->dev,
+                                "err: DMA64 consistent mask error\n");
+                        err = -EIO;
+                        goto out_release_resources;
+                }
+        /* check for 32-bit DMA address supported (SAC) */
+        } else if (!pci_set_dma_mask(pci_dev, DMA_BIT_MASK(32))) {
+                err = pci_set_consistent_dma_mask(pci_dev, DMA_BIT_MASK(32));
+                if (err) {
+                        dev_err(&pci_dev->dev,
+                                "err: DMA32 consistent mask error\n");
+                        err = -EIO;
+                        goto out_release_resources;
+                }
+        } else {
+                dev_err(&pci_dev->dev,
+                        "err: neither DMA32 nor DMA64 supported\n");
+                err = -EIO;
+                goto out_release_resources;
+        }
+        pci_set_master(pci_dev);
+        pci_enable_pcie_error_reporting(pci_dev);
+        /* request complete BAR-0 space (length = 0) */
+        cd->mmio_len = pci_resource_len(pci_dev, 0);
+        cd->mmio = pci_iomap(pci_dev, 0, 0);
+        if (cd->mmio == NULL) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: mapping BAR0 failed\n", __func__);
+                err = -ENOMEM;
+                goto out_release_resources;
+        }
+        cd->num_vfs = pci_sriov_get_totalvfs(pci_dev);
+        err = genwqe_read_ids(cd);
+        if (err)
+                goto out_iounmap;
+        return 0;
+ out_iounmap:
+        pci_iounmap(pci_dev, cd->mmio);
+ out_release_resources:
+        pci_release_selected_regions(pci_dev, bars);
+ err_disable_device:
+        pci_disable_device(pci_dev);
+ err_out:
+        return err;
+}
+/**
+ * genwqe_pci_remove() - Free PCIe related resources for our card
+ */
+static void genwqe_pci_remove(struct genwqe_dev *cd)
+{
+        int bars;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if (cd->mmio)
+                pci_iounmap(pci_dev, cd->mmio);
+        bars = pci_select_bars(pci_dev, IORESOURCE_MEM);
+        pci_release_selected_regions(pci_dev, bars);
+        pci_disable_device(pci_dev);
+}
+/**
+ * genwqe_probe() - Device initialization
+ * @pdev:       PCI device information struct
+ *
+ * Callable for multiple cards. This function is called on bind.
+ *
+ * Return: 0 if succeeded, < 0 when failed
+ */
+static int genwqe_probe(struct pci_dev *pci_dev,
+                        const struct pci_device_id *id)
+{
+        int err;
+        struct genwqe_dev *cd;
+        genwqe_init_crc32();
+        cd = genwqe_dev_alloc();
+        if (IS_ERR(cd)) {
+                dev_err(&pci_dev->dev, "err: could not alloc mem (err=%d)!\n",
+                        (int)PTR_ERR(cd));
+                return PTR_ERR(cd);
+        }
+        dev_set_drvdata(&pci_dev->dev, cd);
+        cd->pci_dev = pci_dev;
+        err = genwqe_pci_setup(cd);
+        if (err < 0) {
+                dev_err(&pci_dev->dev,
+                        "err: problems with PCI setup (err=%d)\n", err);
+                goto out_free_dev;
+        }
+        err = genwqe_start(cd);
+        if (err < 0) {
+                dev_err(&pci_dev->dev,
+                        "err: cannot start card services! (err=%d)\n", err);
+                goto out_pci_remove;
+        }
+        if (genwqe_is_privileged(cd)) {
+                err = genwqe_health_check_start(cd);
+                if (err < 0) {
+                        dev_err(&pci_dev->dev,
+                                "err: cannot start health checking! "
+                                "(err=%d)\n", err);
+                        goto out_stop_services;
+                }
+        }
+        return 0;
+ out_stop_services:
+        genwqe_stop(cd);
+ out_pci_remove:
+        genwqe_pci_remove(cd);
+ out_free_dev:
+        genwqe_dev_free(cd);
+        return err;
+}
+/**
+ * genwqe_remove() - Called when device is removed (hot-plugable)
+ *
+ * Or when driver is unloaded respecitively when unbind is done.
+ */
+static void genwqe_remove(struct pci_dev *pci_dev)
+{
+        struct genwqe_dev *cd = dev_get_drvdata(&pci_dev->dev);
+        genwqe_health_check_stop(cd);
+        /*
+         * genwqe_stop() must survive if it is called twice
+         * sequentially. This happens when the health thread calls it
+         * and fails on genwqe_bus_reset().
+         */
+        genwqe_stop(cd);
+        genwqe_pci_remove(cd);
+        genwqe_dev_free(cd);
+}
+/*
+ * genwqe_err_error_detected() - Error detection callback
+ *
+ * This callback is called by the PCI subsystem whenever a PCI bus
+ * error is detected.
+ */
+static pci_ers_result_t genwqe_err_error_detected(struct pci_dev *pci_dev,
+                                                 enum pci_channel_state state)
+{
+        struct genwqe_dev *cd;
+        dev_err(&pci_dev->dev, "[%s] state=%d\n", __func__, state);
+        if (pci_dev == NULL)
+                return PCI_ERS_RESULT_NEED_RESET;
+        cd = dev_get_drvdata(&pci_dev->dev);
+        if (cd == NULL)
+                return PCI_ERS_RESULT_NEED_RESET;
+        switch (state) {
+        case pci_channel_io_normal:
+                return PCI_ERS_RESULT_CAN_RECOVER;
+        case pci_channel_io_frozen:
+                return PCI_ERS_RESULT_NEED_RESET;
+        case pci_channel_io_perm_failure:
+                return PCI_ERS_RESULT_DISCONNECT;
+        }
+        return PCI_ERS_RESULT_NEED_RESET;
+}
+static pci_ers_result_t genwqe_err_result_none(struct pci_dev *dev)
+{
+        return PCI_ERS_RESULT_NONE;
+}
+static void genwqe_err_resume(struct pci_dev *dev)
+{
+}
+static int genwqe_sriov_configure(struct pci_dev *dev, int numvfs)
+{
+        struct genwqe_dev *cd = dev_get_drvdata(&dev->dev);
+        if (numvfs > 0) {
+                genwqe_setup_vf_jtimer(cd);
+                pci_enable_sriov(dev, numvfs);
+                return numvfs;
+        }
+        if (numvfs == 0) {
+                pci_disable_sriov(dev);
+                return 0;
+        }
+        return 0;
+}
+static struct pci_error_handlers genwqe_err_handler = {
+        .error_detected = genwqe_err_error_detected,
+        .mmio_enabled   = genwqe_err_result_none,
+        .link_reset     = genwqe_err_result_none,
+        .slot_reset     = genwqe_err_result_none,
+        .resume         = genwqe_err_resume,
+};
+static struct pci_driver genwqe_driver = {
+        .name     = genwqe_driver_name,
+        .id_table = genwqe_device_table,
+        .probe    = genwqe_probe,
+        .remove   = genwqe_remove,
+        .sriov_configure = genwqe_sriov_configure,
+        .err_handler = &genwqe_err_handler,
+};
+/**
+ * genwqe_init_module() - Driver registration and initialization
+ */
+static int __init genwqe_init_module(void)
+{
+        int rc;
+        class_genwqe = class_create(THIS_MODULE, GENWQE_DEVNAME);
+        if (IS_ERR(class_genwqe)) {
+                pr_err("[%s] create class failed\n", __func__);
+                return -ENOMEM;
+        }
+        debugfs_genwqe = debugfs_create_dir(GENWQE_DEVNAME, NULL);
+        if (!debugfs_genwqe) {
+                rc = -ENOMEM;
+                goto err_out;
+        }
+        rc = pci_register_driver(&genwqe_driver);
+        if (rc != 0) {
+                pr_err("[%s] pci_reg_driver (rc=%d)\n", __func__, rc);
+                goto err_out0;
+        }
+        return rc;
+ err_out0:
+        debugfs_remove(debugfs_genwqe);
+ err_out:
+        class_destroy(class_genwqe);
+        return rc;
+}
+/**
+ * genwqe_exit_module() - Driver exit
+ */
+static void __exit genwqe_exit_module(void)
+{
+        pci_unregister_driver(&genwqe_driver);
+        debugfs_remove(debugfs_genwqe);
+        class_destroy(class_genwqe);
+}
+module_init(genwqe_init_module);
+module_exit(genwqe_exit_module);
diff --git a/drivers/misc/genwqe/card_base.h b/drivers/misc/genwqe/card_base.h
new file mode 100644
index 000000000000..5e4dbd21f89a
--- /dev/null
+++ b/drivers/misc/genwqe/card_base.h
@@ -0,0 +1,557 @@
+#ifndef __CARD_BASE_H__
+#define __CARD_BASE_H__
+/**
+ * IBM Accelerator Family 'GenWQE'
+ *
+ * (C) Copyright IBM Corp. 2013
+ *
+ * Author: Frank Haverkamp <haver@linux.vnet.ibm.com>
+ * Author: Joerg-Stephan Vogt <jsvogt@de.ibm.com>
+ * Author: Michael Jung <mijung@de.ibm.com>
+ * Author: Michael Ruettger <michael@ibmra.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (version 2 only)
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+/*
+ * Interfaces within the GenWQE module. Defines genwqe_card and
+ * ddcb_queue as well as ddcb_requ.
+ */
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/cdev.h>
+#include <linux/stringify.h>
+#include <linux/pci.h>
+#include <linux/semaphore.h>
+#include <linux/uaccess.h>
+#include <linux/io.h>
+#include <linux/version.h>
+#include <linux/debugfs.h>
+#include <linux/slab.h>
+#include <linux/genwqe/genwqe_card.h>
+#include "genwqe_driver.h"
+#define GENWQE_MSI_IRQS                 4  /* Just one supported, no MSIx */
+#define GENWQE_FLAG_MSI_ENABLED         (1 << 0)
+#define GENWQE_MAX_VFS                  15 /* maximum 15 VFs are possible */
+#define GENWQE_MAX_FUNCS                16 /* 1 PF and 15 VFs */
+#define GENWQE_CARD_NO_MAX              (16 * GENWQE_MAX_FUNCS)
+/* Compile parameters, some of them appear in debugfs for later adjustment */
+#define genwqe_ddcb_max                 32 /* DDCBs on the work-queue */
+#define genwqe_polling_enabled          0  /* in case of irqs not working */
+#define genwqe_ddcb_software_timeout    10 /* timeout per DDCB in seconds */
+#define genwqe_kill_timeout             8  /* time until process gets killed */
+#define genwqe_vf_jobtimeout_msec       250  /* 250 msec */
+#define genwqe_pf_jobtimeout_msec       8000 /* 8 sec should be ok */
+#define genwqe_health_check_interval    4 /* <= 0: disabled */
+/* Sysfs attribute groups used when we create the genwqe device */
+extern const struct attribute_group *genwqe_attribute_groups[];
+/*
+ * Config space for Genwqe5 A7:
+ * 00:[14 10 4b 04]40 00 10 00[00 00 00 12]00 00 00 00
+ * 10: 0c 00 00 f0 07 3c 00 00 00 00 00 00 00 00 00 00
+ * 20: 00 00 00 00 00 00 00 00 00 00 00 00[14 10 4b 04]
+ * 30: 00 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00
+ */
+#define PCI_DEVICE_GENWQE               0x044b /* Genwqe DeviceID */
+#define PCI_SUBSYSTEM_ID_GENWQE5        0x035f /* Genwqe A5 Subsystem-ID */
+#define PCI_SUBSYSTEM_ID_GENWQE5_NEW    0x044b /* Genwqe A5 Subsystem-ID */
+#define PCI_CLASSCODE_GENWQE5           0x1200 /* UNKNOWN */
+#define PCI_SUBVENDOR_ID_IBM_SRIOV      0x0000
+#define PCI_SUBSYSTEM_ID_GENWQE5_SRIOV  0x0000 /* Genwqe A5 Subsystem-ID */
+#define PCI_CLASSCODE_GENWQE5_SRIOV     0x1200 /* UNKNOWN */
+#define GENWQE_SLU_ARCH_REQ             2 /* Required SLU architecture level */
+/**
+ * struct genwqe_reg - Genwqe data dump functionality
+ */
+struct genwqe_reg {
+        u32 addr;
+        u32 idx;
+        u64 val;
+};
+/*
+ * enum genwqe_dbg_type - Specify chip unit to dump/debug
+ */
+enum genwqe_dbg_type {
+        GENWQE_DBG_UNIT0 = 0,  /* captured before prev errs cleared */
+        GENWQE_DBG_UNIT1 = 1,
+        GENWQE_DBG_UNIT2 = 2,
+        GENWQE_DBG_UNIT3 = 3,
+        GENWQE_DBG_UNIT4 = 4,
+        GENWQE_DBG_UNIT5 = 5,
+        GENWQE_DBG_UNIT6 = 6,
+        GENWQE_DBG_UNIT7 = 7,
+        GENWQE_DBG_REGS  = 8,
+        GENWQE_DBG_DMA   = 9,
+        GENWQE_DBG_UNITS = 10, /* max number of possible debug units  */
+};
+/* Software error injection to simulate card failures */
+#define GENWQE_INJECT_HARDWARE_FAILURE  0x00000001 /* injects -1 reg reads */
+#define GENWQE_INJECT_BUS_RESET_FAILURE 0x00000002 /* pci_bus_reset fail */
+#define GENWQE_INJECT_GFIR_FATAL        0x00000004 /* GFIR = 0x0000ffff */
+#define GENWQE_INJECT_GFIR_INFO         0x00000008 /* GFIR = 0xffff0000 */
+/*
+ * Genwqe card description and management data.
+ *
+ * Error-handling in case of card malfunction
+ * ------------------------------------------
+ *
+ * If the card is detected to be defective the outside environment
+ * will cause the PCI layer to call deinit (the cleanup function for
+ * probe). This is the same effect like doing a unbind/bind operation
+ * on the card.
+ *
+ * The genwqe card driver implements a health checking thread which
+ * verifies the card function. If this detects a problem the cards
+ * device is being shutdown and restarted again, along with a reset of
+ * the card and queue.
+ *
+ * All functions accessing the card device return either -EIO or -ENODEV
+ * code to indicate the malfunction to the user. The user has to close
+ * the file descriptor and open a new one, once the card becomes
+ * available again.
+ *
+ * If the open file descriptor is setup to receive SIGIO, the signal is
+ * genereated for the application which has to provide a handler to
+ * react on it. If the application does not close the open
+ * file descriptor a SIGKILL is send to enforce freeing the cards
+ * resources.
+ *
+ * I did not find a different way to prevent kernel problems due to
+ * reference counters for the cards character devices getting out of
+ * sync. The character device deallocation does not block, even if
+ * there is still an open file descriptor pending. If this pending
+ * descriptor is closed, the data structures used by the character
+ * device is reinstantiated, which will lead to the reference counter
+ * dropping below the allowed values.
+ *
+ * Card recovery
+ * -------------
+ *
+ * To test the internal driver recovery the following command can be used:
+ *   sudo sh -c 'echo 0xfffff > /sys/class/genwqe/genwqe0_card/err_inject'
+ */
+/**
+ * struct dma_mapping_type - Mapping type definition
+ *
+ * To avoid memcpying data arround we use user memory directly. To do
+ * this we need to pin/swap-in the memory and request a DMA address
+ * for it.
+ */
+enum dma_mapping_type {
+        GENWQE_MAPPING_RAW = 0,         /* contignous memory buffer */
+        GENWQE_MAPPING_SGL_TEMP,        /* sglist dynamically used */
+        GENWQE_MAPPING_SGL_PINNED,      /* sglist used with pinning */
+};
+/**
+ * struct dma_mapping - Information about memory mappings done by the driver
+ */
+struct dma_mapping {
+        enum dma_mapping_type type;
+        void *u_vaddr;                  /* user-space vaddr/non-aligned */
+        void *k_vaddr;                  /* kernel-space vaddr/non-aligned */
+        dma_addr_t dma_addr;            /* physical DMA address */
+        struct page **page_list;        /* list of pages used by user buff */
+        dma_addr_t *dma_list;           /* list of dma addresses per page */
+        unsigned int nr_pages;          /* number of pages */
+        unsigned int size;              /* size in bytes */
+        struct list_head card_list;     /* list of usr_maps for card */
+        struct list_head pin_list;      /* list of pinned memory for dev */
+};
+static inline void genwqe_mapping_init(struct dma_mapping *m,
+                                       enum dma_mapping_type type)
+{
+        memset(m, 0, sizeof(*m));
+        m->type = type;
+}
+/**
+ * struct ddcb_queue - DDCB queue data
+ * @ddcb_max:          Number of DDCBs on the queue
+ * @ddcb_next:         Next free DDCB
+ * @ddcb_act:          Next DDCB supposed to finish
+ * @ddcb_seq:          Sequence number of last DDCB
+ * @ddcbs_in_flight:   Currently enqueued DDCBs
+ * @ddcbs_completed:   Number of already completed DDCBs
+ * @busy:              Number of -EBUSY returns
+ * @ddcb_daddr:        DMA address of first DDCB in the queue
+ * @ddcb_vaddr:        Kernel virtual address of first DDCB in the queue
+ * @ddcb_req:          Associated requests (one per DDCB)
+ * @ddcb_waitqs:       Associated wait queues (one per DDCB)
+ * @ddcb_lock:         Lock to protect queuing operations
+ * @ddcb_waitq:        Wait on next DDCB finishing
+ */
+struct ddcb_queue {
+        int ddcb_max;                   /* amount of DDCBs  */
+        int ddcb_next;                  /* next available DDCB num */
+        int ddcb_act;                   /* DDCB to be processed */
+        u16 ddcb_seq;                   /* slc seq num */
+        unsigned int ddcbs_in_flight;   /* number of ddcbs in processing */
+        unsigned int ddcbs_completed;
+        unsigned int ddcbs_max_in_flight;
+        unsigned int busy;              /* how many times -EBUSY? */
+        dma_addr_t ddcb_daddr;          /* DMA address */
+        struct ddcb *ddcb_vaddr;        /* kernel virtual addr for DDCBs */
+        struct ddcb_requ **ddcb_req;    /* ddcb processing parameter */
+        wait_queue_head_t *ddcb_waitqs; /* waitqueue per ddcb */
+        spinlock_t ddcb_lock;           /* exclusive access to queue */
+        wait_queue_head_t ddcb_waitq;   /* wait for ddcb processing */
+        /* registers or the respective queue to be used */
+        u32 IO_QUEUE_CONFIG;
+        u32 IO_QUEUE_STATUS;
+        u32 IO_QUEUE_SEGMENT;
+        u32 IO_QUEUE_INITSQN;
+        u32 IO_QUEUE_WRAP;
+        u32 IO_QUEUE_OFFSET;
+        u32 IO_QUEUE_WTIME;
+        u32 IO_QUEUE_ERRCNTS;
+        u32 IO_QUEUE_LRW;
+};
+/*
+ * GFIR, SLU_UNITCFG, APP_UNITCFG
+ *   8 Units with FIR/FEC + 64 * 2ndary FIRS/FEC.
+ */
+#define GENWQE_FFDC_REGS        (3 + (8 * (2 + 2 * 64)))
+struct genwqe_ffdc {
+        unsigned int entries;
+        struct genwqe_reg *regs;
+};
+/**
+ * struct genwqe_dev - GenWQE device information
+ * @card_state:       Card operation state, see above
+ * @ffdc:             First Failure Data Capture buffers for each unit
+ * @card_thread:      Working thread to operate the DDCB queue
+ * @card_waitq:       Wait queue used in card_thread
+ * @queue:            DDCB queue
+ * @health_thread:    Card monitoring thread (only for PFs)
+ * @health_waitq:     Wait queue used in health_thread
+ * @pci_dev:          Associated PCI device (function)
+ * @mmio:             Base address of 64-bit register space
+ * @mmio_len:         Length of register area
+ * @file_lock:        Lock to protect access to file_list
+ * @file_list:        List of all processes with open GenWQE file descriptors
+ *
+ * This struct contains all information needed to communicate with a
+ * GenWQE card. It is initialized when a GenWQE device is found and
+ * destroyed when it goes away. It holds data to maintain the queue as
+ * well as data needed to feed the user interfaces.
+ */
+struct genwqe_dev {
+        enum genwqe_card_state card_state;
+        spinlock_t print_lock;
+        int card_idx;                   /* card index 0..CARD_NO_MAX-1 */
+        u64 flags;                      /* general flags */
+        /* FFDC data gathering */
+        struct genwqe_ffdc ffdc[GENWQE_DBG_UNITS];
+        /* DDCB workqueue */
+        struct task_struct *card_thread;
+        wait_queue_head_t queue_waitq;
+        struct ddcb_queue queue;        /* genwqe DDCB queue */
+        unsigned int irqs_processed;
+        /* Card health checking thread */
+        struct task_struct *health_thread;
+        wait_queue_head_t health_waitq;
+        /* char device */
+        dev_t  devnum_genwqe;           /* major/minor num card */
+        struct class *class_genwqe;     /* reference to class object */
+        struct device *dev;             /* for device creation */
+        struct cdev cdev_genwqe;        /* char device for card */
+        struct dentry *debugfs_root;    /* debugfs card root directory */
+        struct dentry *debugfs_genwqe;  /* debugfs driver root directory */
+        /* pci resources */
+        struct pci_dev *pci_dev;        /* PCI device */
+        void __iomem *mmio;             /* BAR-0 MMIO start */
+        unsigned long mmio_len;
+        u16 num_vfs;
+        u32 vf_jobtimeout_msec[GENWQE_MAX_VFS];
+        int is_privileged;              /* access to all regs possible */
+        /* config regs which we need often */
+        u64 slu_unitcfg;
+        u64 app_unitcfg;
+        u64 softreset;
+        u64 err_inject;
+        u64 last_gfir;
+        char app_name[5];
+        spinlock_t file_lock;           /* lock for open files */
+        struct list_head file_list;     /* list of open files */
+        /* debugfs parameters */
+        int ddcb_software_timeout;      /* wait until DDCB times out */
+        int skip_recovery;              /* circumvention if recovery fails */
+        int kill_timeout;               /* wait after sending SIGKILL */
+};
+/**
+ * enum genwqe_requ_state - State of a DDCB execution request
+ */
+enum genwqe_requ_state {
+        GENWQE_REQU_NEW      = 0,
+        GENWQE_REQU_ENQUEUED = 1,
+        GENWQE_REQU_TAPPED   = 2,
+        GENWQE_REQU_FINISHED = 3,
+        GENWQE_REQU_STATE_MAX,
+};
+/**
+ * struct ddcb_requ - Kernel internal representation of the DDCB request
+ * @cmd:          User space representation of the DDCB execution request
+ */
+struct ddcb_requ {
+        /* kernel specific content */
+        enum genwqe_requ_state req_state; /* request status */
+        int num;                          /* ddcb_no for this request */
+        struct ddcb_queue *queue;         /* associated queue */
+        struct dma_mapping  dma_mappings[DDCB_FIXUPS];
+        struct sg_entry     *sgl[DDCB_FIXUPS];
+        dma_addr_t          sgl_dma_addr[DDCB_FIXUPS];
+        size_t              sgl_size[DDCB_FIXUPS];
+        /* kernel/user shared content */
+        struct genwqe_ddcb_cmd cmd;     /* ddcb_no for this request */
+        struct genwqe_debug_data debug_data;
+};
+/**
+ * struct genwqe_file - Information for open GenWQE devices
+ */
+struct genwqe_file {
+        struct genwqe_dev *cd;
+        struct genwqe_driver *client;
+        struct file *filp;
+        struct fasync_struct *async_queue;
+        struct task_struct *owner;
+        struct list_head list;          /* entry in list of open files */
+        spinlock_t map_lock;            /* lock for dma_mappings */
+        struct list_head map_list;      /* list of dma_mappings */
+        spinlock_t pin_lock;            /* lock for pinned memory */
+        struct list_head pin_list;      /* list of pinned memory */
+};
+int  genwqe_setup_service_layer(struct genwqe_dev *cd); /* for PF only */
+int  genwqe_finish_queue(struct genwqe_dev *cd);
+int  genwqe_release_service_layer(struct genwqe_dev *cd);
+/**
+ * genwqe_get_slu_id() - Read Service Layer Unit Id
+ * Return: 0x00: Development code
+ *         0x01: SLC1 (old)
+ *         0x02: SLC2 (sept2012)
+ *         0x03: SLC2 (feb2013, generic driver)
+ */
+static inline int genwqe_get_slu_id(struct genwqe_dev *cd)
+{
+        return (int)((cd->slu_unitcfg >> 32) & 0xff);
+}
+int  genwqe_ddcbs_in_flight(struct genwqe_dev *cd);
+u8   genwqe_card_type(struct genwqe_dev *cd);
+int  genwqe_card_reset(struct genwqe_dev *cd);
+int  genwqe_set_interrupt_capability(struct genwqe_dev *cd, int count);
+void genwqe_reset_interrupt_capability(struct genwqe_dev *cd);
+int  genwqe_device_create(struct genwqe_dev *cd);
+int  genwqe_device_remove(struct genwqe_dev *cd);
+/* debugfs */
+int  genwqe_init_debugfs(struct genwqe_dev *cd);
+void genqwe_exit_debugfs(struct genwqe_dev *cd);
+int  genwqe_read_softreset(struct genwqe_dev *cd);
+/* Hardware Circumventions */
+int  genwqe_recovery_on_fatal_gfir_required(struct genwqe_dev *cd);
+int  genwqe_flash_readback_fails(struct genwqe_dev *cd);
+/**
+ * genwqe_write_vreg() - Write register in VF window
+ * @cd:    genwqe device
+ * @reg:   register address
+ * @val:   value to write
+ * @func:  0: PF, 1: VF0, ..., 15: VF14
+ */
+int genwqe_write_vreg(struct genwqe_dev *cd, u32 reg, u64 val, int func);
+/**
+ * genwqe_read_vreg() - Read register in VF window
+ * @cd:    genwqe device
+ * @reg:   register address
+ * @func:  0: PF, 1: VF0, ..., 15: VF14
+ *
+ * Return: content of the register
+ */
+u64 genwqe_read_vreg(struct genwqe_dev *cd, u32 reg, int func);
+/* FFDC Buffer Management */
+int  genwqe_ffdc_buff_size(struct genwqe_dev *cd, int unit_id);
+int  genwqe_ffdc_buff_read(struct genwqe_dev *cd, int unit_id,
+                           struct genwqe_reg *regs, unsigned int max_regs);
+int  genwqe_read_ffdc_regs(struct genwqe_dev *cd, struct genwqe_reg *regs,
+                           unsigned int max_regs, int all);
+int  genwqe_ffdc_dump_dma(struct genwqe_dev *cd,
+                          struct genwqe_reg *regs, unsigned int max_regs);
+int  genwqe_init_debug_data(struct genwqe_dev *cd,
+                            struct genwqe_debug_data *d);
+void genwqe_init_crc32(void);
+int  genwqe_read_app_id(struct genwqe_dev *cd, char *app_name, int len);
+/* Memory allocation/deallocation; dma address handling */
+int  genwqe_user_vmap(struct genwqe_dev *cd, struct dma_mapping *m,
+                      void *uaddr, unsigned long size,
+                      struct ddcb_requ *req);
+int  genwqe_user_vunmap(struct genwqe_dev *cd, struct dma_mapping *m,
+                        struct ddcb_requ *req);
+struct sg_entry *genwqe_alloc_sgl(struct genwqe_dev *cd, int num_pages,
+                                 dma_addr_t *dma_addr, size_t *sgl_size);
+void genwqe_free_sgl(struct genwqe_dev *cd, struct sg_entry *sg_list,
+                    dma_addr_t dma_addr, size_t size);
+int genwqe_setup_sgl(struct genwqe_dev *cd,
+                    unsigned long offs,
+                    unsigned long size,
+                    struct sg_entry *sgl, /* genwqe sgl */
+                    dma_addr_t dma_addr, size_t sgl_size,
+                    dma_addr_t *dma_list, int page_offs, int num_pages);
+int genwqe_check_sgl(struct genwqe_dev *cd, struct sg_entry *sg_list,
+                     int size);
+static inline bool dma_mapping_used(struct dma_mapping *m)
+{
+        if (!m)
+                return 0;
+        return m->size != 0;
+}
+/**
+ * __genwqe_execute_ddcb() - Execute DDCB request with addr translation
+ *
+ * This function will do the address translation changes to the DDCBs
+ * according to the definitions required by the ATS field. It looks up
+ * the memory allocation buffer or does vmap/vunmap for the respective
+ * user-space buffers, inclusive page pinning and scatter gather list
+ * buildup and teardown.
+ */
+int  __genwqe_execute_ddcb(struct genwqe_dev *cd,
+                           struct genwqe_ddcb_cmd *cmd);
+/**
+ * __genwqe_execute_raw_ddcb() - Execute DDCB request without addr translation
+ *
+ * This version will not do address translation or any modifcation of
+ * the DDCB data. It is used e.g. for the MoveFlash DDCB which is
+ * entirely prepared by the driver itself. That means the appropriate
+ * DMA addresses are already in the DDCB and do not need any
+ * modification.
+ */
+int  __genwqe_execute_raw_ddcb(struct genwqe_dev *cd,
+                               struct genwqe_ddcb_cmd *cmd);
+int  __genwqe_enqueue_ddcb(struct genwqe_dev *cd, struct ddcb_requ *req);
+int  __genwqe_wait_ddcb(struct genwqe_dev *cd, struct ddcb_requ *req);
+int  __genwqe_purge_ddcb(struct genwqe_dev *cd, struct ddcb_requ *req);
+/* register access */
+int __genwqe_writeq(struct genwqe_dev *cd, u64 byte_offs, u64 val);
+u64 __genwqe_readq(struct genwqe_dev *cd, u64 byte_offs);
+int __genwqe_writel(struct genwqe_dev *cd, u64 byte_offs, u32 val);
+u32 __genwqe_readl(struct genwqe_dev *cd, u64 byte_offs);
+void *__genwqe_alloc_consistent(struct genwqe_dev *cd, size_t size,
+                                 dma_addr_t *dma_handle);
+void __genwqe_free_consistent(struct genwqe_dev *cd, size_t size,
+                              void *vaddr, dma_addr_t dma_handle);
+/* Base clock frequency in MHz */
+int  genwqe_base_clock_frequency(struct genwqe_dev *cd);
+/* Before FFDC is captured the traps should be stopped. */
+void genwqe_stop_traps(struct genwqe_dev *cd);
+void genwqe_start_traps(struct genwqe_dev *cd);
+/* Hardware circumvention */
+bool genwqe_need_err_masking(struct genwqe_dev *cd);
+/**
+ * genwqe_is_privileged() - Determine operation mode for PCI function
+ *
+ * On Intel with SRIOV support we see:
+ *   PF: is_physfn = 1 is_virtfn = 0
+ *   VF: is_physfn = 0 is_virtfn = 1
+ *
+ * On Systems with no SRIOV support _and_ virtualized systems we get:
+ *       is_physfn = 0 is_virtfn = 0
+ *
+ * Other vendors have individual pci device ids to distinguish between
+ * virtual function drivers and physical function drivers. GenWQE
+ * unfortunately has just on pci device id for both, VFs and PF.
+ *
+ * The following code is used to distinguish if the card is running in
+ * privileged mode, either as true PF or in a virtualized system with
+ * full register access e.g. currently on PowerPC.
+ *
+ * if (pci_dev->is_virtfn)
+ *          cd->is_privileged = 0;
+ *  else
+ *          cd->is_privileged = (__genwqe_readq(cd, IO_SLU_BITSTREAM)
+ *                               != IO_ILLEGAL_VALUE);
+ */
+static inline int genwqe_is_privileged(struct genwqe_dev *cd)
+{
+        return cd->is_privileged;
+}
+#endif  /* __CARD_BASE_H__ */
diff --git a/drivers/misc/genwqe/card_ddcb.c b/drivers/misc/genwqe/card_ddcb.c
new file mode 100644
index 000000000000..6f1acc0ccf88
--- /dev/null
+++ b/drivers/misc/genwqe/card_ddcb.c
@@ -0,0 +1,1376 @@
+/**
+ * IBM Accelerator Family 'GenWQE'
+ *
+ * (C) Copyright IBM Corp. 2013
+ *
+ * Author: Frank Haverkamp <haver@linux.vnet.ibm.com>
+ * Author: Joerg-Stephan Vogt <jsvogt@de.ibm.com>
+ * Author: Michael Jung <mijung@de.ibm.com>
+ * Author: Michael Ruettger <michael@ibmra.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (version 2 only)
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+/*
+ * Device Driver Control Block (DDCB) queue support. Definition of
+ * interrupt handlers for queue support as well as triggering the
+ * health monitor code in case of problems. The current hardware uses
+ * an MSI interrupt which is shared between error handling and
+ * functional code.
+ */
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/wait.h>
+#include <linux/pci.h>
+#include <linux/string.h>
+#include <linux/dma-mapping.h>
+#include <linux/delay.h>
+#include <linux/module.h>
+#include <linux/interrupt.h>
+#include <linux/crc-itu-t.h>
+#include "card_base.h"
+#include "card_ddcb.h"
+/*
+ * N: next DDCB, this is where the next DDCB will be put.
+ * A: active DDCB, this is where the code will look for the next completion.
+ * x: DDCB is enqueued, we are waiting for its completion.
+ * Situation (1): Empty queue
+ *  +---+---+---+---+---+---+---+---+
+ *  | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
+ *  |   |   |   |   |   |   |   |   |
+ *  +---+---+---+---+---+---+---+---+
+ *           A/N
+ *  enqueued_ddcbs = A - N = 2 - 2 = 0
+ *
+ * Situation (2): Wrapped, N > A
+ *  +---+---+---+---+---+---+---+---+
+ *  | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
+ *  |   |   | x | x |   |   |   |   |
+ *  +---+---+---+---+---+---+---+---+
+ *            A       N
+ *  enqueued_ddcbs = N - A = 4 - 2 = 2
+ *
+ * Situation (3): Queue wrapped, A > N
+ *  +---+---+---+---+---+---+---+---+
+ *  | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
+ *  | x | x |   |   | x | x | x | x |
+ *  +---+---+---+---+---+---+---+---+
+ *            N       A
+ *  enqueued_ddcbs = queue_max  - (A - N) = 8 - (4 - 2) = 6
+ *
+ * Situation (4a): Queue full N > A
+ *  +---+---+---+---+---+---+---+---+
+ *  | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
+ *  | x | x | x | x | x | x | x |   |
+ *  +---+---+---+---+---+---+---+---+
+ *    A                           N
+ *
+ *  enqueued_ddcbs = N - A = 7 - 0 = 7
+ *
+ * Situation (4a): Queue full A > N
+ *  +---+---+---+---+---+---+---+---+
+ *  | 0 | 1 | 2 | 3 | 4 | 5 | 6 | 7 |
+ *  | x | x | x |   | x | x | x | x |
+ *  +---+---+---+---+---+---+---+---+
+ *                N   A
+ *  enqueued_ddcbs = queue_max - (A - N) = 8 - (4 - 3) = 7
+ */
+static int queue_empty(struct ddcb_queue *queue)
+{
+        return queue->ddcb_next == queue->ddcb_act;
+}
+static int queue_enqueued_ddcbs(struct ddcb_queue *queue)
+{
+        if (queue->ddcb_next >= queue->ddcb_act)
+                return queue->ddcb_next - queue->ddcb_act;
+        return queue->ddcb_max - (queue->ddcb_act - queue->ddcb_next);
+}
+static int queue_free_ddcbs(struct ddcb_queue *queue)
+{
+        int free_ddcbs = queue->ddcb_max - queue_enqueued_ddcbs(queue) - 1;
+        if (WARN_ON_ONCE(free_ddcbs < 0)) { /* must never ever happen! */
+                return 0;
+        }
+        return free_ddcbs;
+}
+/*
+ * Use of the PRIV field in the DDCB for queue debugging:
+ *
+ * (1) Trying to get rid of a DDCB which saw a timeout:
+ *     pddcb->priv[6] = 0xcc;   # cleared
+ *
+ * (2) Append a DDCB via NEXT bit:
+ *     pddcb->priv[7] = 0xaa;   # appended
+ *
+ * (3) DDCB needed tapping:
+ *     pddcb->priv[7] = 0xbb;   # tapped
+ *
+ * (4) DDCB marked as correctly finished:
+ *     pddcb->priv[6] = 0xff;   # finished
+ */
+static inline void ddcb_mark_tapped(struct ddcb *pddcb)
+{
+        pddcb->priv[7] = 0xbb;  /* tapped */
+}
+static inline void ddcb_mark_appended(struct ddcb *pddcb)
+{
+        pddcb->priv[7] = 0xaa;  /* appended */
+}
+static inline void ddcb_mark_cleared(struct ddcb *pddcb)
+{
+        pddcb->priv[6] = 0xcc; /* cleared */
+}
+static inline void ddcb_mark_finished(struct ddcb *pddcb)
+{
+        pddcb->priv[6] = 0xff;  /* finished */
+}
+static inline void ddcb_mark_unused(struct ddcb *pddcb)
+{
+        pddcb->priv_64 = cpu_to_be64(0); /* not tapped */
+}
+/**
+ * genwqe_crc16() - Generate 16-bit crc as required for DDCBs
+ * @buff:       pointer to data buffer
+ * @len:        length of data for calculation
+ * @init:       initial crc (0xffff at start)
+ *
+ * Polynomial = x^16 + x^12 + x^5 + 1   (0x1021)
+ * Example: 4 bytes 0x01 0x02 0x03 0x04 with init = 0xffff
+ *          should result in a crc16 of 0x89c3
+ *
+ * Return: crc16 checksum in big endian format !
+ */
+static inline u16 genwqe_crc16(const u8 *buff, size_t len, u16 init)
+{
+        return crc_itu_t(init, buff, len);
+}
+static void print_ddcb_info(struct genwqe_dev *cd, struct ddcb_queue *queue)
+{
+        int i;
+        struct ddcb *pddcb;
+        unsigned long flags;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        spin_lock_irqsave(&cd->print_lock, flags);
+        dev_info(&pci_dev->dev,
+                 "DDCB list for card #%d (ddcb_act=%d / ddcb_next=%d):\n",
+                 cd->card_idx, queue->ddcb_act, queue->ddcb_next);
+        pddcb = queue->ddcb_vaddr;
+        for (i = 0; i < queue->ddcb_max; i++) {
+                dev_err(&pci_dev->dev,
+                        "  %c %-3d: RETC=%03x SEQ=%04x "
+                        "HSI=%02X SHI=%02x PRIV=%06llx CMD=%03x\n",
+                        i == queue->ddcb_act ? '>' : ' ',
+                        i,
+                        be16_to_cpu(pddcb->retc_16),
+                        be16_to_cpu(pddcb->seqnum_16),
+                        pddcb->hsi,
+                        pddcb->shi,
+                        be64_to_cpu(pddcb->priv_64),
+                        pddcb->cmd);
+                pddcb++;
+        }
+        spin_unlock_irqrestore(&cd->print_lock, flags);
+}
+struct genwqe_ddcb_cmd *ddcb_requ_alloc(void)
+{
+        struct ddcb_requ *req;
+        req = kzalloc(sizeof(*req), GFP_ATOMIC);
+        if (!req)
+                return NULL;
+        return &req->cmd;
+}
+void ddcb_requ_free(struct genwqe_ddcb_cmd *cmd)
+{
+        struct ddcb_requ *req = container_of(cmd, struct ddcb_requ, cmd);
+        kfree(req);
+}
+static inline enum genwqe_requ_state ddcb_requ_get_state(struct ddcb_requ *req)
+{
+        return req->req_state;
+}
+static inline void ddcb_requ_set_state(struct ddcb_requ *req,
+                                       enum genwqe_requ_state new_state)
+{
+        req->req_state = new_state;
+}
+static inline int ddcb_requ_collect_debug_data(struct ddcb_requ *req)
+{
+        return req->cmd.ddata_addr != 0x0;
+}
+/**
+ * ddcb_requ_finished() - Returns the hardware state of the associated DDCB
+ * @cd:          pointer to genwqe device descriptor
+ * @req:         DDCB work request
+ *
+ * Status of ddcb_requ mirrors this hardware state, but is copied in
+ * the ddcb_requ on interrupt/polling function. The lowlevel code
+ * should check the hardware state directly, the higher level code
+ * should check the copy.
+ *
+ * This function will also return true if the state of the queue is
+ * not GENWQE_CARD_USED. This enables us to purge all DDCBs in the
+ * shutdown case.
+ */
+static int ddcb_requ_finished(struct genwqe_dev *cd, struct ddcb_requ *req)
+{
+        return (ddcb_requ_get_state(req) == GENWQE_REQU_FINISHED) ||
+                (cd->card_state != GENWQE_CARD_USED);
+}
+/**
+ * enqueue_ddcb() - Enqueue a DDCB
+ * @cd:         pointer to genwqe device descriptor
+ * @queue:      queue this operation should be done on
+ * @ddcb_no:    pointer to ddcb number being tapped
+ *
+ * Start execution of DDCB by tapping or append to queue via NEXT
+ * bit. This is done by an atomic 'compare and swap' instruction and
+ * checking SHI and HSI of the previous DDCB.
+ *
+ * This function must only be called with ddcb_lock held.
+ *
+ * Return: 1 if new DDCB is appended to previous
+ *         2 if DDCB queue is tapped via register/simulation
+ */
+#define RET_DDCB_APPENDED 1
+#define RET_DDCB_TAPPED   2
+static int enqueue_ddcb(struct genwqe_dev *cd, struct ddcb_queue *queue,
+                        struct ddcb *pddcb, int ddcb_no)
+{
+        unsigned int try;
+        int prev_no;
+        struct ddcb *prev_ddcb;
+        __be32 old, new, icrc_hsi_shi;
+        u64 num;
+        /*
+         * For performance checks a Dispatch Timestamp can be put into
+         * DDCB It is supposed to use the SLU's free running counter,
+         * but this requires PCIe cycles.
+         */
+        ddcb_mark_unused(pddcb);
+        /* check previous DDCB if already fetched */
+        prev_no = (ddcb_no == 0) ? queue->ddcb_max - 1 : ddcb_no - 1;
+        prev_ddcb = &queue->ddcb_vaddr[prev_no];
+        /*
+         * It might have happened that the HSI.FETCHED bit is
+         * set. Retry in this case. Therefore I expect maximum 2 times
+         * trying.
+         */
+        ddcb_mark_appended(pddcb);
+        for (try = 0; try < 2; try++) {
+                old = prev_ddcb->icrc_hsi_shi_32; /* read SHI/HSI in BE32 */
+                /* try to append via NEXT bit if prev DDCB is not completed */
+                if ((old & DDCB_COMPLETED_BE32) != 0x00000000)
+                        break;
+                new = (old | DDCB_NEXT_BE32);
+                icrc_hsi_shi = cmpxchg(&prev_ddcb->icrc_hsi_shi_32, old, new);
+                if (icrc_hsi_shi == old)
+                        return RET_DDCB_APPENDED; /* appended to queue */
+        }
+        /* Queue must be re-started by updating QUEUE_OFFSET */
+        ddcb_mark_tapped(pddcb);
+        num = (u64)ddcb_no << 8;
+        __genwqe_writeq(cd, queue->IO_QUEUE_OFFSET, num); /* start queue */
+        return RET_DDCB_TAPPED;
+}
+/**
+ * copy_ddcb_results() - Copy output state from real DDCB to request
+ *
+ * Copy DDCB ASV to request struct. There is no endian
+ * conversion made, since data structure in ASV is still
+ * unknown here.
+ *
+ * This is needed by:
+ *   - genwqe_purge_ddcb()
+ *   - genwqe_check_ddcb_queue()
+ */
+static void copy_ddcb_results(struct ddcb_requ *req, int ddcb_no)
+{
+        struct ddcb_queue *queue = req->queue;
+        struct ddcb *pddcb = &queue->ddcb_vaddr[req->num];
+        memcpy(&req->cmd.asv[0], &pddcb->asv[0], DDCB_ASV_LENGTH);
+        /* copy status flags of the variant part */
+        req->cmd.vcrc     = be16_to_cpu(pddcb->vcrc_16);
+        req->cmd.deque_ts = be64_to_cpu(pddcb->deque_ts_64);
+        req->cmd.cmplt_ts = be64_to_cpu(pddcb->cmplt_ts_64);
+        req->cmd.attn     = be16_to_cpu(pddcb->attn_16);
+        req->cmd.progress = be32_to_cpu(pddcb->progress_32);
+        req->cmd.retc     = be16_to_cpu(pddcb->retc_16);
+        if (ddcb_requ_collect_debug_data(req)) {
+                int prev_no = (ddcb_no == 0) ?
+                        queue->ddcb_max - 1 : ddcb_no - 1;
+                struct ddcb *prev_pddcb = &queue->ddcb_vaddr[prev_no];
+                memcpy(&req->debug_data.ddcb_finished, pddcb,
+                       sizeof(req->debug_data.ddcb_finished));
+                memcpy(&req->debug_data.ddcb_prev, prev_pddcb,
+                       sizeof(req->debug_data.ddcb_prev));
+        }
+}
+/**
+ * genwqe_check_ddcb_queue() - Checks DDCB queue for completed work equests.
+ * @cd:         pointer to genwqe device descriptor
+ *
+ * Return: Number of DDCBs which were finished
+ */
+static int genwqe_check_ddcb_queue(struct genwqe_dev *cd,
+                                   struct ddcb_queue *queue)
+{
+        unsigned long flags;
+        int ddcbs_finished = 0;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        spin_lock_irqsave(&queue->ddcb_lock, flags);
+        /* FIXME avoid soft locking CPU */
+        while (!queue_empty(queue) && (ddcbs_finished < queue->ddcb_max)) {
+                struct ddcb *pddcb;
+                struct ddcb_requ *req;
+                u16 vcrc, vcrc_16, retc_16;
+                pddcb = &queue->ddcb_vaddr[queue->ddcb_act];
+                if ((pddcb->icrc_hsi_shi_32 & DDCB_COMPLETED_BE32) ==
+                    0x00000000)
+                        goto go_home; /* not completed, continue waiting */
+                /* Note: DDCB could be purged */
+                req = queue->ddcb_req[queue->ddcb_act];
+                if (req == NULL) {
+                        /* this occurs if DDCB is purged, not an error */
+                        /* Move active DDCB further; Nothing to do anymore. */
+                        goto pick_next_one;
+                }
+                /*
+                 * HSI=0x44 (fetched and completed), but RETC is
+                 * 0x101, or even worse 0x000.
+                 *
+                 * In case of seeing the queue in inconsistent state
+                 * we read the errcnts and the queue status to provide
+                 * a trigger for our PCIe analyzer stop capturing.
+                 */
+                retc_16 = be16_to_cpu(pddcb->retc_16);
+                if ((pddcb->hsi == 0x44) && (retc_16 <= 0x101)) {
+                        u64 errcnts, status;
+                        u64 ddcb_offs = (u64)pddcb - (u64)queue->ddcb_vaddr;
+                        errcnts = __genwqe_readq(cd, queue->IO_QUEUE_ERRCNTS);
+                        status  = __genwqe_readq(cd, queue->IO_QUEUE_STATUS);
+                        dev_err(&pci_dev->dev,
+                                "[%s] SEQN=%04x HSI=%02x RETC=%03x "
+                                " Q_ERRCNTS=%016llx Q_STATUS=%016llx\n"
+                                " DDCB_DMA_ADDR=%016llx\n",
+                                __func__, be16_to_cpu(pddcb->seqnum_16),
+                                pddcb->hsi, retc_16, errcnts, status,
+                                queue->ddcb_daddr + ddcb_offs);
+                }
+                copy_ddcb_results(req, queue->ddcb_act);
+                queue->ddcb_req[queue->ddcb_act] = NULL; /* take from queue */
+                dev_dbg(&pci_dev->dev, "FINISHED DDCB#%d\n", req->num);
+                genwqe_hexdump(pci_dev, pddcb, sizeof(*pddcb));
+                ddcb_mark_finished(pddcb);
+                /* calculate CRC_16 to see if VCRC is correct */
+                vcrc = genwqe_crc16(pddcb->asv,
+                                   VCRC_LENGTH(req->cmd.asv_length),
+                                   0xffff);
+                vcrc_16 = be16_to_cpu(pddcb->vcrc_16);
+                if (vcrc != vcrc_16) {
+                        printk_ratelimited(KERN_ERR
+                                "%s %s: err: wrong VCRC pre=%02x vcrc_len=%d "
+                                "bytes vcrc_data=%04x is not vcrc_card=%04x\n",
+                                GENWQE_DEVNAME, dev_name(&pci_dev->dev),
+                                pddcb->pre, VCRC_LENGTH(req->cmd.asv_length),
+                                vcrc, vcrc_16);
+                }
+                ddcb_requ_set_state(req, GENWQE_REQU_FINISHED);
+                queue->ddcbs_completed++;
+                queue->ddcbs_in_flight--;
+                /* wake up process waiting for this DDCB */
+                wake_up_interruptible(&queue->ddcb_waitqs[queue->ddcb_act]);
+pick_next_one:
+                queue->ddcb_act = (queue->ddcb_act + 1) % queue->ddcb_max;
+                ddcbs_finished++;
+        }
+ go_home:
+        spin_unlock_irqrestore(&queue->ddcb_lock, flags);
+        return ddcbs_finished;
+}
+/**
+ * __genwqe_wait_ddcb(): Waits until DDCB is completed
+ * @cd:         pointer to genwqe device descriptor
+ * @req:        pointer to requsted DDCB parameters
+ *
+ * The Service Layer will update the RETC in DDCB when processing is
+ * pending or done.
+ *
+ * Return: > 0 remaining jiffies, DDCB completed
+ *           -ETIMEDOUT when timeout
+ *           -ERESTARTSYS when ^C
+ *           -EINVAL when unknown error condition
+ *
+ * When an error is returned the called needs to ensure that
+ * purge_ddcb() is being called to get the &req removed from the
+ * queue.
+ */
+int __genwqe_wait_ddcb(struct genwqe_dev *cd, struct ddcb_requ *req)
+{
+        int rc;
+        unsigned int ddcb_no;
+        struct ddcb_queue *queue;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if (req == NULL)
+                return -EINVAL;
+        queue = req->queue;
+        if (queue == NULL)
+                return -EINVAL;
+        ddcb_no = req->num;
+        if (ddcb_no >= queue->ddcb_max)
+                return -EINVAL;
+        rc = wait_event_interruptible_timeout(queue->ddcb_waitqs[ddcb_no],
+                                ddcb_requ_finished(cd, req),
+                                genwqe_ddcb_software_timeout * HZ);
+        /*
+         * We need to distinguish 3 cases here:
+         *   1. rc == 0              timeout occured
+         *   2. rc == -ERESTARTSYS   signal received
+         *   3. rc > 0               remaining jiffies condition is true
+         */
+        if (rc == 0) {
+                struct ddcb_queue *queue = req->queue;
+                struct ddcb *pddcb;
+                /*
+                 * Timeout may be caused by long task switching time.
+                 * When timeout happens, check if the request has
+                 * meanwhile completed.
+                 */
+                genwqe_check_ddcb_queue(cd, req->queue);
+                if (ddcb_requ_finished(cd, req))
+                        return rc;
+                dev_err(&pci_dev->dev,
+                        "[%s] err: DDCB#%d timeout rc=%d state=%d req @ %p\n",
+                        __func__, req->num, rc, ddcb_requ_get_state(req),
+                        req);
+                dev_err(&pci_dev->dev,
+                        "[%s]      IO_QUEUE_STATUS=0x%016llx\n", __func__,
+                        __genwqe_readq(cd, queue->IO_QUEUE_STATUS));
+                pddcb = &queue->ddcb_vaddr[req->num];
+                genwqe_hexdump(pci_dev, pddcb, sizeof(*pddcb));
+                print_ddcb_info(cd, req->queue);
+                return -ETIMEDOUT;
+        } else if (rc == -ERESTARTSYS) {
+                return rc;
+                /*
+                 * EINTR:       Stops the application
+                 * ERESTARTSYS: Restartable systemcall; called again
+                 */
+        } else if (rc < 0) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: DDCB#%d unknown result (rc=%d) %d!\n",
+                        __func__, req->num, rc, ddcb_requ_get_state(req));
+                return -EINVAL;
+        }
+        /* Severe error occured. Driver is forced to stop operation */
+        if (cd->card_state != GENWQE_CARD_USED) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: DDCB#%d forced to stop (rc=%d)\n",
+                        __func__, req->num, rc);
+                return -EIO;
+        }
+        return rc;
+}
+/**
+ * get_next_ddcb() - Get next available DDCB
+ * @cd:         pointer to genwqe device descriptor
+ *
+ * DDCB's content is completely cleared but presets for PRE and
+ * SEQNUM. This function must only be called when ddcb_lock is held.
+ *
+ * Return: NULL if no empty DDCB available otherwise ptr to next DDCB.
+ */
+static struct ddcb *get_next_ddcb(struct genwqe_dev *cd,
+                                  struct ddcb_queue *queue,
+                                  int *num)
+{
+        u64 *pu64;
+        struct ddcb *pddcb;
+        if (queue_free_ddcbs(queue) == 0) /* queue is  full */
+                return NULL;
+        /* find new ddcb */
+        pddcb = &queue->ddcb_vaddr[queue->ddcb_next];
+        /* if it is not completed, we are not allowed to use it */
+        /* barrier(); */
+        if ((pddcb->icrc_hsi_shi_32 & DDCB_COMPLETED_BE32) == 0x00000000)
+                return NULL;
+        *num = queue->ddcb_next;        /* internal DDCB number */
+        queue->ddcb_next = (queue->ddcb_next + 1) % queue->ddcb_max;
+        /* clear important DDCB fields */
+        pu64 = (u64 *)pddcb;
+        pu64[0] = 0ULL;         /* offs 0x00 (ICRC,HSI,SHI,...) */
+        pu64[1] = 0ULL;         /* offs 0x01 (ACFUNC,CMD...) */
+        /* destroy previous results in ASV */
+        pu64[0x80/8] = 0ULL;    /* offs 0x80 (ASV + 0) */
+        pu64[0x88/8] = 0ULL;    /* offs 0x88 (ASV + 0x08) */
+        pu64[0x90/8] = 0ULL;    /* offs 0x90 (ASV + 0x10) */
+        pu64[0x98/8] = 0ULL;    /* offs 0x98 (ASV + 0x18) */
+        pu64[0xd0/8] = 0ULL;    /* offs 0xd0 (RETC,ATTN...) */
+        pddcb->pre = DDCB_PRESET_PRE; /* 128 */
+        pddcb->seqnum_16 = cpu_to_be16(queue->ddcb_seq++);
+        return pddcb;
+}
+/**
+ * __genwqe_purge_ddcb() - Remove a DDCB from the workqueue
+ * @cd:         genwqe device descriptor
+ * @req:        DDCB request
+ *
+ * This will fail when the request was already FETCHED. In this case
+ * we need to wait until it is finished. Else the DDCB can be
+ * reused. This function also ensures that the request data structure
+ * is removed from ddcb_req[].
+ *
+ * Do not forget to call this function when genwqe_wait_ddcb() fails,
+ * such that the request gets really removed from ddcb_req[].
+ *
+ * Return: 0 success
+ */
+int __genwqe_purge_ddcb(struct genwqe_dev *cd, struct ddcb_requ *req)
+{
+        struct ddcb *pddcb = NULL;
+        unsigned int t;
+        unsigned long flags;
+        struct ddcb_queue *queue = req->queue;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        u64 queue_status;
+        __be32 icrc_hsi_shi = 0x0000;
+        __be32 old, new;
+        /* unsigned long flags; */
+        if (genwqe_ddcb_software_timeout <= 0) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: software timeout is not set!\n", __func__);
+                return -EFAULT;
+        }
+        pddcb = &queue->ddcb_vaddr[req->num];
+        for (t = 0; t < genwqe_ddcb_software_timeout * 10; t++) {
+                spin_lock_irqsave(&queue->ddcb_lock, flags);
+                /* Check if req was meanwhile finished */
+                if (ddcb_requ_get_state(req) == GENWQE_REQU_FINISHED)
+                        goto go_home;
+                /* try to set PURGE bit if FETCHED/COMPLETED are not set */
+                old = pddcb->icrc_hsi_shi_32;   /* read SHI/HSI in BE32 */
+                if ((old & DDCB_FETCHED_BE32) == 0x00000000) {
+                        new = (old | DDCB_PURGE_BE32);
+                        icrc_hsi_shi = cmpxchg(&pddcb->icrc_hsi_shi_32,
+                                               old, new);
+                        if (icrc_hsi_shi == old)
+                                goto finish_ddcb;
+                }
+                /* normal finish with HSI bit */
+                barrier();
+                icrc_hsi_shi = pddcb->icrc_hsi_shi_32;
+                if (icrc_hsi_shi & DDCB_COMPLETED_BE32)
+                        goto finish_ddcb;
+                spin_unlock_irqrestore(&queue->ddcb_lock, flags);
+                /*
+                 * Here the check_ddcb() function will most likely
+                 * discover this DDCB to be finished some point in
+                 * time. It will mark the req finished and free it up
+                 * in the list.
+                 */
+                copy_ddcb_results(req, req->num); /* for the failing case */
+                msleep(100); /* sleep for 1/10 second and try again */
+                continue;
+finish_ddcb:
+                copy_ddcb_results(req, req->num);
+                ddcb_requ_set_state(req, GENWQE_REQU_FINISHED);
+                queue->ddcbs_in_flight--;
+                queue->ddcb_req[req->num] = NULL; /* delete from array */
+                ddcb_mark_cleared(pddcb);
+                /* Move active DDCB further; Nothing to do here anymore. */
+                /*
+                 * We need to ensure that there is at least one free
+                 * DDCB in the queue. To do that, we must update
+                 * ddcb_act only if the COMPLETED bit is set for the
+                 * DDCB we are working on else we treat that DDCB even
+                 * if we PURGED it as occupied (hardware is supposed
+                 * to set the COMPLETED bit yet!).
+                 */
+                icrc_hsi_shi = pddcb->icrc_hsi_shi_32;
+                if ((icrc_hsi_shi & DDCB_COMPLETED_BE32) &&
+                    (queue->ddcb_act == req->num)) {
+                        queue->ddcb_act = ((queue->ddcb_act + 1) %
+                                           queue->ddcb_max);
+                }
+go_home:
+                spin_unlock_irqrestore(&queue->ddcb_lock, flags);
+                return 0;
+        }
+        /*
+         * If the card is dead and the queue is forced to stop, we
+         * might see this in the queue status register.
+         */
+        queue_status = __genwqe_readq(cd, queue->IO_QUEUE_STATUS);
+        dev_dbg(&pci_dev->dev, "UN/FINISHED DDCB#%d\n", req->num);
+        genwqe_hexdump(pci_dev, pddcb, sizeof(*pddcb));
+        dev_err(&pci_dev->dev,
+                "[%s] err: DDCB#%d not purged and not completed "
+                "after %d seconds QSTAT=%016llx!!\n",
+                __func__, req->num, genwqe_ddcb_software_timeout,
+                queue_status);
+        print_ddcb_info(cd, req->queue);
+        return -EFAULT;
+}
+int genwqe_init_debug_data(struct genwqe_dev *cd, struct genwqe_debug_data *d)
+{
+        int len;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if (d == NULL) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: invalid memory for debug data!\n",
+                        __func__);
+                return -EFAULT;
+        }
+        len  = sizeof(d->driver_version);
+        snprintf(d->driver_version, len, "%s", DRV_VERS_STRING);
+        d->slu_unitcfg = cd->slu_unitcfg;
+        d->app_unitcfg = cd->app_unitcfg;
+        return 0;
+}
+/**
+ * __genwqe_enqueue_ddcb() - Enqueue a DDCB
+ * @cd:          pointer to genwqe device descriptor
+ * @req:         pointer to DDCB execution request
+ *
+ * Return: 0 if enqueuing succeeded
+ *         -EIO if card is unusable/PCIe problems
+ *         -EBUSY if enqueuing failed
+ */
+int __genwqe_enqueue_ddcb(struct genwqe_dev *cd, struct ddcb_requ *req)
+{
+        struct ddcb *pddcb;
+        unsigned long flags;
+        struct ddcb_queue *queue;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        u16 icrc;
+        if (cd->card_state != GENWQE_CARD_USED) {
+                printk_ratelimited(KERN_ERR
+                        "%s %s: [%s] Card is unusable/PCIe problem Req#%d\n",
+                        GENWQE_DEVNAME, dev_name(&pci_dev->dev),
+                        __func__, req->num);
+                return -EIO;
+        }
+        queue = req->queue = &cd->queue;
+        /* FIXME circumvention to improve performance when no irq is
+         * there.
+         */
+        if (genwqe_polling_enabled)
+                genwqe_check_ddcb_queue(cd, queue);
+        /*
+         * It must be ensured to process all DDCBs in successive
+         * order. Use a lock here in order to prevent nested DDCB
+         * enqueuing.
+         */
+        spin_lock_irqsave(&queue->ddcb_lock, flags);
+        pddcb = get_next_ddcb(cd, queue, &req->num);    /* get ptr and num */
+        if (pddcb == NULL) {
+                spin_unlock_irqrestore(&queue->ddcb_lock, flags);
+                queue->busy++;
+                return -EBUSY;
+        }
+        if (queue->ddcb_req[req->num] != NULL) {
+                spin_unlock_irqrestore(&queue->ddcb_lock, flags);
+                dev_err(&pci_dev->dev,
+                        "[%s] picked DDCB %d with req=%p still in use!!\n",
+                        __func__, req->num, req);
+                return -EFAULT;
+        }
+        ddcb_requ_set_state(req, GENWQE_REQU_ENQUEUED);
+        queue->ddcb_req[req->num] = req;
+        pddcb->cmdopts_16 = cpu_to_be16(req->cmd.cmdopts);
+        pddcb->cmd = req->cmd.cmd;
+        pddcb->acfunc = req->cmd.acfunc;        /* functional unit */
+        /*
+         * We know that we can get retc 0x104 with CRC error, do not
+         * stop the queue in those cases for this command. XDIR = 1
+         * does not work for old SLU versions.
+         *
+         * Last bitstream with the old XDIR behavior had SLU_ID
+         * 0x34199.
+         */
+        if ((cd->slu_unitcfg & 0xFFFF0ull) > 0x34199ull)
+                pddcb->xdir = 0x1;
+        else
+                pddcb->xdir = 0x0;
+        pddcb->psp = (((req->cmd.asiv_length / 8) << 4) |
+                      ((req->cmd.asv_length  / 8)));
+        pddcb->disp_ts_64 = cpu_to_be64(req->cmd.disp_ts);
+        /*
+         * If copying the whole DDCB_ASIV_LENGTH is impacting
+         * performance we need to change it to
+         * req->cmd.asiv_length. But simulation benefits from some
+         * non-architectured bits behind the architectured content.
+         *
+         * How much data is copied depends on the availability of the
+         * ATS field, which was introduced late. If the ATS field is
+         * supported ASIV is 8 bytes shorter than it used to be. Since
+         * the ATS field is copied too, the code should do exactly
+         * what it did before, but I wanted to make copying of the ATS
+         * field very explicit.
+         */
+        if (genwqe_get_slu_id(cd) <= 0x2) {
+                memcpy(&pddcb->__asiv[0],       /* destination */
+                       &req->cmd.__asiv[0],     /* source */
+                       DDCB_ASIV_LENGTH);       /* req->cmd.asiv_length */
+        } else {
+                pddcb->n.ats_64 = cpu_to_be64(req->cmd.ats);
+                memcpy(&pddcb->n.asiv[0],       /* destination */
+                        &req->cmd.asiv[0],      /* source */
+                        DDCB_ASIV_LENGTH_ATS);  /* req->cmd.asiv_length */
+        }
+        pddcb->icrc_hsi_shi_32 = cpu_to_be32(0x00000000); /* for crc */
+        /*
+         * Calculate CRC_16 for corresponding range PSP(7:4). Include
+         * empty 4 bytes prior to the data.
+         */
+        icrc = genwqe_crc16((const u8 *)pddcb,
+                           ICRC_LENGTH(req->cmd.asiv_length), 0xffff);
+        pddcb->icrc_hsi_shi_32 = cpu_to_be32((u32)icrc << 16);
+        /* enable DDCB completion irq */
+        if (!genwqe_polling_enabled)
+                pddcb->icrc_hsi_shi_32 |= DDCB_INTR_BE32;
+        dev_dbg(&pci_dev->dev, "INPUT DDCB#%d\n", req->num);
+        genwqe_hexdump(pci_dev, pddcb, sizeof(*pddcb));
+        if (ddcb_requ_collect_debug_data(req)) {
+                /* use the kernel copy of debug data. copying back to
+                   user buffer happens later */
+                genwqe_init_debug_data(cd, &req->debug_data);
+                memcpy(&req->debug_data.ddcb_before, pddcb,
+                       sizeof(req->debug_data.ddcb_before));
+        }
+        enqueue_ddcb(cd, queue, pddcb, req->num);
+        queue->ddcbs_in_flight++;
+        if (queue->ddcbs_in_flight > queue->ddcbs_max_in_flight)
+                queue->ddcbs_max_in_flight = queue->ddcbs_in_flight;
+        ddcb_requ_set_state(req, GENWQE_REQU_TAPPED);
+        spin_unlock_irqrestore(&queue->ddcb_lock, flags);
+        wake_up_interruptible(&cd->queue_waitq);
+        return 0;
+}
+/**
+ * __genwqe_execute_raw_ddcb() - Setup and execute DDCB
+ * @cd:         pointer to genwqe device descriptor
+ * @req:        user provided DDCB request
+ */
+int __genwqe_execute_raw_ddcb(struct genwqe_dev *cd,
+                             struct genwqe_ddcb_cmd *cmd)
+{
+        int rc = 0;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        struct ddcb_requ *req = container_of(cmd, struct ddcb_requ, cmd);
+        if (cmd->asiv_length > DDCB_ASIV_LENGTH) {
+                dev_err(&pci_dev->dev, "[%s] err: wrong asiv_length of %d\n",
+                        __func__, cmd->asiv_length);
+                return -EINVAL;
+        }
+        if (cmd->asv_length > DDCB_ASV_LENGTH) {
+                dev_err(&pci_dev->dev, "[%s] err: wrong asv_length of %d\n",
+                        __func__, cmd->asiv_length);
+                return -EINVAL;
+        }
+        rc = __genwqe_enqueue_ddcb(cd, req);
+        if (rc != 0)
+                return rc;
+        rc = __genwqe_wait_ddcb(cd, req);
+        if (rc < 0)             /* error or signal interrupt */
+                goto err_exit;
+        if (ddcb_requ_collect_debug_data(req)) {
+                if (copy_to_user((struct genwqe_debug_data __user *)
+                                 (unsigned long)cmd->ddata_addr,
+                                 &req->debug_data,
+                                 sizeof(struct genwqe_debug_data)))
+                        return -EFAULT;
+        }
+        /*
+         * Higher values than 0x102 indicate completion with faults,
+         * lower values than 0x102 indicate processing faults. Note
+         * that DDCB might have been purged. E.g. Cntl+C.
+         */
+        if (cmd->retc != DDCB_RETC_COMPLETE) {
+                /* This might happen e.g. flash read, and needs to be
+                   handled by the upper layer code. */
+                rc = -EBADMSG;  /* not processed/error retc */
+        }
+        return rc;
+ err_exit:
+        __genwqe_purge_ddcb(cd, req);
+        if (ddcb_requ_collect_debug_data(req)) {
+                if (copy_to_user((struct genwqe_debug_data __user *)
+                                 (unsigned long)cmd->ddata_addr,
+                                 &req->debug_data,
+                                 sizeof(struct genwqe_debug_data)))
+                        return -EFAULT;
+        }
+        return rc;
+}
+/**
+ * genwqe_next_ddcb_ready() - Figure out if the next DDCB is already finished
+ *
+ * We use this as condition for our wait-queue code.
+ */
+static int genwqe_next_ddcb_ready(struct genwqe_dev *cd)
+{
+        unsigned long flags;
+        struct ddcb *pddcb;
+        struct ddcb_queue *queue = &cd->queue;
+        spin_lock_irqsave(&queue->ddcb_lock, flags);
+        if (queue_empty(queue)) { /* emtpy queue */
+                spin_unlock_irqrestore(&queue->ddcb_lock, flags);
+                return 0;
+        }
+        pddcb = &queue->ddcb_vaddr[queue->ddcb_act];
+        if (pddcb->icrc_hsi_shi_32 & DDCB_COMPLETED_BE32) { /* ddcb ready */
+                spin_unlock_irqrestore(&queue->ddcb_lock, flags);
+                return 1;
+        }
+        spin_unlock_irqrestore(&queue->ddcb_lock, flags);
+        return 0;
+}
+/**
+ * genwqe_ddcbs_in_flight() - Check how many DDCBs are in flight
+ *
+ * Keep track on the number of DDCBs which ware currently in the
+ * queue. This is needed for statistics as well as conditon if we want
+ * to wait or better do polling in case of no interrupts available.
+ */
+int genwqe_ddcbs_in_flight(struct genwqe_dev *cd)
+{
+        unsigned long flags;
+        int ddcbs_in_flight = 0;
+        struct ddcb_queue *queue = &cd->queue;
+        spin_lock_irqsave(&queue->ddcb_lock, flags);
+        ddcbs_in_flight += queue->ddcbs_in_flight;
+        spin_unlock_irqrestore(&queue->ddcb_lock, flags);
+        return ddcbs_in_flight;
+}
+static int setup_ddcb_queue(struct genwqe_dev *cd, struct ddcb_queue *queue)
+{
+        int rc, i;
+        struct ddcb *pddcb;
+        u64 val64;
+        unsigned int queue_size;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if (genwqe_ddcb_max < 2)
+                return -EINVAL;
+        queue_size = roundup(genwqe_ddcb_max * sizeof(struct ddcb), PAGE_SIZE);
+        queue->ddcbs_in_flight = 0;  /* statistics */
+        queue->ddcbs_max_in_flight = 0;
+        queue->ddcbs_completed = 0;
+        queue->busy = 0;
+        queue->ddcb_seq   = 0x100; /* start sequence number */
+        queue->ddcb_max   = genwqe_ddcb_max; /* module parameter */
+        queue->ddcb_vaddr = __genwqe_alloc_consistent(cd, queue_size,
+                                                &queue->ddcb_daddr);
+        if (queue->ddcb_vaddr == NULL) {
+                dev_err(&pci_dev->dev,
+                        "[%s] **err: could not allocate DDCB **\n", __func__);
+                return -ENOMEM;
+        }
+        memset(queue->ddcb_vaddr, 0, queue_size);
+        queue->ddcb_req = kzalloc(sizeof(struct ddcb_requ *) *
+                                  queue->ddcb_max, GFP_KERNEL);
+        if (!queue->ddcb_req) {
+                rc = -ENOMEM;
+                goto free_ddcbs;
+        }
+        queue->ddcb_waitqs = kzalloc(sizeof(wait_queue_head_t) *
+                                     queue->ddcb_max, GFP_KERNEL);
+        if (!queue->ddcb_waitqs) {
+                rc = -ENOMEM;
+                goto free_requs;
+        }
+        for (i = 0; i < queue->ddcb_max; i++) {
+                pddcb = &queue->ddcb_vaddr[i];               /* DDCBs */
+                pddcb->icrc_hsi_shi_32 = DDCB_COMPLETED_BE32;
+                pddcb->retc_16 = cpu_to_be16(0xfff);
+                queue->ddcb_req[i] = NULL;                   /* requests */
+                init_waitqueue_head(&queue->ddcb_waitqs[i]); /* waitqueues */
+        }
+        queue->ddcb_act  = 0;
+        queue->ddcb_next = 0;   /* queue is empty */
+        spin_lock_init(&queue->ddcb_lock);
+        init_waitqueue_head(&queue->ddcb_waitq);
+        val64 = ((u64)(queue->ddcb_max - 1) <<  8); /* lastptr */
+        __genwqe_writeq(cd, queue->IO_QUEUE_CONFIG,  0x07);  /* iCRC/vCRC */
+        __genwqe_writeq(cd, queue->IO_QUEUE_SEGMENT, queue->ddcb_daddr);
+        __genwqe_writeq(cd, queue->IO_QUEUE_INITSQN, queue->ddcb_seq);
+        __genwqe_writeq(cd, queue->IO_QUEUE_WRAP,    val64);
+        return 0;
+ free_requs:
+        kfree(queue->ddcb_req);
+        queue->ddcb_req = NULL;
+ free_ddcbs:
+        __genwqe_free_consistent(cd, queue_size, queue->ddcb_vaddr,
+                                queue->ddcb_daddr);
+        queue->ddcb_vaddr = NULL;
+        queue->ddcb_daddr = 0ull;
+        return -ENODEV;
+}
+static int ddcb_queue_initialized(struct ddcb_queue *queue)
+{
+        return queue->ddcb_vaddr != NULL;
+}
+static void free_ddcb_queue(struct genwqe_dev *cd, struct ddcb_queue *queue)
+{
+        unsigned int queue_size;
+        queue_size = roundup(queue->ddcb_max * sizeof(struct ddcb), PAGE_SIZE);
+        kfree(queue->ddcb_req);
+        queue->ddcb_req = NULL;
+        if (queue->ddcb_vaddr) {
+                __genwqe_free_consistent(cd, queue_size, queue->ddcb_vaddr,
+                                        queue->ddcb_daddr);
+                queue->ddcb_vaddr = NULL;
+                queue->ddcb_daddr = 0ull;
+        }
+}
+static irqreturn_t genwqe_pf_isr(int irq, void *dev_id)
+{
+        u64 gfir;
+        struct genwqe_dev *cd = (struct genwqe_dev *)dev_id;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        /*
+         * In case of fatal FIR error the queue is stopped, such that
+         * we can safely check it without risking anything.
+         */
+        cd->irqs_processed++;
+        wake_up_interruptible(&cd->queue_waitq);
+        /*
+         * Checking for errors before kicking the queue might be
+         * safer, but slower for the good-case ... See above.
+         */
+        gfir = __genwqe_readq(cd, IO_SLC_CFGREG_GFIR);
+        if ((gfir & GFIR_ERR_TRIGGER) != 0x0) {
+                wake_up_interruptible(&cd->health_waitq);
+                /*
+                 * By default GFIRs causes recovery actions. This
+                 * count is just for debug when recovery is masked.
+                 */
+                printk_ratelimited(KERN_ERR
+                                   "%s %s: [%s] GFIR=%016llx\n",
+                                   GENWQE_DEVNAME, dev_name(&pci_dev->dev),
+                                   __func__, gfir);
+        }
+        return IRQ_HANDLED;
+}
+static irqreturn_t genwqe_vf_isr(int irq, void *dev_id)
+{
+        struct genwqe_dev *cd = (struct genwqe_dev *)dev_id;
+        cd->irqs_processed++;
+        wake_up_interruptible(&cd->queue_waitq);
+        return IRQ_HANDLED;
+}
+/**
+ * genwqe_card_thread() - Work thread for the DDCB queue
+ *
+ * The idea is to check if there are DDCBs in processing. If there are
+ * some finished DDCBs, we process them and wakeup the
+ * requestors. Otherwise we give other processes time using
+ * cond_resched().
+ */
+static int genwqe_card_thread(void *data)
+{
+        int should_stop = 0, rc = 0;
+        struct genwqe_dev *cd = (struct genwqe_dev *)data;
+        while (!kthread_should_stop()) {
+                genwqe_check_ddcb_queue(cd, &cd->queue);
+                if (genwqe_polling_enabled) {
+                        rc = wait_event_interruptible_timeout(
+                                cd->queue_waitq,
+                                genwqe_ddcbs_in_flight(cd) ||
+                                (should_stop = kthread_should_stop()), 1);
+                } else {
+                        rc = wait_event_interruptible_timeout(
+                                cd->queue_waitq,
+                                genwqe_next_ddcb_ready(cd) ||
+                                (should_stop = kthread_should_stop()), HZ);
+                }
+                if (should_stop)
+                        break;
+                /*
+                 * Avoid soft lockups on heavy loads; we do not want
+                 * to disable our interrupts.
+                 */
+                cond_resched();
+        }
+        return 0;
+}
+/**
+ * genwqe_setup_service_layer() - Setup DDCB queue
+ * @cd:         pointer to genwqe device descriptor
+ *
+ * Allocate DDCBs. Configure Service Layer Controller (SLC).
+ *
+ * Return: 0 success
+ */
+int genwqe_setup_service_layer(struct genwqe_dev *cd)
+{
+        int rc;
+        struct ddcb_queue *queue;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if (genwqe_is_privileged(cd)) {
+                rc = genwqe_card_reset(cd);
+                if (rc < 0) {
+                        dev_err(&pci_dev->dev,
+                                "[%s] err: reset failed.\n", __func__);
+                        return rc;
+                }
+                genwqe_read_softreset(cd);
+        }
+        queue = &cd->queue;
+        queue->IO_QUEUE_CONFIG  = IO_SLC_QUEUE_CONFIG;
+        queue->IO_QUEUE_STATUS  = IO_SLC_QUEUE_STATUS;
+        queue->IO_QUEUE_SEGMENT = IO_SLC_QUEUE_SEGMENT;
+        queue->IO_QUEUE_INITSQN = IO_SLC_QUEUE_INITSQN;
+        queue->IO_QUEUE_OFFSET  = IO_SLC_QUEUE_OFFSET;
+        queue->IO_QUEUE_WRAP    = IO_SLC_QUEUE_WRAP;
+        queue->IO_QUEUE_WTIME   = IO_SLC_QUEUE_WTIME;
+        queue->IO_QUEUE_ERRCNTS = IO_SLC_QUEUE_ERRCNTS;
+        queue->IO_QUEUE_LRW     = IO_SLC_QUEUE_LRW;
+        rc = setup_ddcb_queue(cd, queue);
+        if (rc != 0) {
+                rc = -ENODEV;
+                goto err_out;
+        }
+        init_waitqueue_head(&cd->queue_waitq);
+        cd->card_thread = kthread_run(genwqe_card_thread, cd,
+                                      GENWQE_DEVNAME "%d_thread",
+                                      cd->card_idx);
+        if (IS_ERR(cd->card_thread)) {
+                rc = PTR_ERR(cd->card_thread);
+                cd->card_thread = NULL;
+                goto stop_free_queue;
+        }
+        rc = genwqe_set_interrupt_capability(cd, GENWQE_MSI_IRQS);
+        if (rc > 0)
+                rc = genwqe_set_interrupt_capability(cd, rc);
+        if (rc != 0) {
+                rc = -ENODEV;
+                goto stop_kthread;
+        }
+        /*
+         * We must have all wait-queues initialized when we enable the
+         * interrupts. Otherwise we might crash if we get an early
+         * irq.
+         */
+        init_waitqueue_head(&cd->health_waitq);
+        if (genwqe_is_privileged(cd)) {
+                rc = request_irq(pci_dev->irq, genwqe_pf_isr, IRQF_SHARED,
+                                 GENWQE_DEVNAME, cd);
+        } else {
+                rc = request_irq(pci_dev->irq, genwqe_vf_isr, IRQF_SHARED,
+                                 GENWQE_DEVNAME, cd);
+        }
+        if (rc < 0) {
+                dev_err(&pci_dev->dev, "irq %d not free.\n", pci_dev->irq);
+                goto stop_irq_cap;
+        }
+        cd->card_state = GENWQE_CARD_USED;
+        return 0;
+ stop_irq_cap:
+        genwqe_reset_interrupt_capability(cd);
+ stop_kthread:
+        kthread_stop(cd->card_thread);
+        cd->card_thread = NULL;
+ stop_free_queue:
+        free_ddcb_queue(cd, queue);
+ err_out:
+        return rc;
+}
+/**
+ * queue_wake_up_all() - Handles fatal error case
+ *
+ * The PCI device got unusable and we have to stop all pending
+ * requests as fast as we can. The code after this must purge the
+ * DDCBs in question and ensure that all mappings are freed.
+ */
+static int queue_wake_up_all(struct genwqe_dev *cd)
+{
+        unsigned int i;
+        unsigned long flags;
+        struct ddcb_queue *queue = &cd->queue;
+        spin_lock_irqsave(&queue->ddcb_lock, flags);
+        for (i = 0; i < queue->ddcb_max; i++)
+                wake_up_interruptible(&queue->ddcb_waitqs[queue->ddcb_act]);
+        spin_unlock_irqrestore(&queue->ddcb_lock, flags);
+        return 0;
+}
+/**
+ * genwqe_finish_queue() - Remove any genwqe devices and user-interfaces
+ *
+ * Relies on the pre-condition that there are no users of the card
+ * device anymore e.g. with open file-descriptors.
+ *
+ * This function must be robust enough to be called twice.
+ */
+int genwqe_finish_queue(struct genwqe_dev *cd)
+{
+        int i, rc, in_flight;
+        int waitmax = genwqe_ddcb_software_timeout;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        struct ddcb_queue *queue = &cd->queue;
+        if (!ddcb_queue_initialized(queue))
+                return 0;
+        /* Do not wipe out the error state. */
+        if (cd->card_state == GENWQE_CARD_USED)
+                cd->card_state = GENWQE_CARD_UNUSED;
+        /* Wake up all requests in the DDCB queue such that they
+           should be removed nicely. */
+        queue_wake_up_all(cd);
+        /* We must wait to get rid of the DDCBs in flight */
+        for (i = 0; i < waitmax; i++) {
+                in_flight = genwqe_ddcbs_in_flight(cd);
+                if (in_flight == 0)
+                        break;
+                dev_dbg(&pci_dev->dev,
+                        "  DEBUG [%d/%d] waiting for queue to get empty: "
+                        "%d requests!\n", i, waitmax, in_flight);
+                /*
+                 * Severe severe error situation: The card itself has
+                 * 16 DDCB queues, each queue has e.g. 32 entries,
+                 * each DDBC has a hardware timeout of currently 250
+                 * msec but the PFs have a hardware timeout of 8 sec
+                 * ... so I take something large.
+                 */
+                msleep(1000);
+        }
+        if (i == waitmax) {
+                dev_err(&pci_dev->dev, "  [%s] err: queue is not empty!!\n",
+                        __func__);
+                rc = -EIO;
+        }
+        return rc;
+}
+/**
+ * genwqe_release_service_layer() - Shutdown DDCB queue
+ * @cd:       genwqe device descriptor
+ *
+ * This function must be robust enough to be called twice.
+ */
+int genwqe_release_service_layer(struct genwqe_dev *cd)
+{
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if (!ddcb_queue_initialized(&cd->queue))
+                return 1;
+        free_irq(pci_dev->irq, cd);
+        genwqe_reset_interrupt_capability(cd);
+        if (cd->card_thread != NULL) {
+                kthread_stop(cd->card_thread);
+                cd->card_thread = NULL;
+        }
+        free_ddcb_queue(cd, &cd->queue);
+        return 0;
+}
diff --git a/drivers/misc/genwqe/card_ddcb.h b/drivers/misc/genwqe/card_ddcb.h
new file mode 100644
index 000000000000..c4f26720753e
--- /dev/null
+++ b/drivers/misc/genwqe/card_ddcb.h
@@ -0,0 +1,188 @@
+#ifndef __CARD_DDCB_H__
+#define __CARD_DDCB_H__
+/**
+ * IBM Accelerator Family 'GenWQE'
+ *
+ * (C) Copyright IBM Corp. 2013
+ *
+ * Author: Frank Haverkamp <haver@linux.vnet.ibm.com>
+ * Author: Joerg-Stephan Vogt <jsvogt@de.ibm.com>
+ * Author: Michael Jung <mijung@de.ibm.com>
+ * Author: Michael Ruettger <michael@ibmra.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2, or (at your option)
+ * any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+#include <linux/types.h>
+#include <asm/byteorder.h>
+#include "genwqe_driver.h"
+#include "card_base.h"
+/**
+ * struct ddcb - Device Driver Control Block DDCB
+ * @hsi:        Hardware software interlock
+ * @shi:        Software hardware interlock. Hsi and shi are used to interlock
+ *              software and hardware activities. We are using a compare and
+ *              swap operation to ensure that there are no races when
+ *              activating new DDCBs on the queue, or when we need to
+ *              purge a DDCB from a running queue.
+ * @acfunc:     Accelerator function addresses a unit within the chip
+ * @cmd:        Command to work on
+ * @cmdopts_16: Options for the command
+ * @asiv:       Input data
+ * @asv:        Output data
+ *
+ * The DDCB data format is big endian. Multiple consequtive DDBCs form
+ * a DDCB queue.
+ */
+#define ASIV_LENGTH             104 /* Old specification without ATS field */
+#define ASIV_LENGTH_ATS         96  /* New specification with ATS field */
+#define ASV_LENGTH              64
+struct ddcb {
+        union {
+                __be32 icrc_hsi_shi_32; /* iCRC, Hardware/SW interlock */
+                struct {
+                        __be16  icrc_16;
+                        u8      hsi;
+                        u8      shi;
+                };
+        };
+        u8  pre;                /* Preamble */
+        u8  xdir;               /* Execution Directives */
+        __be16 seqnum_16;       /* Sequence Number */
+        u8  acfunc;             /* Accelerator Function.. */
+        u8  cmd;                /* Command. */
+        __be16 cmdopts_16;      /* Command Options */
+        u8  sur;                /* Status Update Rate */
+        u8  psp;                /* Protection Section Pointer */
+        __be16 rsvd_0e_16;      /* Reserved invariant */
+        __be64 fwiv_64;         /* Firmware Invariant. */
+        union {
+                struct {
+                        __be64 ats_64;  /* Address Translation Spec */
+                        u8     asiv[ASIV_LENGTH_ATS]; /* New ASIV */
+                } n;
+                u8  __asiv[ASIV_LENGTH];        /* obsolete */
+        };
+        u8     asv[ASV_LENGTH]; /* Appl Spec Variant */
+        __be16 rsvd_c0_16;      /* Reserved Variant */
+        __be16 vcrc_16;         /* Variant CRC */
+        __be32 rsvd_32;         /* Reserved unprotected */
+        __be64 deque_ts_64;     /* Deque Time Stamp. */
+        __be16 retc_16;         /* Return Code */
+        __be16 attn_16;         /* Attention/Extended Error Codes */
+        __be32 progress_32;     /* Progress indicator. */
+        __be64 cmplt_ts_64;     /* Completion Time Stamp. */
+        /* The following layout matches the new service layer format */
+        __be32 ibdc_32;         /* Inbound Data Count  (* 256) */
+        __be32 obdc_32;         /* Outbound Data Count (* 256) */
+        __be64 rsvd_SLH_64;     /* Reserved for hardware */
+        union {                 /* private data for driver */
+                u8      priv[8];
+                __be64  priv_64;
+        };
+        __be64 disp_ts_64;      /* Dispatch TimeStamp */
+} __attribute__((__packed__));
+/* CRC polynomials for DDCB */
+#define CRC16_POLYNOMIAL        0x1021
+/*
+ * SHI: Software to Hardware Interlock
+ *   This 1 byte field is written by software to interlock the
+ *   movement of one queue entry to another with the hardware in the
+ *   chip.
+ */
+#define DDCB_SHI_INTR           0x04 /* Bit 2 */
+#define DDCB_SHI_PURGE          0x02 /* Bit 1 */
+#define DDCB_SHI_NEXT           0x01 /* Bit 0 */
+/*
+ * HSI: Hardware to Software interlock
+ * This 1 byte field is written by hardware to interlock the movement
+ * of one queue entry to another with the software in the chip.
+ */
+#define DDCB_HSI_COMPLETED      0x40 /* Bit 6 */
+#define DDCB_HSI_FETCHED        0x04 /* Bit 2 */
+/*
+ * Accessing HSI/SHI is done 32-bit wide
+ *   Normally 16-bit access would work too, but on some platforms the
+ *   16 compare and swap operation is not supported. Therefore
+ *   switching to 32-bit such that those platforms will work too.
+ *
+ *                                         iCRC HSI/SHI
+ */
+#define DDCB_INTR_BE32          cpu_to_be32(0x00000004)
+#define DDCB_PURGE_BE32         cpu_to_be32(0x00000002)
+#define DDCB_NEXT_BE32          cpu_to_be32(0x00000001)
+#define DDCB_COMPLETED_BE32     cpu_to_be32(0x00004000)
+#define DDCB_FETCHED_BE32       cpu_to_be32(0x00000400)
+/* Definitions of DDCB presets */
+#define DDCB_PRESET_PRE         0x80
+#define ICRC_LENGTH(n)          ((n) + 8 + 8 + 8)  /* used ASIV + hdr fields */
+#define VCRC_LENGTH(n)          ((n))              /* used ASV */
+/*
+ * Genwqe Scatter Gather list
+ *   Each element has up to 8 entries.
+ *   The chaining element is element 0 cause of prefetching needs.
+ */
+/*
+ * 0b0110 Chained descriptor. The descriptor is describing the next
+ * descriptor list.
+ */
+#define SG_CHAINED              (0x6)
+/*
+ * 0b0010 First entry of a descriptor list. Start from a Buffer-Empty
+ * condition.
+ */
+#define SG_DATA                 (0x2)
+/*
+ * 0b0000 Early terminator. This is the last entry on the list
+ * irregardless of the length indicated.
+ */
+#define SG_END_LIST             (0x0)
+/**
+ * struct sglist - Scatter gather list
+ * @target_addr:       Either a dma addr of memory to work on or a
+ *                     dma addr or a subsequent sglist block.
+ * @len:               Length of the data block.
+ * @flags:             See above.
+ *
+ * Depending on the command the GenWQE card can use a scatter gather
+ * list to describe the memory it works on. Always 8 sg_entry's form
+ * a block.
+ */
+struct sg_entry {
+        __be64 target_addr;
+        __be32 len;
+        __be32 flags;
+};
+#endif /* __CARD_DDCB_H__ */
diff --git a/drivers/misc/genwqe/card_debugfs.c b/drivers/misc/genwqe/card_debugfs.c
new file mode 100644
index 000000000000..3bfdc07a7248
--- /dev/null
+++ b/drivers/misc/genwqe/card_debugfs.c
@@ -0,0 +1,500 @@
+/**
+ * IBM Accelerator Family 'GenWQE'
+ *
+ * (C) Copyright IBM Corp. 2013
+ *
+ * Author: Frank Haverkamp <haver@linux.vnet.ibm.com>
+ * Author: Joerg-Stephan Vogt <jsvogt@de.ibm.com>
+ * Author: Michael Jung <mijung@de.ibm.com>
+ * Author: Michael Ruettger <michael@ibmra.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (version 2 only)
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+/*
+ * Debugfs interfaces for the GenWQE card. Help to debug potential
+ * problems. Dump internal chip state for debugging and failure
+ * determination.
+ */
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <linux/uaccess.h>
+#include "card_base.h"
+#include "card_ddcb.h"
+#define GENWQE_DEBUGFS_RO(_name, _showfn)                               \
+        static int genwqe_debugfs_##_name##_open(struct inode *inode,   \
+                                                 struct file *file)     \
+        {                                                               \
+                return single_open(file, _showfn, inode->i_private);    \
+        }                                                               \
+        static const struct file_operations genwqe_##_name##_fops = {   \
+                .open = genwqe_debugfs_##_name##_open,                  \
+                .read = seq_read,                                       \
+                .llseek = seq_lseek,                                    \
+                .release = single_release,                              \
+        }
+static void dbg_uidn_show(struct seq_file *s, struct genwqe_reg *regs,
+                          int entries)
+{
+        unsigned int i;
+        u32 v_hi, v_lo;
+        for (i = 0; i < entries; i++) {
+                v_hi = (regs[i].val >> 32) & 0xffffffff;
+                v_lo = (regs[i].val)       & 0xffffffff;
+                seq_printf(s, "  0x%08x 0x%08x 0x%08x 0x%08x EXT_ERR_REC\n",
+                           regs[i].addr, regs[i].idx, v_hi, v_lo);
+        }
+}
+static int curr_dbg_uidn_show(struct seq_file *s, void *unused, int uid)
+{
+        struct genwqe_dev *cd = s->private;
+        int entries;
+        struct genwqe_reg *regs;
+        entries = genwqe_ffdc_buff_size(cd, uid);
+        if (entries < 0)
+                return -EINVAL;
+        if (entries == 0)
+                return 0;
+        regs = kcalloc(entries, sizeof(*regs), GFP_KERNEL);
+        if (regs == NULL)
+                return -ENOMEM;
+        genwqe_stop_traps(cd); /* halt the traps while dumping data */
+        genwqe_ffdc_buff_read(cd, uid, regs, entries);
+        genwqe_start_traps(cd);
+        dbg_uidn_show(s, regs, entries);
+        kfree(regs);
+        return 0;
+}
+static int genwqe_curr_dbg_uid0_show(struct seq_file *s, void *unused)
+{
+        return curr_dbg_uidn_show(s, unused, 0);
+}
+GENWQE_DEBUGFS_RO(curr_dbg_uid0, genwqe_curr_dbg_uid0_show);
+static int genwqe_curr_dbg_uid1_show(struct seq_file *s, void *unused)
+{
+        return curr_dbg_uidn_show(s, unused, 1);
+}
+GENWQE_DEBUGFS_RO(curr_dbg_uid1, genwqe_curr_dbg_uid1_show);
+static int genwqe_curr_dbg_uid2_show(struct seq_file *s, void *unused)
+{
+        return curr_dbg_uidn_show(s, unused, 2);
+}
+GENWQE_DEBUGFS_RO(curr_dbg_uid2, genwqe_curr_dbg_uid2_show);
+static int prev_dbg_uidn_show(struct seq_file *s, void *unused, int uid)
+{
+        struct genwqe_dev *cd = s->private;
+        dbg_uidn_show(s, cd->ffdc[uid].regs,  cd->ffdc[uid].entries);
+        return 0;
+}
+static int genwqe_prev_dbg_uid0_show(struct seq_file *s, void *unused)
+{
+        return prev_dbg_uidn_show(s, unused, 0);
+}
+GENWQE_DEBUGFS_RO(prev_dbg_uid0, genwqe_prev_dbg_uid0_show);
+static int genwqe_prev_dbg_uid1_show(struct seq_file *s, void *unused)
+{
+        return prev_dbg_uidn_show(s, unused, 1);
+}
+GENWQE_DEBUGFS_RO(prev_dbg_uid1, genwqe_prev_dbg_uid1_show);
+static int genwqe_prev_dbg_uid2_show(struct seq_file *s, void *unused)
+{
+        return prev_dbg_uidn_show(s, unused, 2);
+}
+GENWQE_DEBUGFS_RO(prev_dbg_uid2, genwqe_prev_dbg_uid2_show);
+static int genwqe_curr_regs_show(struct seq_file *s, void *unused)
+{
+        struct genwqe_dev *cd = s->private;
+        unsigned int i;
+        struct genwqe_reg *regs;
+        regs = kcalloc(GENWQE_FFDC_REGS, sizeof(*regs), GFP_KERNEL);
+        if (regs == NULL)
+                return -ENOMEM;
+        genwqe_stop_traps(cd);
+        genwqe_read_ffdc_regs(cd, regs, GENWQE_FFDC_REGS, 1);
+        genwqe_start_traps(cd);
+        for (i = 0; i < GENWQE_FFDC_REGS; i++) {
+                if (regs[i].addr == 0xffffffff)
+                        break;  /* invalid entries */
+                if (regs[i].val == 0x0ull)
+                        continue;  /* do not print 0x0 FIRs */
+                seq_printf(s, "  0x%08x 0x%016llx\n",
+                           regs[i].addr, regs[i].val);
+        }
+        return 0;
+}
+GENWQE_DEBUGFS_RO(curr_regs, genwqe_curr_regs_show);
+static int genwqe_prev_regs_show(struct seq_file *s, void *unused)
+{
+        struct genwqe_dev *cd = s->private;
+        unsigned int i;
+        struct genwqe_reg *regs = cd->ffdc[GENWQE_DBG_REGS].regs;
+        if (regs == NULL)
+                return -EINVAL;
+        for (i = 0; i < GENWQE_FFDC_REGS; i++) {
+                if (regs[i].addr == 0xffffffff)
+                        break;  /* invalid entries */
+                if (regs[i].val == 0x0ull)
+                        continue;  /* do not print 0x0 FIRs */
+                seq_printf(s, "  0x%08x 0x%016llx\n",
+                           regs[i].addr, regs[i].val);
+        }
+        return 0;
+}
+GENWQE_DEBUGFS_RO(prev_regs, genwqe_prev_regs_show);
+static int genwqe_jtimer_show(struct seq_file *s, void *unused)
+{
+        struct genwqe_dev *cd = s->private;
+        unsigned int vf_num;
+        u64 jtimer;
+        jtimer = genwqe_read_vreg(cd, IO_SLC_VF_APPJOB_TIMEOUT, 0);
+        seq_printf(s, "  PF   0x%016llx %d msec\n", jtimer,
+                   genwqe_pf_jobtimeout_msec);
+        for (vf_num = 0; vf_num < cd->num_vfs; vf_num++) {
+                jtimer = genwqe_read_vreg(cd, IO_SLC_VF_APPJOB_TIMEOUT,
+                                          vf_num + 1);
+                seq_printf(s, "  VF%-2d 0x%016llx %d msec\n", vf_num, jtimer,
+                           cd->vf_jobtimeout_msec[vf_num]);
+        }
+        return 0;
+}
+GENWQE_DEBUGFS_RO(jtimer, genwqe_jtimer_show);
+static int genwqe_queue_working_time_show(struct seq_file *s, void *unused)
+{
+        struct genwqe_dev *cd = s->private;
+        unsigned int vf_num;
+        u64 t;
+        t = genwqe_read_vreg(cd, IO_SLC_VF_QUEUE_WTIME, 0);
+        seq_printf(s, "  PF   0x%016llx\n", t);
+        for (vf_num = 0; vf_num < cd->num_vfs; vf_num++) {
+                t = genwqe_read_vreg(cd, IO_SLC_VF_QUEUE_WTIME, vf_num + 1);
+                seq_printf(s, "  VF%-2d 0x%016llx\n", vf_num, t);
+        }
+        return 0;
+}
+GENWQE_DEBUGFS_RO(queue_working_time, genwqe_queue_working_time_show);
+static int genwqe_ddcb_info_show(struct seq_file *s, void *unused)
+{
+        struct genwqe_dev *cd = s->private;
+        unsigned int i;
+        struct ddcb_queue *queue;
+        struct ddcb *pddcb;
+        queue = &cd->queue;
+        seq_puts(s, "DDCB QUEUE:\n");
+        seq_printf(s, "  ddcb_max:            %d\n"
+                   "  ddcb_daddr:          %016llx - %016llx\n"
+                   "  ddcb_vaddr:          %016llx\n"
+                   "  ddcbs_in_flight:     %u\n"
+                   "  ddcbs_max_in_flight: %u\n"
+                   "  ddcbs_completed:     %u\n"
+                   "  busy:                %u\n"
+                   "  irqs_processed:      %u\n",
+                   queue->ddcb_max, (long long)queue->ddcb_daddr,
+                   (long long)queue->ddcb_daddr +
+                   (queue->ddcb_max * DDCB_LENGTH),
+                   (long long)queue->ddcb_vaddr, queue->ddcbs_in_flight,
+                   queue->ddcbs_max_in_flight, queue->ddcbs_completed,
+                   queue->busy, cd->irqs_processed);
+        /* Hardware State */
+        seq_printf(s, "  0x%08x 0x%016llx IO_QUEUE_CONFIG\n"
+                   "  0x%08x 0x%016llx IO_QUEUE_STATUS\n"
+                   "  0x%08x 0x%016llx IO_QUEUE_SEGMENT\n"
+                   "  0x%08x 0x%016llx IO_QUEUE_INITSQN\n"
+                   "  0x%08x 0x%016llx IO_QUEUE_WRAP\n"
+                   "  0x%08x 0x%016llx IO_QUEUE_OFFSET\n"
+                   "  0x%08x 0x%016llx IO_QUEUE_WTIME\n"
+                   "  0x%08x 0x%016llx IO_QUEUE_ERRCNTS\n"
+                   "  0x%08x 0x%016llx IO_QUEUE_LRW\n",
+                   queue->IO_QUEUE_CONFIG,
+                   __genwqe_readq(cd, queue->IO_QUEUE_CONFIG),
+                   queue->IO_QUEUE_STATUS,
+                   __genwqe_readq(cd, queue->IO_QUEUE_STATUS),
+                   queue->IO_QUEUE_SEGMENT,
+                   __genwqe_readq(cd, queue->IO_QUEUE_SEGMENT),
+                   queue->IO_QUEUE_INITSQN,
+                   __genwqe_readq(cd, queue->IO_QUEUE_INITSQN),
+                   queue->IO_QUEUE_WRAP,
+                   __genwqe_readq(cd, queue->IO_QUEUE_WRAP),
+                   queue->IO_QUEUE_OFFSET,
+                   __genwqe_readq(cd, queue->IO_QUEUE_OFFSET),
+                   queue->IO_QUEUE_WTIME,
+                   __genwqe_readq(cd, queue->IO_QUEUE_WTIME),
+                   queue->IO_QUEUE_ERRCNTS,
+                   __genwqe_readq(cd, queue->IO_QUEUE_ERRCNTS),
+                   queue->IO_QUEUE_LRW,
+                   __genwqe_readq(cd, queue->IO_QUEUE_LRW));
+        seq_printf(s, "DDCB list (ddcb_act=%d/ddcb_next=%d):\n",
+                   queue->ddcb_act, queue->ddcb_next);
+        pddcb = queue->ddcb_vaddr;
+        for (i = 0; i < queue->ddcb_max; i++) {
+                seq_printf(s, "  %-3d: RETC=%03x SEQ=%04x HSI/SHI=%02x/%02x ",
+                           i, be16_to_cpu(pddcb->retc_16),
+                           be16_to_cpu(pddcb->seqnum_16),
+                           pddcb->hsi, pddcb->shi);
+                seq_printf(s, "PRIV=%06llx CMD=%02x\n",
+                           be64_to_cpu(pddcb->priv_64), pddcb->cmd);
+                pddcb++;
+        }
+        return 0;
+}
+GENWQE_DEBUGFS_RO(ddcb_info, genwqe_ddcb_info_show);
+static int genwqe_info_show(struct seq_file *s, void *unused)
+{
+        struct genwqe_dev *cd = s->private;
+        u16 val16, type;
+        u64 app_id, slu_id, bitstream = -1;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        slu_id = __genwqe_readq(cd, IO_SLU_UNITCFG);
+        app_id = __genwqe_readq(cd, IO_APP_UNITCFG);
+        if (genwqe_is_privileged(cd))
+                bitstream = __genwqe_readq(cd, IO_SLU_BITSTREAM);
+        val16 = (u16)(slu_id & 0x0fLLU);
+        type  = (u16)((slu_id >> 20) & 0xffLLU);
+        seq_printf(s, "%s driver version: %s\n"
+                   "    Device Name/Type: %s %s CardIdx: %d\n"
+                   "    SLU/APP Config  : 0x%016llx/0x%016llx\n"
+                   "    Build Date      : %u/%x/%u\n"
+                   "    Base Clock      : %u MHz\n"
+                   "    Arch/SVN Release: %u/%llx\n"
+                   "    Bitstream       : %llx\n",
+                   GENWQE_DEVNAME, DRV_VERS_STRING, dev_name(&pci_dev->dev),
+                   genwqe_is_privileged(cd) ?
+                   "Physical" : "Virtual or no SR-IOV",
+                   cd->card_idx, slu_id, app_id,
+                   (u16)((slu_id >> 12) & 0x0fLLU),        /* month */
+                   (u16)((slu_id >>  4) & 0xffLLU),        /* day */
+                   (u16)((slu_id >> 16) & 0x0fLLU) + 2010, /* year */
+                   genwqe_base_clock_frequency(cd),
+                   (u16)((slu_id >> 32) & 0xffLLU), slu_id >> 40,
+                   bitstream);
+        return 0;
+}
+GENWQE_DEBUGFS_RO(info, genwqe_info_show);
+int genwqe_init_debugfs(struct genwqe_dev *cd)
+{
+        struct dentry *root;
+        struct dentry *file;
+        int ret;
+        char card_name[64];
+        char name[64];
+        unsigned int i;
+        sprintf(card_name, "%s%u_card", GENWQE_DEVNAME, cd->card_idx);
+        root = debugfs_create_dir(card_name, cd->debugfs_genwqe);
+        if (!root) {
+                ret = -ENOMEM;
+                goto err0;
+        }
+        /* non privileged interfaces are done here */
+        file = debugfs_create_file("ddcb_info", S_IRUGO, root, cd,
+                                   &genwqe_ddcb_info_fops);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        file = debugfs_create_file("info", S_IRUGO, root, cd,
+                                   &genwqe_info_fops);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        file = debugfs_create_x64("err_inject", 0666, root, &cd->err_inject);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        file = debugfs_create_u32("ddcb_software_timeout", 0666, root,
+                                  &cd->ddcb_software_timeout);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        file = debugfs_create_u32("kill_timeout", 0666, root,
+                                  &cd->kill_timeout);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        /* privileged interfaces follow here */
+        if (!genwqe_is_privileged(cd)) {
+                cd->debugfs_root = root;
+                return 0;
+        }
+        file = debugfs_create_file("curr_regs", S_IRUGO, root, cd,
+                                   &genwqe_curr_regs_fops);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        file = debugfs_create_file("curr_dbg_uid0", S_IRUGO, root, cd,
+                                   &genwqe_curr_dbg_uid0_fops);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        file = debugfs_create_file("curr_dbg_uid1", S_IRUGO, root, cd,
+                                   &genwqe_curr_dbg_uid1_fops);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        file = debugfs_create_file("curr_dbg_uid2", S_IRUGO, root, cd,
+                                   &genwqe_curr_dbg_uid2_fops);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        file = debugfs_create_file("prev_regs", S_IRUGO, root, cd,
+                                   &genwqe_prev_regs_fops);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        file = debugfs_create_file("prev_dbg_uid0", S_IRUGO, root, cd,
+                                   &genwqe_prev_dbg_uid0_fops);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        file = debugfs_create_file("prev_dbg_uid1", S_IRUGO, root, cd,
+                                   &genwqe_prev_dbg_uid1_fops);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        file = debugfs_create_file("prev_dbg_uid2", S_IRUGO, root, cd,
+                                   &genwqe_prev_dbg_uid2_fops);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        for (i = 0; i <  GENWQE_MAX_VFS; i++) {
+                sprintf(name, "vf%d_jobtimeout_msec", i);
+                file = debugfs_create_u32(name, 0666, root,
+                                          &cd->vf_jobtimeout_msec[i]);
+                if (!file) {
+                        ret = -ENOMEM;
+                        goto err1;
+                }
+        }
+        file = debugfs_create_file("jobtimer", S_IRUGO, root, cd,
+                                   &genwqe_jtimer_fops);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        file = debugfs_create_file("queue_working_time", S_IRUGO, root, cd,
+                                   &genwqe_queue_working_time_fops);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        file = debugfs_create_u32("skip_recovery", 0666, root,
+                                  &cd->skip_recovery);
+        if (!file) {
+                ret = -ENOMEM;
+                goto err1;
+        }
+        cd->debugfs_root = root;
+        return 0;
+err1:
+        debugfs_remove_recursive(root);
+err0:
+        return ret;
+}
+void genqwe_exit_debugfs(struct genwqe_dev *cd)
+{
+        debugfs_remove_recursive(cd->debugfs_root);
+}
diff --git a/drivers/misc/genwqe/card_dev.c b/drivers/misc/genwqe/card_dev.c
new file mode 100644
index 000000000000..8f8a6b327cdb
--- /dev/null
+++ b/drivers/misc/genwqe/card_dev.c
@@ -0,0 +1,1414 @@
+/**
+ * IBM Accelerator Family 'GenWQE'
+ *
+ * (C) Copyright IBM Corp. 2013
+ *
+ * Author: Frank Haverkamp <haver@linux.vnet.ibm.com>
+ * Author: Joerg-Stephan Vogt <jsvogt@de.ibm.com>
+ * Author: Michael Jung <mijung@de.ibm.com>
+ * Author: Michael Ruettger <michael@ibmra.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (version 2 only)
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+/*
+ * Character device representation of the GenWQE device. This allows
+ * user-space applications to communicate with the card.
+ */
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/string.h>
+#include <linux/fs.h>
+#include <linux/sched.h>
+#include <linux/wait.h>
+#include <linux/delay.h>
+#include <linux/atomic.h>
+#include "card_base.h"
+#include "card_ddcb.h"
+static int genwqe_open_files(struct genwqe_dev *cd)
+{
+        int rc;
+        unsigned long flags;
+        spin_lock_irqsave(&cd->file_lock, flags);
+        rc = list_empty(&cd->file_list);
+        spin_unlock_irqrestore(&cd->file_lock, flags);
+        return !rc;
+}
+static void genwqe_add_file(struct genwqe_dev *cd, struct genwqe_file *cfile)
+{
+        unsigned long flags;
+        cfile->owner = current;
+        spin_lock_irqsave(&cd->file_lock, flags);
+        list_add(&cfile->list, &cd->file_list);
+        spin_unlock_irqrestore(&cd->file_lock, flags);
+}
+static int genwqe_del_file(struct genwqe_dev *cd, struct genwqe_file *cfile)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&cd->file_lock, flags);
+        list_del(&cfile->list);
+        spin_unlock_irqrestore(&cd->file_lock, flags);
+        return 0;
+}
+static void genwqe_add_pin(struct genwqe_file *cfile, struct dma_mapping *m)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&cfile->pin_lock, flags);
+        list_add(&m->pin_list, &cfile->pin_list);
+        spin_unlock_irqrestore(&cfile->pin_lock, flags);
+}
+static int genwqe_del_pin(struct genwqe_file *cfile, struct dma_mapping *m)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&cfile->pin_lock, flags);
+        list_del(&m->pin_list);
+        spin_unlock_irqrestore(&cfile->pin_lock, flags);
+        return 0;
+}
+/**
+ * genwqe_search_pin() - Search for the mapping for a userspace address
+ * @cfile:      Descriptor of opened file
+ * @u_addr:     User virtual address
+ * @size:       Size of buffer
+ * @dma_addr:   DMA address to be updated
+ *
+ * Return: Pointer to the corresponding mapping NULL if not found
+ */
+static struct dma_mapping *genwqe_search_pin(struct genwqe_file *cfile,
+                                            unsigned long u_addr,
+                                            unsigned int size,
+                                            void **virt_addr)
+{
+        unsigned long flags;
+        struct dma_mapping *m;
+        spin_lock_irqsave(&cfile->pin_lock, flags);
+        list_for_each_entry(m, &cfile->pin_list, pin_list) {
+                if ((((u64)m->u_vaddr) <= (u_addr)) &&
+                    (((u64)m->u_vaddr + m->size) >= (u_addr + size))) {
+                        if (virt_addr)
+                                *virt_addr = m->k_vaddr +
+                                        (u_addr - (u64)m->u_vaddr);
+                        spin_unlock_irqrestore(&cfile->pin_lock, flags);
+                        return m;
+                }
+        }
+        spin_unlock_irqrestore(&cfile->pin_lock, flags);
+        return NULL;
+}
+static void __genwqe_add_mapping(struct genwqe_file *cfile,
+                              struct dma_mapping *dma_map)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&cfile->map_lock, flags);
+        list_add(&dma_map->card_list, &cfile->map_list);
+        spin_unlock_irqrestore(&cfile->map_lock, flags);
+}
+static void __genwqe_del_mapping(struct genwqe_file *cfile,
+                              struct dma_mapping *dma_map)
+{
+        unsigned long flags;
+        spin_lock_irqsave(&cfile->map_lock, flags);
+        list_del(&dma_map->card_list);
+        spin_unlock_irqrestore(&cfile->map_lock, flags);
+}
+/**
+ * __genwqe_search_mapping() - Search for the mapping for a userspace address
+ * @cfile:      descriptor of opened file
+ * @u_addr:     user virtual address
+ * @size:       size of buffer
+ * @dma_addr:   DMA address to be updated
+ * Return: Pointer to the corresponding mapping NULL if not found
+ */
+static struct dma_mapping *__genwqe_search_mapping(struct genwqe_file *cfile,
+                                                   unsigned long u_addr,
+                                                   unsigned int size,
+                                                   dma_addr_t *dma_addr,
+                                                   void **virt_addr)
+{
+        unsigned long flags;
+        struct dma_mapping *m;
+        struct pci_dev *pci_dev = cfile->cd->pci_dev;
+        spin_lock_irqsave(&cfile->map_lock, flags);
+        list_for_each_entry(m, &cfile->map_list, card_list) {
+                if ((((u64)m->u_vaddr) <= (u_addr)) &&
+                    (((u64)m->u_vaddr + m->size) >= (u_addr + size))) {
+                        /* match found: current is as expected and
+                           addr is in range */
+                        if (dma_addr)
+                                *dma_addr = m->dma_addr +
+                                        (u_addr - (u64)m->u_vaddr);
+                        if (virt_addr)
+                                *virt_addr = m->k_vaddr +
+                                        (u_addr - (u64)m->u_vaddr);
+                        spin_unlock_irqrestore(&cfile->map_lock, flags);
+                        return m;
+                }
+        }
+        spin_unlock_irqrestore(&cfile->map_lock, flags);
+        dev_err(&pci_dev->dev,
+                "[%s] Entry not found: u_addr=%lx, size=%x\n",
+                __func__, u_addr, size);
+        return NULL;
+}
+static void genwqe_remove_mappings(struct genwqe_file *cfile)
+{
+        int i = 0;
+        struct list_head *node, *next;
+        struct dma_mapping *dma_map;
+        struct genwqe_dev *cd = cfile->cd;
+        struct pci_dev *pci_dev = cfile->cd->pci_dev;
+        list_for_each_safe(node, next, &cfile->map_list) {
+                dma_map = list_entry(node, struct dma_mapping, card_list);
+                list_del_init(&dma_map->card_list);
+                /*
+                 * This is really a bug, because those things should
+                 * have been already tidied up.
+                 *
+                 * GENWQE_MAPPING_RAW should have been removed via mmunmap().
+                 * GENWQE_MAPPING_SGL_TEMP should be removed by tidy up code.
+                 */
+                dev_err(&pci_dev->dev,
+                        "[%s] %d. cleanup mapping: u_vaddr=%p "
+                        "u_kaddr=%016lx dma_addr=%lx\n", __func__, i++,
+                        dma_map->u_vaddr, (unsigned long)dma_map->k_vaddr,
+                        (unsigned long)dma_map->dma_addr);
+                if (dma_map->type == GENWQE_MAPPING_RAW) {
+                        /* we allocated this dynamically */
+                        __genwqe_free_consistent(cd, dma_map->size,
+                                                dma_map->k_vaddr,
+                                                dma_map->dma_addr);
+                        kfree(dma_map);
+                } else if (dma_map->type == GENWQE_MAPPING_SGL_TEMP) {
+                        /* we use dma_map statically from the request */
+                        genwqe_user_vunmap(cd, dma_map, NULL);
+                }
+        }
+}
+static void genwqe_remove_pinnings(struct genwqe_file *cfile)
+{
+        struct list_head *node, *next;
+        struct dma_mapping *dma_map;
+        struct genwqe_dev *cd = cfile->cd;
+        list_for_each_safe(node, next, &cfile->pin_list) {
+                dma_map = list_entry(node, struct dma_mapping, pin_list);
+                /*
+                 * This is not a bug, because a killed processed might
+                 * not call the unpin ioctl, which is supposed to free
+                 * the resources.
+                 *
+                 * Pinnings are dymically allocated and need to be
+                 * deleted.
+                 */
+                list_del_init(&dma_map->pin_list);
+                genwqe_user_vunmap(cd, dma_map, NULL);
+                kfree(dma_map);
+        }
+}
+/**
+ * genwqe_kill_fasync() - Send signal to all processes with open GenWQE files
+ *
+ * E.g. genwqe_send_signal(cd, SIGIO);
+ */
+static int genwqe_kill_fasync(struct genwqe_dev *cd, int sig)
+{
+        unsigned int files = 0;
+        unsigned long flags;
+        struct genwqe_file *cfile;
+        spin_lock_irqsave(&cd->file_lock, flags);
+        list_for_each_entry(cfile, &cd->file_list, list) {
+                if (cfile->async_queue)
+                        kill_fasync(&cfile->async_queue, sig, POLL_HUP);
+                files++;
+        }
+        spin_unlock_irqrestore(&cd->file_lock, flags);
+        return files;
+}
+static int genwqe_force_sig(struct genwqe_dev *cd, int sig)
+{
+        unsigned int files = 0;
+        unsigned long flags;
+        struct genwqe_file *cfile;
+        spin_lock_irqsave(&cd->file_lock, flags);
+        list_for_each_entry(cfile, &cd->file_list, list) {
+                force_sig(sig, cfile->owner);
+                files++;
+        }
+        spin_unlock_irqrestore(&cd->file_lock, flags);
+        return files;
+}
+/**
+ * genwqe_open() - file open
+ * @inode:      file system information
+ * @filp:       file handle
+ *
+ * This function is executed whenever an application calls
+ * open("/dev/genwqe",..).
+ *
+ * Return: 0 if successful or <0 if errors
+ */
+static int genwqe_open(struct inode *inode, struct file *filp)
+{
+        struct genwqe_dev *cd;
+        struct genwqe_file *cfile;
+        struct pci_dev *pci_dev;
+        cfile = kzalloc(sizeof(*cfile), GFP_KERNEL);
+        if (cfile == NULL)
+                return -ENOMEM;
+        cd = container_of(inode->i_cdev, struct genwqe_dev, cdev_genwqe);
+        pci_dev = cd->pci_dev;
+        cfile->cd = cd;
+        cfile->filp = filp;
+        cfile->client = NULL;
+        spin_lock_init(&cfile->map_lock);  /* list of raw memory allocations */
+        INIT_LIST_HEAD(&cfile->map_list);
+        spin_lock_init(&cfile->pin_lock);  /* list of user pinned memory */
+        INIT_LIST_HEAD(&cfile->pin_list);
+        filp->private_data = cfile;
+        genwqe_add_file(cd, cfile);
+        return 0;
+}
+/**
+ * genwqe_fasync() - Setup process to receive SIGIO.
+ * @fd:        file descriptor
+ * @filp:      file handle
+ * @mode:      file mode
+ *
+ * Sending a signal is working as following:
+ *
+ * if (cdev->async_queue)
+ *         kill_fasync(&cdev->async_queue, SIGIO, POLL_IN);
+ *
+ * Some devices also implement asynchronous notification to indicate
+ * when the device can be written; in this case, of course,
+ * kill_fasync must be called with a mode of POLL_OUT.
+ */
+static int genwqe_fasync(int fd, struct file *filp, int mode)
+{
+        struct genwqe_file *cdev = (struct genwqe_file *)filp->private_data;
+        return fasync_helper(fd, filp, mode, &cdev->async_queue);
+}
+/**
+ * genwqe_release() - file close
+ * @inode:      file system information
+ * @filp:       file handle
+ *
+ * This function is executed whenever an application calls 'close(fd_genwqe)'
+ *
+ * Return: always 0
+ */
+static int genwqe_release(struct inode *inode, struct file *filp)
+{
+        struct genwqe_file *cfile = (struct genwqe_file *)filp->private_data;
+        struct genwqe_dev *cd = cfile->cd;
+        /* there must be no entries in these lists! */
+        genwqe_remove_mappings(cfile);
+        genwqe_remove_pinnings(cfile);
+        /* remove this filp from the asynchronously notified filp's */
+        genwqe_fasync(-1, filp, 0);
+        /*
+         * For this to work we must not release cd when this cfile is
+         * not yet released, otherwise the list entry is invalid,
+         * because the list itself gets reinstantiated!
+         */
+        genwqe_del_file(cd, cfile);
+        kfree(cfile);
+        return 0;
+}
+static void genwqe_vma_open(struct vm_area_struct *vma)
+{
+        /* nothing ... */
+}
+/**
+ * genwqe_vma_close() - Called each time when vma is unmapped
+ *
+ * Free memory which got allocated by GenWQE mmap().
+ */
+static void genwqe_vma_close(struct vm_area_struct *vma)
+{
+        unsigned long vsize = vma->vm_end - vma->vm_start;
+        struct inode *inode = vma->vm_file->f_dentry->d_inode;
+        struct dma_mapping *dma_map;
+        struct genwqe_dev *cd = container_of(inode->i_cdev, struct genwqe_dev,
+                                            cdev_genwqe);
+        struct pci_dev *pci_dev = cd->pci_dev;
+        dma_addr_t d_addr = 0;
+        struct genwqe_file *cfile = vma->vm_private_data;
+        dma_map = __genwqe_search_mapping(cfile, vma->vm_start, vsize,
+                                         &d_addr, NULL);
+        if (dma_map == NULL) {
+                dev_err(&pci_dev->dev,
+                        "  [%s] err: mapping not found: v=%lx, p=%lx s=%lx\n",
+                        __func__, vma->vm_start, vma->vm_pgoff << PAGE_SHIFT,
+                        vsize);
+                return;
+        }
+        __genwqe_del_mapping(cfile, dma_map);
+        __genwqe_free_consistent(cd, dma_map->size, dma_map->k_vaddr,
+                                 dma_map->dma_addr);
+        kfree(dma_map);
+}
+static struct vm_operations_struct genwqe_vma_ops = {
+        .open   = genwqe_vma_open,
+        .close  = genwqe_vma_close,
+};
+/**
+ * genwqe_mmap() - Provide contignous buffers to userspace
+ *
+ * We use mmap() to allocate contignous buffers used for DMA
+ * transfers. After the buffer is allocated we remap it to user-space
+ * and remember a reference to our dma_mapping data structure, where
+ * we store the associated DMA address and allocated size.
+ *
+ * When we receive a DDCB execution request with the ATS bits set to
+ * plain buffer, we lookup our dma_mapping list to find the
+ * corresponding DMA address for the associated user-space address.
+ */
+static int genwqe_mmap(struct file *filp, struct vm_area_struct *vma)
+{
+        int rc;
+        unsigned long pfn, vsize = vma->vm_end - vma->vm_start;
+        struct genwqe_file *cfile = (struct genwqe_file *)filp->private_data;
+        struct genwqe_dev *cd = cfile->cd;
+        struct dma_mapping *dma_map;
+        if (vsize == 0)
+                return -EINVAL;
+        if (get_order(vsize) > MAX_ORDER)
+                return -ENOMEM;
+        dma_map = kzalloc(sizeof(struct dma_mapping), GFP_ATOMIC);
+        if (dma_map == NULL)
+                return -ENOMEM;
+        genwqe_mapping_init(dma_map, GENWQE_MAPPING_RAW);
+        dma_map->u_vaddr = (void *)vma->vm_start;
+        dma_map->size = vsize;
+        dma_map->nr_pages = DIV_ROUND_UP(vsize, PAGE_SIZE);
+        dma_map->k_vaddr = __genwqe_alloc_consistent(cd, vsize,
+                                                     &dma_map->dma_addr);
+        if (dma_map->k_vaddr == NULL) {
+                rc = -ENOMEM;
+                goto free_dma_map;
+        }
+        if (capable(CAP_SYS_ADMIN) && (vsize > sizeof(dma_addr_t)))
+                *(dma_addr_t *)dma_map->k_vaddr = dma_map->dma_addr;
+        pfn = virt_to_phys(dma_map->k_vaddr) >> PAGE_SHIFT;
+        rc = remap_pfn_range(vma,
+                             vma->vm_start,
+                             pfn,
+                             vsize,
+                             vma->vm_page_prot);
+        if (rc != 0) {
+                rc = -EFAULT;
+                goto free_dma_mem;
+        }
+        vma->vm_private_data = cfile;
+        vma->vm_ops = &genwqe_vma_ops;
+        __genwqe_add_mapping(cfile, dma_map);
+        return 0;
+ free_dma_mem:
+        __genwqe_free_consistent(cd, dma_map->size,
+                                dma_map->k_vaddr,
+                                dma_map->dma_addr);
+ free_dma_map:
+        kfree(dma_map);
+        return rc;
+}
+/**
+ * do_flash_update() - Excute flash update (write image or CVPD)
+ * @cd:        genwqe device
+ * @load:      details about image load
+ *
+ * Return: 0 if successful
+ */
+#define FLASH_BLOCK     0x40000 /* we use 256k blocks */
+static int do_flash_update(struct genwqe_file *cfile,
+                           struct genwqe_bitstream *load)
+{
+        int rc = 0;
+        int blocks_to_flash;
+        dma_addr_t dma_addr;
+        u64 flash = 0;
+        size_t tocopy = 0;
+        u8 __user *buf;
+        u8 *xbuf;
+        u32 crc;
+        u8 cmdopts;
+        struct genwqe_dev *cd = cfile->cd;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if ((load->size & 0x3) != 0)
+                return -EINVAL;
+        if (((unsigned long)(load->data_addr) & ~PAGE_MASK) != 0)
+                return -EINVAL;
+        /* FIXME Bits have changed for new service layer! */
+        switch ((char)load->partition) {
+        case '0':
+                cmdopts = 0x14;
+                break;          /* download/erase_first/part_0 */
+        case '1':
+                cmdopts = 0x1C;
+                break;          /* download/erase_first/part_1 */
+        case 'v':               /* cmdopts = 0x0c (VPD) */
+        default:
+                return -EINVAL;
+        }
+        buf = (u8 __user *)load->data_addr;
+        xbuf = __genwqe_alloc_consistent(cd, FLASH_BLOCK, &dma_addr);
+        if (xbuf == NULL)
+                return -ENOMEM;
+        blocks_to_flash = load->size / FLASH_BLOCK;
+        while (load->size) {
+                struct genwqe_ddcb_cmd *req;
+                /*
+                 * We must be 4 byte aligned. Buffer must be 0 appened
+                 * to have defined values when calculating CRC.
+                 */
+                tocopy = min_t(size_t, load->size, FLASH_BLOCK);
+                rc = copy_from_user(xbuf, buf, tocopy);
+                if (rc) {
+                        rc = -EFAULT;
+                        goto free_buffer;
+                }
+                crc = genwqe_crc32(xbuf, tocopy, 0xffffffff);
+                dev_dbg(&pci_dev->dev,
+                        "[%s] DMA: %lx CRC: %08x SZ: %ld %d\n",
+                        __func__, (unsigned long)dma_addr, crc, tocopy,
+                        blocks_to_flash);
+                /* prepare DDCB for SLU process */
+                req = ddcb_requ_alloc();
+                if (req == NULL) {
+                        rc = -ENOMEM;
+                        goto free_buffer;
+                }
+                req->cmd = SLCMD_MOVE_FLASH;
+                req->cmdopts = cmdopts;
+                /* prepare invariant values */
+                if (genwqe_get_slu_id(cd) <= 0x2) {
+                        *(__be64 *)&req->__asiv[0]  = cpu_to_be64(dma_addr);
+                        *(__be64 *)&req->__asiv[8]  = cpu_to_be64(tocopy);
+                        *(__be64 *)&req->__asiv[16] = cpu_to_be64(flash);
+                        *(__be32 *)&req->__asiv[24] = cpu_to_be32(0);
+                        req->__asiv[24]        = load->uid;
+                        *(__be32 *)&req->__asiv[28] = cpu_to_be32(crc);
+                        /* for simulation only */
+                        *(__be64 *)&req->__asiv[88] = cpu_to_be64(load->slu_id);
+                        *(__be64 *)&req->__asiv[96] = cpu_to_be64(load->app_id);
+                        req->asiv_length = 32; /* bytes included in crc calc */
+                } else {        /* setup DDCB for ATS architecture */
+                        *(__be64 *)&req->asiv[0]  = cpu_to_be64(dma_addr);
+                        *(__be32 *)&req->asiv[8]  = cpu_to_be32(tocopy);
+                        *(__be32 *)&req->asiv[12] = cpu_to_be32(0); /* resvd */
+                        *(__be64 *)&req->asiv[16] = cpu_to_be64(flash);
+                        *(__be32 *)&req->asiv[24] = cpu_to_be32(load->uid<<24);
+                        *(__be32 *)&req->asiv[28] = cpu_to_be32(crc);
+                        /* for simulation only */
+                        *(__be64 *)&req->asiv[80] = cpu_to_be64(load->slu_id);
+                        *(__be64 *)&req->asiv[88] = cpu_to_be64(load->app_id);
+                        /* Rd only */
+                        req->ats = 0x4ULL << 44;
+                        req->asiv_length = 40; /* bytes included in crc calc */
+                }
+                req->asv_length  = 8;
+                /* For Genwqe5 we get back the calculated CRC */
+                *(u64 *)&req->asv[0] = 0ULL;                    /* 0x80 */
+                rc = __genwqe_execute_raw_ddcb(cd, req);
+                load->retc = req->retc;
+                load->attn = req->attn;
+                load->progress = req->progress;
+                if (rc < 0) {
+                        ddcb_requ_free(req);
+                        goto free_buffer;
+                }
+                if (req->retc != DDCB_RETC_COMPLETE) {
+                        rc = -EIO;
+                        ddcb_requ_free(req);
+                        goto free_buffer;
+                }
+                load->size  -= tocopy;
+                flash += tocopy;
+                buf += tocopy;
+                blocks_to_flash--;
+                ddcb_requ_free(req);
+        }
+ free_buffer:
+        __genwqe_free_consistent(cd, FLASH_BLOCK, xbuf, dma_addr);
+        return rc;
+}
+static int do_flash_read(struct genwqe_file *cfile,
+                         struct genwqe_bitstream *load)
+{
+        int rc, blocks_to_flash;
+        dma_addr_t dma_addr;
+        u64 flash = 0;
+        size_t tocopy = 0;
+        u8 __user *buf;
+        u8 *xbuf;
+        u8 cmdopts;
+        struct genwqe_dev *cd = cfile->cd;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        struct genwqe_ddcb_cmd *cmd;
+        if ((load->size & 0x3) != 0)
+                return -EINVAL;
+        if (((unsigned long)(load->data_addr) & ~PAGE_MASK) != 0)
+                return -EINVAL;
+        /* FIXME Bits have changed for new service layer! */
+        switch ((char)load->partition) {
+        case '0':
+                cmdopts = 0x12;
+                break;          /* upload/part_0 */
+        case '1':
+                cmdopts = 0x1A;
+                break;          /* upload/part_1 */
+        case 'v':
+        default:
+                return -EINVAL;
+        }
+        buf = (u8 __user *)load->data_addr;
+        xbuf = __genwqe_alloc_consistent(cd, FLASH_BLOCK, &dma_addr);
+        if (xbuf == NULL)
+                return -ENOMEM;
+        blocks_to_flash = load->size / FLASH_BLOCK;
+        while (load->size) {
+                /*
+                 * We must be 4 byte aligned. Buffer must be 0 appened
+                 * to have defined values when calculating CRC.
+                 */
+                tocopy = min_t(size_t, load->size, FLASH_BLOCK);
+                dev_dbg(&pci_dev->dev,
+                        "[%s] DMA: %lx SZ: %ld %d\n",
+                        __func__, (unsigned long)dma_addr, tocopy,
+                        blocks_to_flash);
+                /* prepare DDCB for SLU process */
+                cmd = ddcb_requ_alloc();
+                if (cmd == NULL) {
+                        rc = -ENOMEM;
+                        goto free_buffer;
+                }
+                cmd->cmd = SLCMD_MOVE_FLASH;
+                cmd->cmdopts = cmdopts;
+                /* prepare invariant values */
+                if (genwqe_get_slu_id(cd) <= 0x2) {
+                        *(__be64 *)&cmd->__asiv[0]  = cpu_to_be64(dma_addr);
+                        *(__be64 *)&cmd->__asiv[8]  = cpu_to_be64(tocopy);
+                        *(__be64 *)&cmd->__asiv[16] = cpu_to_be64(flash);
+                        *(__be32 *)&cmd->__asiv[24] = cpu_to_be32(0);
+                        cmd->__asiv[24] = load->uid;
+                        *(__be32 *)&cmd->__asiv[28] = cpu_to_be32(0) /* CRC */;
+                        cmd->asiv_length = 32; /* bytes included in crc calc */
+                } else {        /* setup DDCB for ATS architecture */
+                        *(__be64 *)&cmd->asiv[0]  = cpu_to_be64(dma_addr);
+                        *(__be32 *)&cmd->asiv[8]  = cpu_to_be32(tocopy);
+                        *(__be32 *)&cmd->asiv[12] = cpu_to_be32(0); /* resvd */
+                        *(__be64 *)&cmd->asiv[16] = cpu_to_be64(flash);
+                        *(__be32 *)&cmd->asiv[24] = cpu_to_be32(load->uid<<24);
+                        *(__be32 *)&cmd->asiv[28] = cpu_to_be32(0); /* CRC */
+                        /* rd/wr */
+                        cmd->ats = 0x5ULL << 44;
+                        cmd->asiv_length = 40; /* bytes included in crc calc */
+                }
+                cmd->asv_length  = 8;
+                /* we only get back the calculated CRC */
+                *(u64 *)&cmd->asv[0] = 0ULL;    /* 0x80 */
+                rc = __genwqe_execute_raw_ddcb(cd, cmd);
+                load->retc = cmd->retc;
+                load->attn = cmd->attn;
+                load->progress = cmd->progress;
+                if ((rc < 0) && (rc != -EBADMSG)) {
+                        ddcb_requ_free(cmd);
+                        goto free_buffer;
+                }
+                rc = copy_to_user(buf, xbuf, tocopy);
+                if (rc) {
+                        rc = -EFAULT;
+                        ddcb_requ_free(cmd);
+                        goto free_buffer;
+                }
+                /* We know that we can get retc 0x104 with CRC err */
+                if (((cmd->retc == DDCB_RETC_FAULT) &&
+                     (cmd->attn != 0x02)) ||  /* Normally ignore CRC error */
+                    ((cmd->retc == DDCB_RETC_COMPLETE) &&
+                     (cmd->attn != 0x00))) {  /* Everything was fine */
+                        rc = -EIO;
+                        ddcb_requ_free(cmd);
+                        goto free_buffer;
+                }
+                load->size  -= tocopy;
+                flash += tocopy;
+                buf += tocopy;
+                blocks_to_flash--;
+                ddcb_requ_free(cmd);
+        }
+        rc = 0;
+ free_buffer:
+        __genwqe_free_consistent(cd, FLASH_BLOCK, xbuf, dma_addr);
+        return rc;
+}
+static int genwqe_pin_mem(struct genwqe_file *cfile, struct genwqe_mem *m)
+{
+        int rc;
+        struct genwqe_dev *cd = cfile->cd;
+        struct pci_dev *pci_dev = cfile->cd->pci_dev;
+        struct dma_mapping *dma_map;
+        unsigned long map_addr;
+        unsigned long map_size;
+        if ((m->addr == 0x0) || (m->size == 0))
+                return -EINVAL;
+        map_addr = (m->addr & PAGE_MASK);
+        map_size = round_up(m->size + (m->addr & ~PAGE_MASK), PAGE_SIZE);
+        dma_map = kzalloc(sizeof(struct dma_mapping), GFP_ATOMIC);
+        if (dma_map == NULL)
+                return -ENOMEM;
+        genwqe_mapping_init(dma_map, GENWQE_MAPPING_SGL_PINNED);
+        rc = genwqe_user_vmap(cd, dma_map, (void *)map_addr, map_size, NULL);
+        if (rc != 0) {
+                dev_err(&pci_dev->dev,
+                        "[%s] genwqe_user_vmap rc=%d\n", __func__, rc);
+                return rc;
+        }
+        genwqe_add_pin(cfile, dma_map);
+        return 0;
+}
+static int genwqe_unpin_mem(struct genwqe_file *cfile, struct genwqe_mem *m)
+{
+        struct genwqe_dev *cd = cfile->cd;
+        struct dma_mapping *dma_map;
+        unsigned long map_addr;
+        unsigned long map_size;
+        if (m->addr == 0x0)
+                return -EINVAL;
+        map_addr = (m->addr & PAGE_MASK);
+        map_size = round_up(m->size + (m->addr & ~PAGE_MASK), PAGE_SIZE);
+        dma_map = genwqe_search_pin(cfile, map_addr, map_size, NULL);
+        if (dma_map == NULL)
+                return -ENOENT;
+        genwqe_del_pin(cfile, dma_map);
+        genwqe_user_vunmap(cd, dma_map, NULL);
+        kfree(dma_map);
+        return 0;
+}
+/**
+ * ddcb_cmd_cleanup() - Remove dynamically created fixup entries
+ *
+ * Only if there are any. Pinnings are not removed.
+ */
+static int ddcb_cmd_cleanup(struct genwqe_file *cfile, struct ddcb_requ *req)
+{
+        unsigned int i;
+        struct dma_mapping *dma_map;
+        struct genwqe_dev *cd = cfile->cd;
+        for (i = 0; i < DDCB_FIXUPS; i++) {
+                dma_map = &req->dma_mappings[i];
+                if (dma_mapping_used(dma_map)) {
+                        __genwqe_del_mapping(cfile, dma_map);
+                        genwqe_user_vunmap(cd, dma_map, req);
+                }
+                if (req->sgl[i] != NULL) {
+                        genwqe_free_sgl(cd, req->sgl[i],
+                                       req->sgl_dma_addr[i],
+                                       req->sgl_size[i]);
+                        req->sgl[i] = NULL;
+                        req->sgl_dma_addr[i] = 0x0;
+                        req->sgl_size[i] = 0;
+                }
+        }
+        return 0;
+}
+/**
+ * ddcb_cmd_fixups() - Establish DMA fixups/sglists for user memory references
+ *
+ * Before the DDCB gets executed we need to handle the fixups. We
+ * replace the user-space addresses with DMA addresses or do
+ * additional setup work e.g. generating a scatter-gather list which
+ * is used to describe the memory referred to in the fixup.
+ */
+static int ddcb_cmd_fixups(struct genwqe_file *cfile, struct ddcb_requ *req)
+{
+        int rc;
+        unsigned int asiv_offs, i;
+        struct genwqe_dev *cd = cfile->cd;
+        struct genwqe_ddcb_cmd *cmd = &req->cmd;
+        struct dma_mapping *m;
+        const char *type = "UNKNOWN";
+        for (i = 0, asiv_offs = 0x00; asiv_offs <= 0x58;
+             i++, asiv_offs += 0x08) {
+                u64 u_addr;
+                dma_addr_t d_addr;
+                u32 u_size = 0;
+                u64 ats_flags;
+                ats_flags = ATS_GET_FLAGS(cmd->ats, asiv_offs);
+                switch (ats_flags) {
+                case ATS_TYPE_DATA:
+                        break;  /* nothing to do here */
+                case ATS_TYPE_FLAT_RDWR:
+                case ATS_TYPE_FLAT_RD: {
+                        u_addr = be64_to_cpu(*((__be64 *)&cmd->
+                                               asiv[asiv_offs]));
+                        u_size = be32_to_cpu(*((__be32 *)&cmd->
+                                               asiv[asiv_offs + 0x08]));
+                        /*
+                         * No data available. Ignore u_addr in this
+                         * case and set addr to 0. Hardware must not
+                         * fetch the buffer.
+                         */
+                        if (u_size == 0x0) {
+                                *((__be64 *)&cmd->asiv[asiv_offs]) =
+                                        cpu_to_be64(0x0);
+                                break;
+                        }
+                        m = __genwqe_search_mapping(cfile, u_addr, u_size,
+                                                   &d_addr, NULL);
+                        if (m == NULL) {
+                                rc = -EFAULT;
+                                goto err_out;
+                        }
+                        *((__be64 *)&cmd->asiv[asiv_offs]) =
+                                cpu_to_be64(d_addr);
+                        break;
+                }
+                case ATS_TYPE_SGL_RDWR:
+                case ATS_TYPE_SGL_RD: {
+                        int page_offs, nr_pages, offs;
+                        u_addr = be64_to_cpu(*((__be64 *)
+                                               &cmd->asiv[asiv_offs]));
+                        u_size = be32_to_cpu(*((__be32 *)
+                                               &cmd->asiv[asiv_offs + 0x08]));
+                        /*
+                         * No data available. Ignore u_addr in this
+                         * case and set addr to 0. Hardware must not
+                         * fetch the empty sgl.
+                         */
+                        if (u_size == 0x0) {
+                                *((__be64 *)&cmd->asiv[asiv_offs]) =
+                                        cpu_to_be64(0x0);
+                                break;
+                        }
+                        m = genwqe_search_pin(cfile, u_addr, u_size, NULL);
+                        if (m != NULL) {
+                                type = "PINNING";
+                                page_offs = (u_addr -
+                                             (u64)m->u_vaddr)/PAGE_SIZE;
+                        } else {
+                                type = "MAPPING";
+                                m = &req->dma_mappings[i];
+                                genwqe_mapping_init(m,
+                                                    GENWQE_MAPPING_SGL_TEMP);
+                                rc = genwqe_user_vmap(cd, m, (void *)u_addr,
+                                                      u_size, req);
+                                if (rc != 0)
+                                        goto err_out;
+                                __genwqe_add_mapping(cfile, m);
+                                page_offs = 0;
+                        }
+                        offs = offset_in_page(u_addr);
+                        nr_pages = DIV_ROUND_UP(offs + u_size, PAGE_SIZE);
+                        /* create genwqe style scatter gather list */
+                        req->sgl[i] = genwqe_alloc_sgl(cd, m->nr_pages,
+                                                      &req->sgl_dma_addr[i],
+                                                      &req->sgl_size[i]);
+                        if (req->sgl[i] == NULL) {
+                                rc = -ENOMEM;
+                                goto err_out;
+                        }
+                        genwqe_setup_sgl(cd, offs, u_size,
+                                        req->sgl[i],
+                                        req->sgl_dma_addr[i],
+                                        req->sgl_size[i],
+                                        m->dma_list,
+                                        page_offs,
+                                        nr_pages);
+                        *((__be64 *)&cmd->asiv[asiv_offs]) =
+                                cpu_to_be64(req->sgl_dma_addr[i]);
+                        break;
+                }
+                default:
+                        rc = -EINVAL;
+                        goto err_out;
+                }
+        }
+        return 0;
+ err_out:
+        ddcb_cmd_cleanup(cfile, req);
+        return rc;
+}
+/**
+ * genwqe_execute_ddcb() - Execute DDCB using userspace address fixups
+ *
+ * The code will build up the translation tables or lookup the
+ * contignous memory allocation table to find the right translations
+ * and DMA addresses.
+ */
+static int genwqe_execute_ddcb(struct genwqe_file *cfile,
+                               struct genwqe_ddcb_cmd *cmd)
+{
+        int rc;
+        struct genwqe_dev *cd = cfile->cd;
+        struct ddcb_requ *req = container_of(cmd, struct ddcb_requ, cmd);
+        rc = ddcb_cmd_fixups(cfile, req);
+        if (rc != 0)
+                return rc;
+        rc = __genwqe_execute_raw_ddcb(cd, cmd);
+        ddcb_cmd_cleanup(cfile, req);
+        return rc;
+}
+static int do_execute_ddcb(struct genwqe_file *cfile,
+                           unsigned long arg, int raw)
+{
+        int rc;
+        struct genwqe_ddcb_cmd *cmd;
+        struct ddcb_requ *req;
+        struct genwqe_dev *cd = cfile->cd;
+        cmd = ddcb_requ_alloc();
+        if (cmd == NULL)
+                return -ENOMEM;
+        req = container_of(cmd, struct ddcb_requ, cmd);
+        if (copy_from_user(cmd, (void __user *)arg, sizeof(*cmd))) {
+                ddcb_requ_free(cmd);
+                return -EFAULT;
+        }
+        if (!raw)
+                rc = genwqe_execute_ddcb(cfile, cmd);
+        else
+                rc = __genwqe_execute_raw_ddcb(cd, cmd);
+        /* Copy back only the modifed fields. Do not copy ASIV
+           back since the copy got modified by the driver. */
+        if (copy_to_user((void __user *)arg, cmd,
+                         sizeof(*cmd) - DDCB_ASIV_LENGTH)) {
+                ddcb_requ_free(cmd);
+                return -EFAULT;
+        }
+        ddcb_requ_free(cmd);
+        return rc;
+}
+/**
+ * genwqe_ioctl() - IO control
+ * @filp:       file handle
+ * @cmd:        command identifier (passed from user)
+ * @arg:        argument (passed from user)
+ *
+ * Return: 0 success
+ */
+static long genwqe_ioctl(struct file *filp, unsigned int cmd,
+                         unsigned long arg)
+{
+        int rc = 0;
+        struct genwqe_file *cfile = (struct genwqe_file *)filp->private_data;
+        struct genwqe_dev *cd = cfile->cd;
+        struct genwqe_reg_io __user *io;
+        u64 val;
+        u32 reg_offs;
+        if (_IOC_TYPE(cmd) != GENWQE_IOC_CODE)
+                return -EINVAL;
+        switch (cmd) {
+        case GENWQE_GET_CARD_STATE:
+                put_user(cd->card_state, (enum genwqe_card_state __user *)arg);
+                return 0;
+                /* Register access */
+        case GENWQE_READ_REG64: {
+                io = (struct genwqe_reg_io __user *)arg;
+                if (get_user(reg_offs, &io->num))
+                        return -EFAULT;
+                if ((reg_offs >= cd->mmio_len) || (reg_offs & 0x7))
+                        return -EINVAL;
+                val = __genwqe_readq(cd, reg_offs);
+                put_user(val, &io->val64);
+                return 0;
+        }
+        case GENWQE_WRITE_REG64: {
+                io = (struct genwqe_reg_io __user *)arg;
+                if (!capable(CAP_SYS_ADMIN))
+                        return -EPERM;
+                if ((filp->f_flags & O_ACCMODE) == O_RDONLY)
+                        return -EPERM;
+                if (get_user(reg_offs, &io->num))
+                        return -EFAULT;
+                if ((reg_offs >= cd->mmio_len) || (reg_offs & 0x7))
+                        return -EINVAL;
+                if (get_user(val, &io->val64))
+                        return -EFAULT;
+                __genwqe_writeq(cd, reg_offs, val);
+                return 0;
+        }
+        case GENWQE_READ_REG32: {
+                io = (struct genwqe_reg_io __user *)arg;
+                if (get_user(reg_offs, &io->num))
+                        return -EFAULT;
+                if ((reg_offs >= cd->mmio_len) || (reg_offs & 0x3))
+                        return -EINVAL;
+                val = __genwqe_readl(cd, reg_offs);
+                put_user(val, &io->val64);
+                return 0;
+        }
+        case GENWQE_WRITE_REG32: {
+                io = (struct genwqe_reg_io __user *)arg;
+                if (!capable(CAP_SYS_ADMIN))
+                        return -EPERM;
+                if ((filp->f_flags & O_ACCMODE) == O_RDONLY)
+                        return -EPERM;
+                if (get_user(reg_offs, &io->num))
+                        return -EFAULT;
+                if ((reg_offs >= cd->mmio_len) || (reg_offs & 0x3))
+                        return -EINVAL;
+                if (get_user(val, &io->val64))
+                        return -EFAULT;
+                __genwqe_writel(cd, reg_offs, val);
+                return 0;
+        }
+                /* Flash update/reading */
+        case GENWQE_SLU_UPDATE: {
+                struct genwqe_bitstream load;
+                if (!genwqe_is_privileged(cd))
+                        return -EPERM;
+                if ((filp->f_flags & O_ACCMODE) == O_RDONLY)
+                        return -EPERM;
+                if (copy_from_user(&load, (void __user *)arg,
+                                   sizeof(load)))
+                        return -EFAULT;
+                rc = do_flash_update(cfile, &load);
+                if (copy_to_user((void __user *)arg, &load, sizeof(load)))
+                        return -EFAULT;
+                return rc;
+        }
+        case GENWQE_SLU_READ: {
+                struct genwqe_bitstream load;
+                if (!genwqe_is_privileged(cd))
+                        return -EPERM;
+                if (genwqe_flash_readback_fails(cd))
+                        return -ENOSPC;  /* known to fail for old versions */
+                if (copy_from_user(&load, (void __user *)arg, sizeof(load)))
+                        return -EFAULT;
+                rc = do_flash_read(cfile, &load);
+                if (copy_to_user((void __user *)arg, &load, sizeof(load)))
+                        return -EFAULT;
+                return rc;
+        }
+                /* memory pinning and unpinning */
+        case GENWQE_PIN_MEM: {
+                struct genwqe_mem m;
+                if (copy_from_user(&m, (void __user *)arg, sizeof(m)))
+                        return -EFAULT;
+                return genwqe_pin_mem(cfile, &m);
+        }
+        case GENWQE_UNPIN_MEM: {
+                struct genwqe_mem m;
+                if (copy_from_user(&m, (void __user *)arg, sizeof(m)))
+                        return -EFAULT;
+                return genwqe_unpin_mem(cfile, &m);
+        }
+                /* launch an DDCB and wait for completion */
+        case GENWQE_EXECUTE_DDCB:
+                return do_execute_ddcb(cfile, arg, 0);
+        case GENWQE_EXECUTE_RAW_DDCB: {
+                if (!capable(CAP_SYS_ADMIN))
+                        return -EPERM;
+                return do_execute_ddcb(cfile, arg, 1);
+        }
+        default:
+                return -EINVAL;
+        }
+        return rc;
+}
+#if defined(CONFIG_COMPAT)
+/**
+ * genwqe_compat_ioctl() - Compatibility ioctl
+ *
+ * Called whenever a 32-bit process running under a 64-bit kernel
+ * performs an ioctl on /dev/genwqe<n>_card.
+ *
+ * @filp:        file pointer.
+ * @cmd:         command.
+ * @arg:         user argument.
+ * Return:       zero on success or negative number on failure.
+ */
+static long genwqe_compat_ioctl(struct file *filp, unsigned int cmd,
+                                unsigned long arg)
+{
+        return genwqe_ioctl(filp, cmd, arg);
+}
+#endif /* defined(CONFIG_COMPAT) */
+static const struct file_operations genwqe_fops = {
+        .owner          = THIS_MODULE,
+        .open           = genwqe_open,
+        .fasync         = genwqe_fasync,
+        .mmap           = genwqe_mmap,
+        .unlocked_ioctl = genwqe_ioctl,
+#if defined(CONFIG_COMPAT)
+        .compat_ioctl   = genwqe_compat_ioctl,
+#endif
+        .release        = genwqe_release,
+};
+static int genwqe_device_initialized(struct genwqe_dev *cd)
+{
+        return cd->dev != NULL;
+}
+/**
+ * genwqe_device_create() - Create and configure genwqe char device
+ * @cd:      genwqe device descriptor
+ *
+ * This function must be called before we create any more genwqe
+ * character devices, because it is allocating the major and minor
+ * number which are supposed to be used by the client drivers.
+ */
+int genwqe_device_create(struct genwqe_dev *cd)
+{
+        int rc;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        /*
+         * Here starts the individual setup per client. It must
+         * initialize its own cdev data structure with its own fops.
+         * The appropriate devnum needs to be created. The ranges must
+         * not overlap.
+         */
+        rc = alloc_chrdev_region(&cd->devnum_genwqe, 0,
+                                 GENWQE_MAX_MINOR, GENWQE_DEVNAME);
+        if (rc < 0) {
+                dev_err(&pci_dev->dev, "err: alloc_chrdev_region failed\n");
+                goto err_dev;
+        }
+        cdev_init(&cd->cdev_genwqe, &genwqe_fops);
+        cd->cdev_genwqe.owner = THIS_MODULE;
+        rc = cdev_add(&cd->cdev_genwqe, cd->devnum_genwqe, 1);
+        if (rc < 0) {
+                dev_err(&pci_dev->dev, "err: cdev_add failed\n");
+                goto err_add;
+        }
+        /*
+         * Finally the device in /dev/... must be created. The rule is
+         * to use card%d_clientname for each created device.
+         */
+        cd->dev = device_create_with_groups(cd->class_genwqe,
+                                            &cd->pci_dev->dev,
+                                            cd->devnum_genwqe, cd,
+                                            genwqe_attribute_groups,
+                                            GENWQE_DEVNAME "%u_card",
+                                            cd->card_idx);
+        if (IS_ERR(cd->dev)) {
+                rc = PTR_ERR(cd->dev);
+                goto err_cdev;
+        }
+        rc = genwqe_init_debugfs(cd);
+        if (rc != 0)
+                goto err_debugfs;
+        return 0;
+ err_debugfs:
+        device_destroy(cd->class_genwqe, cd->devnum_genwqe);
+ err_cdev:
+        cdev_del(&cd->cdev_genwqe);
+ err_add:
+        unregister_chrdev_region(cd->devnum_genwqe, GENWQE_MAX_MINOR);
+ err_dev:
+        cd->dev = NULL;
+        return rc;
+}
+static int genwqe_inform_and_stop_processes(struct genwqe_dev *cd)
+{
+        int rc;
+        unsigned int i;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if (!genwqe_open_files(cd))
+                return 0;
+        dev_warn(&pci_dev->dev, "[%s] send SIGIO and wait ...\n", __func__);
+        rc = genwqe_kill_fasync(cd, SIGIO);
+        if (rc > 0) {
+                /* give kill_timeout seconds to close file descriptors ... */
+                for (i = 0; (i < genwqe_kill_timeout) &&
+                             genwqe_open_files(cd); i++) {
+                        dev_info(&pci_dev->dev, "  %d sec ...", i);
+                        cond_resched();
+                        msleep(1000);
+                }
+                /* if no open files we can safely continue, else ... */
+                if (!genwqe_open_files(cd))
+                        return 0;
+                dev_warn(&pci_dev->dev,
+                         "[%s] send SIGKILL and wait ...\n", __func__);
+                rc = genwqe_force_sig(cd, SIGKILL); /* force terminate */
+                if (rc) {
+                        /* Give kill_timout more seconds to end processes */
+                        for (i = 0; (i < genwqe_kill_timeout) &&
+                                     genwqe_open_files(cd); i++) {
+                                dev_warn(&pci_dev->dev, "  %d sec ...", i);
+                                cond_resched();
+                                msleep(1000);
+                        }
+                }
+        }
+        return 0;
+}
+/**
+ * genwqe_device_remove() - Remove genwqe's char device
+ *
+ * This function must be called after the client devices are removed
+ * because it will free the major/minor number range for the genwqe
+ * drivers.
+ *
+ * This function must be robust enough to be called twice.
+ */
+int genwqe_device_remove(struct genwqe_dev *cd)
+{
+        int rc;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if (!genwqe_device_initialized(cd))
+                return 1;
+        genwqe_inform_and_stop_processes(cd);
+        /*
+         * We currently do wait until all filedescriptors are
+         * closed. This leads to a problem when we abort the
+         * application which will decrease this reference from
+         * 1/unused to 0/illegal and not from 2/used 1/empty.
+         */
+        rc = atomic_read(&cd->cdev_genwqe.kobj.kref.refcount);
+        if (rc != 1) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: cdev_genwqe...refcount=%d\n", __func__, rc);
+                panic("Fatal err: cannot free resources with pending references!");
+        }
+        genqwe_exit_debugfs(cd);
+        device_destroy(cd->class_genwqe, cd->devnum_genwqe);
+        cdev_del(&cd->cdev_genwqe);
+        unregister_chrdev_region(cd->devnum_genwqe, GENWQE_MAX_MINOR);
+        cd->dev = NULL;
+        return 0;
+}
diff --git a/drivers/misc/genwqe/card_sysfs.c b/drivers/misc/genwqe/card_sysfs.c
new file mode 100644
index 000000000000..a72a99266c3c
--- /dev/null
+++ b/drivers/misc/genwqe/card_sysfs.c
@@ -0,0 +1,288 @@
+/**
+ * IBM Accelerator Family 'GenWQE'
+ *
+ * (C) Copyright IBM Corp. 2013
+ *
+ * Author: Frank Haverkamp <haver@linux.vnet.ibm.com>
+ * Author: Joerg-Stephan Vogt <jsvogt@de.ibm.com>
+ * Author: Michael Jung <mijung@de.ibm.com>
+ * Author: Michael Ruettger <michael@ibmra.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (version 2 only)
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+/*
+ * Sysfs interfaces for the GenWQE card. There are attributes to query
+ * the version of the bitstream as well as some for the driver. For
+ * debugging, please also see the debugfs interfaces of this driver.
+ */
+#include <linux/version.h>
+#include <linux/kernel.h>
+#include <linux/types.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/string.h>
+#include <linux/fs.h>
+#include <linux/sysfs.h>
+#include <linux/ctype.h>
+#include <linux/device.h>
+#include "card_base.h"
+#include "card_ddcb.h"
+static const char * const genwqe_types[] = {
+        [GENWQE_TYPE_ALTERA_230] = "GenWQE4-230",
+        [GENWQE_TYPE_ALTERA_530] = "GenWQE4-530",
+        [GENWQE_TYPE_ALTERA_A4]  = "GenWQE5-A4",
+        [GENWQE_TYPE_ALTERA_A7]  = "GenWQE5-A7",
+};
+static ssize_t status_show(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        struct genwqe_dev *cd = dev_get_drvdata(dev);
+        const char *cs[GENWQE_CARD_STATE_MAX] = { "unused", "used", "error" };
+        return sprintf(buf, "%s\n", cs[cd->card_state]);
+}
+static DEVICE_ATTR_RO(status);
+static ssize_t appid_show(struct device *dev, struct device_attribute *attr,
+                          char *buf)
+{
+        char app_name[5];
+        struct genwqe_dev *cd = dev_get_drvdata(dev);
+        genwqe_read_app_id(cd, app_name, sizeof(app_name));
+        return sprintf(buf, "%s\n", app_name);
+}
+static DEVICE_ATTR_RO(appid);
+static ssize_t version_show(struct device *dev, struct device_attribute *attr,
+                            char *buf)
+{
+        u64 slu_id, app_id;
+        struct genwqe_dev *cd = dev_get_drvdata(dev);
+        slu_id = __genwqe_readq(cd, IO_SLU_UNITCFG);
+        app_id = __genwqe_readq(cd, IO_APP_UNITCFG);
+        return sprintf(buf, "%016llx.%016llx\n", slu_id, app_id);
+}
+static DEVICE_ATTR_RO(version);
+static ssize_t type_show(struct device *dev, struct device_attribute *attr,
+                         char *buf)
+{
+        u8 card_type;
+        struct genwqe_dev *cd = dev_get_drvdata(dev);
+        card_type = genwqe_card_type(cd);
+        return sprintf(buf, "%s\n", (card_type >= ARRAY_SIZE(genwqe_types)) ?
+                       "invalid" : genwqe_types[card_type]);
+}
+static DEVICE_ATTR_RO(type);
+static ssize_t driver_show(struct device *dev, struct device_attribute *attr,
+                           char *buf)
+{
+        return sprintf(buf, "%s\n", DRV_VERS_STRING);
+}
+static DEVICE_ATTR_RO(driver);
+static ssize_t tempsens_show(struct device *dev, struct device_attribute *attr,
+                             char *buf)
+{
+        u64 tempsens;
+        struct genwqe_dev *cd = dev_get_drvdata(dev);
+        tempsens = __genwqe_readq(cd, IO_SLU_TEMPERATURE_SENSOR);
+        return sprintf(buf, "%016llx\n", tempsens);
+}
+static DEVICE_ATTR_RO(tempsens);
+static ssize_t freerunning_timer_show(struct device *dev,
+                                      struct device_attribute *attr,
+                                      char *buf)
+{
+        u64 t;
+        struct genwqe_dev *cd = dev_get_drvdata(dev);
+        t = __genwqe_readq(cd, IO_SLC_FREE_RUNNING_TIMER);
+        return sprintf(buf, "%016llx\n", t);
+}
+static DEVICE_ATTR_RO(freerunning_timer);
+static ssize_t queue_working_time_show(struct device *dev,
+                                       struct device_attribute *attr,
+                                       char *buf)
+{
+        u64 t;
+        struct genwqe_dev *cd = dev_get_drvdata(dev);
+        t = __genwqe_readq(cd, IO_SLC_QUEUE_WTIME);
+        return sprintf(buf, "%016llx\n", t);
+}
+static DEVICE_ATTR_RO(queue_working_time);
+static ssize_t base_clock_show(struct device *dev,
+                               struct device_attribute *attr,
+                               char *buf)
+{
+        u64 base_clock;
+        struct genwqe_dev *cd = dev_get_drvdata(dev);
+        base_clock = genwqe_base_clock_frequency(cd);
+        return sprintf(buf, "%lld\n", base_clock);
+}
+static DEVICE_ATTR_RO(base_clock);
+/**
+ * curr_bitstream_show() - Show the current bitstream id
+ *
+ * There is a bug in some old versions of the CPLD which selects the
+ * bitstream, which causes the IO_SLU_BITSTREAM register to report
+ * unreliable data in very rare cases. This makes this sysfs
+ * unreliable up to the point were a new CPLD version is being used.
+ *
+ * Unfortunately there is no automatic way yet to query the CPLD
+ * version, such that you need to manually ensure via programming
+ * tools that you have a recent version of the CPLD software.
+ *
+ * The proposed circumvention is to use a special recovery bitstream
+ * on the backup partition (0) to identify problems while loading the
+ * image.
+ */
+static ssize_t curr_bitstream_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        int curr_bitstream;
+        struct genwqe_dev *cd = dev_get_drvdata(dev);
+        curr_bitstream = __genwqe_readq(cd, IO_SLU_BITSTREAM) & 0x1;
+        return sprintf(buf, "%d\n", curr_bitstream);
+}
+static DEVICE_ATTR_RO(curr_bitstream);
+/**
+ * next_bitstream_show() - Show the next activated bitstream
+ *
+ * IO_SLC_CFGREG_SOFTRESET: This register can only be accessed by the PF.
+ */
+static ssize_t next_bitstream_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+        int next_bitstream;
+        struct genwqe_dev *cd = dev_get_drvdata(dev);
+        switch ((cd->softreset & 0xc) >> 2) {
+        case 0x2:
+                next_bitstream =  0;
+                break;
+        case 0x3:
+                next_bitstream =  1;
+                break;
+        default:
+                next_bitstream = -1;
+                break;          /* error */
+        }
+        return sprintf(buf, "%d\n", next_bitstream);
+}
+static ssize_t next_bitstream_store(struct device *dev,
+                                    struct device_attribute *attr,
+                                    const char *buf, size_t count)
+{
+        int partition;
+        struct genwqe_dev *cd = dev_get_drvdata(dev);
+        if (kstrtoint(buf, 0, &partition) < 0)
+                return -EINVAL;
+        switch (partition) {
+        case 0x0:
+                cd->softreset = 0x78;
+                break;
+        case 0x1:
+                cd->softreset = 0x7c;
+                break;
+        default:
+                return -EINVAL;
+        }
+        __genwqe_writeq(cd, IO_SLC_CFGREG_SOFTRESET, cd->softreset);
+        return count;
+}
+static DEVICE_ATTR_RW(next_bitstream);
+/*
+ * Create device_attribute structures / params: name, mode, show, store
+ * additional flag if valid in VF
+ */
+static struct attribute *genwqe_attributes[] = {
+        &dev_attr_tempsens.attr,
+        &dev_attr_next_bitstream.attr,
+        &dev_attr_curr_bitstream.attr,
+        &dev_attr_base_clock.attr,
+        &dev_attr_driver.attr,
+        &dev_attr_type.attr,
+        &dev_attr_version.attr,
+        &dev_attr_appid.attr,
+        &dev_attr_status.attr,
+        &dev_attr_freerunning_timer.attr,
+        &dev_attr_queue_working_time.attr,
+        NULL,
+};
+static struct attribute *genwqe_normal_attributes[] = {
+        &dev_attr_driver.attr,
+        &dev_attr_type.attr,
+        &dev_attr_version.attr,
+        &dev_attr_appid.attr,
+        &dev_attr_status.attr,
+        &dev_attr_freerunning_timer.attr,
+        &dev_attr_queue_working_time.attr,
+        NULL,
+};
+/**
+ * genwqe_is_visible() - Determine if sysfs attribute should be visible or not
+ *
+ * VFs have restricted mmio capabilities, so not all sysfs entries
+ * are allowed in VFs.
+ */
+static umode_t genwqe_is_visible(struct kobject *kobj,
+                                 struct attribute *attr, int n)
+{
+        unsigned int j;
+        struct device *dev = container_of(kobj, struct device, kobj);
+        struct genwqe_dev *cd = dev_get_drvdata(dev);
+        umode_t mode = attr->mode;
+        if (genwqe_is_privileged(cd))
+                return mode;
+        for (j = 0; genwqe_normal_attributes[j] != NULL;  j++)
+                if (genwqe_normal_attributes[j] == attr)
+                        return mode;
+        return 0;
+}
+static struct attribute_group genwqe_attribute_group = {
+        .is_visible = genwqe_is_visible,
+        .attrs      = genwqe_attributes,
+};
+const struct attribute_group *genwqe_attribute_groups[] = {
+        &genwqe_attribute_group,
+        NULL,
+};
diff --git a/drivers/misc/genwqe/card_utils.c b/drivers/misc/genwqe/card_utils.c
new file mode 100644
index 000000000000..6b1a6ef9f1a8
--- /dev/null
+++ b/drivers/misc/genwqe/card_utils.c
@@ -0,0 +1,944 @@
+/**
+ * IBM Accelerator Family 'GenWQE'
+ *
+ * (C) Copyright IBM Corp. 2013
+ *
+ * Author: Frank Haverkamp <haver@linux.vnet.ibm.com>
+ * Author: Joerg-Stephan Vogt <jsvogt@de.ibm.com>
+ * Author: Michael Jung <mijung@de.ibm.com>
+ * Author: Michael Ruettger <michael@ibmra.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (version 2 only)
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+/*
+ * Miscelanous functionality used in the other GenWQE driver parts.
+ */
+#include <linux/kernel.h>
+#include <linux/dma-mapping.h>
+#include <linux/sched.h>
+#include <linux/vmalloc.h>
+#include <linux/page-flags.h>
+#include <linux/scatterlist.h>
+#include <linux/hugetlb.h>
+#include <linux/iommu.h>
+#include <linux/delay.h>
+#include <linux/pci.h>
+#include <linux/dma-mapping.h>
+#include <linux/ctype.h>
+#include <linux/module.h>
+#include <linux/platform_device.h>
+#include <linux/delay.h>
+#include <asm/pgtable.h>
+#include "genwqe_driver.h"
+#include "card_base.h"
+#include "card_ddcb.h"
+/**
+ * __genwqe_writeq() - Write 64-bit register
+ * @cd:         genwqe device descriptor
+ * @byte_offs:  byte offset within BAR
+ * @val:        64-bit value
+ *
+ * Return: 0 if success; < 0 if error
+ */
+int __genwqe_writeq(struct genwqe_dev *cd, u64 byte_offs, u64 val)
+{
+        if (cd->err_inject & GENWQE_INJECT_HARDWARE_FAILURE)
+                return -EIO;
+        if (cd->mmio == NULL)
+                return -EIO;
+        __raw_writeq((__force u64)cpu_to_be64(val), cd->mmio + byte_offs);
+        return 0;
+}
+/**
+ * __genwqe_readq() - Read 64-bit register
+ * @cd:         genwqe device descriptor
+ * @byte_offs:  offset within BAR
+ *
+ * Return: value from register
+ */
+u64 __genwqe_readq(struct genwqe_dev *cd, u64 byte_offs)
+{
+        if (cd->err_inject & GENWQE_INJECT_HARDWARE_FAILURE)
+                return 0xffffffffffffffffull;
+        if ((cd->err_inject & GENWQE_INJECT_GFIR_FATAL) &&
+            (byte_offs == IO_SLC_CFGREG_GFIR))
+                return 0x000000000000ffffull;
+        if ((cd->err_inject & GENWQE_INJECT_GFIR_INFO) &&
+            (byte_offs == IO_SLC_CFGREG_GFIR))
+                return 0x00000000ffff0000ull;
+        if (cd->mmio == NULL)
+                return 0xffffffffffffffffull;
+        return be64_to_cpu((__force __be64)__raw_readq(cd->mmio + byte_offs));
+}
+/**
+ * __genwqe_writel() - Write 32-bit register
+ * @cd:         genwqe device descriptor
+ * @byte_offs:  byte offset within BAR
+ * @val:        32-bit value
+ *
+ * Return: 0 if success; < 0 if error
+ */
+int __genwqe_writel(struct genwqe_dev *cd, u64 byte_offs, u32 val)
+{
+        if (cd->err_inject & GENWQE_INJECT_HARDWARE_FAILURE)
+                return -EIO;
+        if (cd->mmio == NULL)
+                return -EIO;
+        __raw_writel((__force u32)cpu_to_be32(val), cd->mmio + byte_offs);
+        return 0;
+}
+/**
+ * __genwqe_readl() - Read 32-bit register
+ * @cd:         genwqe device descriptor
+ * @byte_offs:  offset within BAR
+ *
+ * Return: Value from register
+ */
+u32 __genwqe_readl(struct genwqe_dev *cd, u64 byte_offs)
+{
+        if (cd->err_inject & GENWQE_INJECT_HARDWARE_FAILURE)
+                return 0xffffffff;
+        if (cd->mmio == NULL)
+                return 0xffffffff;
+        return be32_to_cpu((__force __be32)__raw_readl(cd->mmio + byte_offs));
+}
+/**
+ * genwqe_read_app_id() - Extract app_id
+ *
+ * app_unitcfg need to be filled with valid data first
+ */
+int genwqe_read_app_id(struct genwqe_dev *cd, char *app_name, int len)
+{
+        int i, j;
+        u32 app_id = (u32)cd->app_unitcfg;
+        memset(app_name, 0, len);
+        for (i = 0, j = 0; j < min(len, 4); j++) {
+                char ch = (char)((app_id >> (24 - j*8)) & 0xff);
+                if (ch == ' ')
+                        continue;
+                app_name[i++] = isprint(ch) ? ch : 'X';
+        }
+        return i;
+}
+/**
+ * genwqe_init_crc32() - Prepare a lookup table for fast crc32 calculations
+ *
+ * Existing kernel functions seem to use a different polynom,
+ * therefore we could not use them here.
+ *
+ * Genwqe's Polynomial = 0x20044009
+ */
+#define CRC32_POLYNOMIAL        0x20044009
+static u32 crc32_tab[256];      /* crc32 lookup table */
+void genwqe_init_crc32(void)
+{
+        int i, j;
+        u32 crc;
+        for (i = 0;  i < 256;  i++) {
+                crc = i << 24;
+                for (j = 0;  j < 8;  j++) {
+                        if (crc & 0x80000000)
+                                crc = (crc << 1) ^ CRC32_POLYNOMIAL;
+                        else
+                                crc = (crc << 1);
+                }
+                crc32_tab[i] = crc;
+        }
+}
+/**
+ * genwqe_crc32() - Generate 32-bit crc as required for DDCBs
+ * @buff:       pointer to data buffer
+ * @len:        length of data for calculation
+ * @init:       initial crc (0xffffffff at start)
+ *
+ * polynomial = x^32 * + x^29 + x^18 + x^14 + x^3 + 1 (0x20044009)
+ * Example: 4 bytes 0x01 0x02 0x03 0x04 with init=0xffffffff should
+ * result in a crc32 of 0xf33cb7d3.
+ *
+ * The existing kernel crc functions did not cover this polynom yet.
+ *
+ * Return: crc32 checksum.
+ */
+u32 genwqe_crc32(u8 *buff, size_t len, u32 init)
+{
+        int i;
+        u32 crc;
+        crc = init;
+        while (len--) {
+                i = ((crc >> 24) ^ *buff++) & 0xFF;
+                crc = (crc << 8) ^ crc32_tab[i];
+        }
+        return crc;
+}
+void *__genwqe_alloc_consistent(struct genwqe_dev *cd, size_t size,
+                               dma_addr_t *dma_handle)
+{
+        if (get_order(size) > MAX_ORDER)
+                return NULL;
+        return pci_alloc_consistent(cd->pci_dev, size, dma_handle);
+}
+void __genwqe_free_consistent(struct genwqe_dev *cd, size_t size,
+                             void *vaddr, dma_addr_t dma_handle)
+{
+        if (vaddr == NULL)
+                return;
+        pci_free_consistent(cd->pci_dev, size, vaddr, dma_handle);
+}
+static void genwqe_unmap_pages(struct genwqe_dev *cd, dma_addr_t *dma_list,
+                              int num_pages)
+{
+        int i;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        for (i = 0; (i < num_pages) && (dma_list[i] != 0x0); i++) {
+                pci_unmap_page(pci_dev, dma_list[i],
+                               PAGE_SIZE, PCI_DMA_BIDIRECTIONAL);
+                dma_list[i] = 0x0;
+        }
+}
+static int genwqe_map_pages(struct genwqe_dev *cd,
+                           struct page **page_list, int num_pages,
+                           dma_addr_t *dma_list)
+{
+        int i;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        /* establish DMA mapping for requested pages */
+        for (i = 0; i < num_pages; i++) {
+                dma_addr_t daddr;
+                dma_list[i] = 0x0;
+                daddr = pci_map_page(pci_dev, page_list[i],
+                                     0,  /* map_offs */
+                                     PAGE_SIZE,
+                                     PCI_DMA_BIDIRECTIONAL);  /* FIXME rd/rw */
+                if (pci_dma_mapping_error(pci_dev, daddr)) {
+                        dev_err(&pci_dev->dev,
+                                "[%s] err: no dma addr daddr=%016llx!\n",
+                                __func__, (long long)daddr);
+                        goto err;
+                }
+                dma_list[i] = daddr;
+        }
+        return 0;
+ err:
+        genwqe_unmap_pages(cd, dma_list, num_pages);
+        return -EIO;
+}
+static int genwqe_sgl_size(int num_pages)
+{
+        int len, num_tlb = num_pages / 7;
+        len = sizeof(struct sg_entry) * (num_pages+num_tlb + 1);
+        return roundup(len, PAGE_SIZE);
+}
+struct sg_entry *genwqe_alloc_sgl(struct genwqe_dev *cd, int num_pages,
+                                  dma_addr_t *dma_addr, size_t *sgl_size)
+{
+        struct pci_dev *pci_dev = cd->pci_dev;
+        struct sg_entry *sgl;
+        *sgl_size = genwqe_sgl_size(num_pages);
+        if (get_order(*sgl_size) > MAX_ORDER) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: too much memory requested!\n", __func__);
+                return NULL;
+        }
+        sgl = __genwqe_alloc_consistent(cd, *sgl_size, dma_addr);
+        if (sgl == NULL) {
+                dev_err(&pci_dev->dev,
+                        "[%s] err: no memory available!\n", __func__);
+                return NULL;
+        }
+        return sgl;
+}
+int genwqe_setup_sgl(struct genwqe_dev *cd,
+                     unsigned long offs,
+                     unsigned long size,
+                     struct sg_entry *sgl,
+                     dma_addr_t dma_addr, size_t sgl_size,
+                     dma_addr_t *dma_list, int page_offs, int num_pages)
+{
+        int i = 0, j = 0, p;
+        unsigned long dma_offs, map_offs;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        dma_addr_t prev_daddr = 0;
+        struct sg_entry *s, *last_s = NULL;
+        /* sanity checks */
+        if (offs > PAGE_SIZE) {
+                dev_err(&pci_dev->dev,
+                        "[%s] too large start offs %08lx\n", __func__, offs);
+                return -EFAULT;
+        }
+        if (sgl_size < genwqe_sgl_size(num_pages)) {
+                dev_err(&pci_dev->dev,
+                        "[%s] sgl_size too small %08lx for %d pages\n",
+                        __func__, sgl_size, num_pages);
+                return -EFAULT;
+        }
+        dma_offs = 128;         /* next block if needed/dma_offset */
+        map_offs = offs;        /* offset in first page */
+        s = &sgl[0];            /* first set of 8 entries */
+        p = 0;                  /* page */
+        while (p < num_pages) {
+                dma_addr_t daddr;
+                unsigned int size_to_map;
+                /* always write the chaining entry, cleanup is done later */
+                j = 0;
+                s[j].target_addr = cpu_to_be64(dma_addr + dma_offs);
+                s[j].len         = cpu_to_be32(128);
+                s[j].flags       = cpu_to_be32(SG_CHAINED);
+                j++;
+                while (j < 8) {
+                        /* DMA mapping for requested page, offs, size */
+                        size_to_map = min(size, PAGE_SIZE - map_offs);
+                        daddr = dma_list[page_offs + p] + map_offs;
+                        size -= size_to_map;
+                        map_offs = 0;
+                        if (prev_daddr == daddr) {
+                                u32 prev_len = be32_to_cpu(last_s->len);
+                                /* pr_info("daddr combining: "
+                                        "%016llx/%08x -> %016llx\n",
+                                        prev_daddr, prev_len, daddr); */
+                                last_s->len = cpu_to_be32(prev_len +
+                                                          size_to_map);
+                                p++; /* process next page */
+                                if (p == num_pages)
+                                        goto fixup;  /* nothing to do */
+                                prev_daddr = daddr + size_to_map;
+                                continue;
+                        }
+                        /* start new entry */
+                        s[j].target_addr = cpu_to_be64(daddr);
+                        s[j].len         = cpu_to_be32(size_to_map);
+                        s[j].flags       = cpu_to_be32(SG_DATA);
+                        prev_daddr = daddr + size_to_map;
+                        last_s = &s[j];
+                        j++;
+                        p++;    /* process next page */
+                        if (p == num_pages)
+                                goto fixup;  /* nothing to do */
+                }
+                dma_offs += 128;
+                s += 8;         /* continue 8 elements further */
+        }
+ fixup:
+        if (j == 1) {           /* combining happend on last entry! */
+                s -= 8;         /* full shift needed on previous sgl block */
+                j =  7;         /* shift all elements */
+        }
+        for (i = 0; i < j; i++) /* move elements 1 up */
+                s[i] = s[i + 1];
+        s[i].target_addr = cpu_to_be64(0);
+        s[i].len         = cpu_to_be32(0);
+        s[i].flags       = cpu_to_be32(SG_END_LIST);
+        return 0;
+}
+void genwqe_free_sgl(struct genwqe_dev *cd, struct sg_entry *sg_list,
+                    dma_addr_t dma_addr, size_t size)
+{
+        __genwqe_free_consistent(cd, size, sg_list, dma_addr);
+}
+/**
+ * free_user_pages() - Give pinned pages back
+ *
+ * Documentation of get_user_pages is in mm/memory.c:
+ *
+ * If the page is written to, set_page_dirty (or set_page_dirty_lock,
+ * as appropriate) must be called after the page is finished with, and
+ * before put_page is called.
+ *
+ * FIXME Could be of use to others and might belong in the generic
+ * code, if others agree. E.g.
+ *    ll_free_user_pages in drivers/staging/lustre/lustre/llite/rw26.c
+ *    ceph_put_page_vector in net/ceph/pagevec.c
+ *    maybe more?
+ */
+static int free_user_pages(struct page **page_list, unsigned int nr_pages,
+                           int dirty)
+{
+        unsigned int i;
+        for (i = 0; i < nr_pages; i++) {
+                if (page_list[i] != NULL) {
+                        if (dirty)
+                                set_page_dirty_lock(page_list[i]);
+                        put_page(page_list[i]);
+                }
+        }
+        return 0;
+}
+/**
+ * genwqe_user_vmap() - Map user-space memory to virtual kernel memory
+ * @cd:         pointer to genwqe device
+ * @m:          mapping params
+ * @uaddr:      user virtual address
+ * @size:       size of memory to be mapped
+ *
+ * We need to think about how we could speed this up. Of course it is
+ * not a good idea to do this over and over again, like we are
+ * currently doing it. Nevertheless, I am curious where on the path
+ * the performance is spend. Most probably within the memory
+ * allocation functions, but maybe also in the DMA mapping code.
+ *
+ * Restrictions: The maximum size of the possible mapping currently depends
+ *               on the amount of memory we can get using kzalloc() for the
+ *               page_list and pci_alloc_consistent for the sg_list.
+ *               The sg_list is currently itself not scattered, which could
+ *               be fixed with some effort. The page_list must be split into
+ *               PAGE_SIZE chunks too. All that will make the complicated
+ *               code more complicated.
+ *
+ * Return: 0 if success
+ */
+int genwqe_user_vmap(struct genwqe_dev *cd, struct dma_mapping *m, void *uaddr,
+                     unsigned long size, struct ddcb_requ *req)
+{
+        int rc = -EINVAL;
+        unsigned long data, offs;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if ((uaddr == NULL) || (size == 0)) {
+                m->size = 0;    /* mark unused and not added */
+                return -EINVAL;
+        }
+        m->u_vaddr = uaddr;
+        m->size    = size;
+        /* determine space needed for page_list. */
+        data = (unsigned long)uaddr;
+        offs = offset_in_page(data);
+        m->nr_pages = DIV_ROUND_UP(offs + size, PAGE_SIZE);
+        m->page_list = kcalloc(m->nr_pages,
+                               sizeof(struct page *) + sizeof(dma_addr_t),
+                               GFP_KERNEL);
+        if (!m->page_list) {
+                dev_err(&pci_dev->dev, "err: alloc page_list failed\n");
+                m->nr_pages = 0;
+                m->u_vaddr = NULL;
+                m->size = 0;    /* mark unused and not added */
+                return -ENOMEM;
+        }
+        m->dma_list = (dma_addr_t *)(m->page_list + m->nr_pages);
+        /* pin user pages in memory */
+        rc = get_user_pages_fast(data & PAGE_MASK, /* page aligned addr */
+                                 m->nr_pages,
+                                 1,             /* write by caller */
+                                 m->page_list); /* ptrs to pages */
+        /* assumption: get_user_pages can be killed by signals. */
+        if (rc < m->nr_pages) {
+                free_user_pages(m->page_list, rc, 0);
+                rc = -EFAULT;
+                goto fail_get_user_pages;
+        }
+        rc = genwqe_map_pages(cd, m->page_list, m->nr_pages, m->dma_list);
+        if (rc != 0)
+                goto fail_free_user_pages;
+        return 0;
+ fail_free_user_pages:
+        free_user_pages(m->page_list, m->nr_pages, 0);
+ fail_get_user_pages:
+        kfree(m->page_list);
+        m->page_list = NULL;
+        m->dma_list = NULL;
+        m->nr_pages = 0;
+        m->u_vaddr = NULL;
+        m->size = 0;            /* mark unused and not added */
+        return rc;
+}
+/**
+ * genwqe_user_vunmap() - Undo mapping of user-space mem to virtual kernel
+ *                        memory
+ * @cd:         pointer to genwqe device
+ * @m:          mapping params
+ */
+int genwqe_user_vunmap(struct genwqe_dev *cd, struct dma_mapping *m,
+                       struct ddcb_requ *req)
+{
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if (!dma_mapping_used(m)) {
+                dev_err(&pci_dev->dev, "[%s] err: mapping %p not used!\n",
+                        __func__, m);
+                return -EINVAL;
+        }
+        if (m->dma_list)
+                genwqe_unmap_pages(cd, m->dma_list, m->nr_pages);
+        if (m->page_list) {
+                free_user_pages(m->page_list, m->nr_pages, 1);
+                kfree(m->page_list);
+                m->page_list = NULL;
+                m->dma_list = NULL;
+                m->nr_pages = 0;
+        }
+        m->u_vaddr = NULL;
+        m->size = 0;            /* mark as unused and not added */
+        return 0;
+}
+/**
+ * genwqe_card_type() - Get chip type SLU Configuration Register
+ * @cd:         pointer to the genwqe device descriptor
+ * Return: 0: Altera Stratix-IV 230
+ *         1: Altera Stratix-IV 530
+ *         2: Altera Stratix-V A4
+ *         3: Altera Stratix-V A7
+ */
+u8 genwqe_card_type(struct genwqe_dev *cd)
+{
+        u64 card_type = cd->slu_unitcfg;
+        return (u8)((card_type & IO_SLU_UNITCFG_TYPE_MASK) >> 20);
+}
+/**
+ * genwqe_card_reset() - Reset the card
+ * @cd:         pointer to the genwqe device descriptor
+ */
+int genwqe_card_reset(struct genwqe_dev *cd)
+{
+        u64 softrst;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if (!genwqe_is_privileged(cd))
+                return -ENODEV;
+        /* new SL */
+        __genwqe_writeq(cd, IO_SLC_CFGREG_SOFTRESET, 0x1ull);
+        msleep(1000);
+        __genwqe_readq(cd, IO_HSU_FIR_CLR);
+        __genwqe_readq(cd, IO_APP_FIR_CLR);
+        __genwqe_readq(cd, IO_SLU_FIR_CLR);
+        /*
+         * Read-modify-write to preserve the stealth bits
+         *
+         * For SL >= 039, Stealth WE bit allows removing
+         * the read-modify-wrote.
+         * r-m-w may require a mask 0x3C to avoid hitting hard
+         * reset again for error reset (should be 0, chicken).
+         */
+        softrst = __genwqe_readq(cd, IO_SLC_CFGREG_SOFTRESET) & 0x3cull;
+        __genwqe_writeq(cd, IO_SLC_CFGREG_SOFTRESET, softrst | 0x2ull);
+        /* give ERRORRESET some time to finish */
+        msleep(50);
+        if (genwqe_need_err_masking(cd)) {
+                dev_info(&pci_dev->dev,
+                         "[%s] masking errors for old bitstreams\n", __func__);
+                __genwqe_writeq(cd, IO_SLC_MISC_DEBUG, 0x0aull);
+        }
+        return 0;
+}
+int genwqe_read_softreset(struct genwqe_dev *cd)
+{
+        u64 bitstream;
+        if (!genwqe_is_privileged(cd))
+                return -ENODEV;
+        bitstream = __genwqe_readq(cd, IO_SLU_BITSTREAM) & 0x1;
+        cd->softreset = (bitstream == 0) ? 0x8ull : 0xcull;
+        return 0;
+}
+/**
+ * genwqe_set_interrupt_capability() - Configure MSI capability structure
+ * @cd:         pointer to the device
+ * Return: 0 if no error
+ */
+int genwqe_set_interrupt_capability(struct genwqe_dev *cd, int count)
+{
+        int rc;
+        struct pci_dev *pci_dev = cd->pci_dev;
+        rc = pci_enable_msi_block(pci_dev, count);
+        if (rc == 0)
+                cd->flags |= GENWQE_FLAG_MSI_ENABLED;
+        return rc;
+}
+/**
+ * genwqe_reset_interrupt_capability() - Undo genwqe_set_interrupt_capability()
+ * @cd:         pointer to the device
+ */
+void genwqe_reset_interrupt_capability(struct genwqe_dev *cd)
+{
+        struct pci_dev *pci_dev = cd->pci_dev;
+        if (cd->flags & GENWQE_FLAG_MSI_ENABLED) {
+                pci_disable_msi(pci_dev);
+                cd->flags &= ~GENWQE_FLAG_MSI_ENABLED;
+        }
+}
+/**
+ * set_reg_idx() - Fill array with data. Ignore illegal offsets.
+ * @cd:         card device
+ * @r:          debug register array
+ * @i:          index to desired entry
+ * @m:          maximum possible entries
+ * @addr:       addr which is read
+ * @index:      index in debug array
+ * @val:        read value
+ */
+static int set_reg_idx(struct genwqe_dev *cd, struct genwqe_reg *r,
+                       unsigned int *i, unsigned int m, u32 addr, u32 idx,
+                       u64 val)
+{
+        if (WARN_ON_ONCE(*i >= m))
+                return -EFAULT;
+        r[*i].addr = addr;
+        r[*i].idx = idx;
+        r[*i].val = val;
+        ++*i;
+        return 0;
+}
+static int set_reg(struct genwqe_dev *cd, struct genwqe_reg *r,
+                   unsigned int *i, unsigned int m, u32 addr, u64 val)
+{
+        return set_reg_idx(cd, r, i, m, addr, 0, val);
+}
+int genwqe_read_ffdc_regs(struct genwqe_dev *cd, struct genwqe_reg *regs,
+                         unsigned int max_regs, int all)
+{
+        unsigned int i, j, idx = 0;
+        u32 ufir_addr, ufec_addr, sfir_addr, sfec_addr;
+        u64 gfir, sluid, appid, ufir, ufec, sfir, sfec;
+        /* Global FIR */
+        gfir = __genwqe_readq(cd, IO_SLC_CFGREG_GFIR);
+        set_reg(cd, regs, &idx, max_regs, IO_SLC_CFGREG_GFIR, gfir);
+        /* UnitCfg for SLU */
+        sluid = __genwqe_readq(cd, IO_SLU_UNITCFG); /* 0x00000000 */
+        set_reg(cd, regs, &idx, max_regs, IO_SLU_UNITCFG, sluid);
+        /* UnitCfg for APP */
+        appid = __genwqe_readq(cd, IO_APP_UNITCFG); /* 0x02000000 */
+        set_reg(cd, regs, &idx, max_regs, IO_APP_UNITCFG, appid);
+        /* Check all chip Units */
+        for (i = 0; i < GENWQE_MAX_UNITS; i++) {
+                /* Unit FIR */
+                ufir_addr = (i << 24) | 0x008;
+                ufir = __genwqe_readq(cd, ufir_addr);
+                set_reg(cd, regs, &idx, max_regs, ufir_addr, ufir);
+                /* Unit FEC */
+                ufec_addr = (i << 24) | 0x018;
+                ufec = __genwqe_readq(cd, ufec_addr);
+                set_reg(cd, regs, &idx, max_regs, ufec_addr, ufec);
+                for (j = 0; j < 64; j++) {
+                        /* wherever there is a primary 1, read the 2ndary */
+                        if (!all && (!(ufir & (1ull << j))))
+                                continue;
+                        sfir_addr = (i << 24) | (0x100 + 8 * j);
+                        sfir = __genwqe_readq(cd, sfir_addr);
+                        set_reg(cd, regs, &idx, max_regs, sfir_addr, sfir);
+                        sfec_addr = (i << 24) | (0x300 + 8 * j);
+                        sfec = __genwqe_readq(cd, sfec_addr);
+                        set_reg(cd, regs, &idx, max_regs, sfec_addr, sfec);
+                }
+        }
+        /* fill with invalid data until end */
+        for (i = idx; i < max_regs; i++) {
+                regs[i].addr = 0xffffffff;
+                regs[i].val = 0xffffffffffffffffull;
+        }
+        return idx;
+}
+/**
+ * genwqe_ffdc_buff_size() - Calculates the number of dump registers
+ */
+int genwqe_ffdc_buff_size(struct genwqe_dev *cd, int uid)
+{
+        int entries = 0, ring, traps, traces, trace_entries;
+        u32 eevptr_addr, l_addr, d_len, d_type;
+        u64 eevptr, val, addr;
+        eevptr_addr = GENWQE_UID_OFFS(uid) | IO_EXTENDED_ERROR_POINTER;
+        eevptr = __genwqe_readq(cd, eevptr_addr);
+        if ((eevptr != 0x0) && (eevptr != -1ull)) {
+                l_addr = GENWQE_UID_OFFS(uid) | eevptr;
+                while (1) {
+                        val = __genwqe_readq(cd, l_addr);
+                        if ((val == 0x0) || (val == -1ull))
+                                break;
+                        /* 38:24 */
+                        d_len  = (val & 0x0000007fff000000ull) >> 24;
+                        /* 39 */
+                        d_type = (val & 0x0000008000000000ull) >> 36;
+                        if (d_type) {   /* repeat */
+                                entries += d_len;
+                        } else {        /* size in bytes! */
+                                entries += d_len >> 3;
+                        }
+                        l_addr += 8;
+                }
+        }
+        for (ring = 0; ring < 8; ring++) {
+                addr = GENWQE_UID_OFFS(uid) | IO_EXTENDED_DIAG_MAP(ring);
+                val = __genwqe_readq(cd, addr);
+                if ((val == 0x0ull) || (val == -1ull))
+                        continue;
+                traps = (val >> 24) & 0xff;
+                traces = (val >> 16) & 0xff;
+                trace_entries = val & 0xffff;
+                entries += traps + (traces * trace_entries);
+        }
+        return entries;
+}
+/**
+ * genwqe_ffdc_buff_read() - Implements LogoutExtendedErrorRegisters procedure
+ */
+int genwqe_ffdc_buff_read(struct genwqe_dev *cd, int uid,
+                          struct genwqe_reg *regs, unsigned int max_regs)
+{
+        int i, traps, traces, trace, trace_entries, trace_entry, ring;
+        unsigned int idx = 0;
+        u32 eevptr_addr, l_addr, d_addr, d_len, d_type;
+        u64 eevptr, e, val, addr;
+        eevptr_addr = GENWQE_UID_OFFS(uid) | IO_EXTENDED_ERROR_POINTER;
+        eevptr = __genwqe_readq(cd, eevptr_addr);
+        if ((eevptr != 0x0) && (eevptr != 0xffffffffffffffffull)) {
+                l_addr = GENWQE_UID_OFFS(uid) | eevptr;
+                while (1) {
+                        e = __genwqe_readq(cd, l_addr);
+                        if ((e == 0x0) || (e == 0xffffffffffffffffull))
+                                break;
+                        d_addr = (e & 0x0000000000ffffffull);       /* 23:0 */
+                        d_len  = (e & 0x0000007fff000000ull) >> 24; /* 38:24 */
+                        d_type = (e & 0x0000008000000000ull) >> 36; /* 39 */
+                        d_addr |= GENWQE_UID_OFFS(uid);
+                        if (d_type) {
+                                for (i = 0; i < (int)d_len; i++) {
+                                        val = __genwqe_readq(cd, d_addr);
+                                        set_reg_idx(cd, regs, &idx, max_regs,
+                                                    d_addr, i, val);
+                                }
+                        } else {
+                                d_len >>= 3; /* Size in bytes! */
+                                for (i = 0; i < (int)d_len; i++, d_addr += 8) {
+                                        val = __genwqe_readq(cd, d_addr);
+                                        set_reg_idx(cd, regs, &idx, max_regs,
+                                                    d_addr, 0, val);
+                                }
+                        }
+                        l_addr += 8;
+                }
+        }
+        /*
+         * To save time, there are only 6 traces poplulated on Uid=2,
+         * Ring=1. each with iters=512.
+         */
+        for (ring = 0; ring < 8; ring++) { /* 0 is fls, 1 is fds,
+                                              2...7 are ASI rings */
+                addr = GENWQE_UID_OFFS(uid) | IO_EXTENDED_DIAG_MAP(ring);
+                val = __genwqe_readq(cd, addr);
+                if ((val == 0x0ull) || (val == -1ull))
+                        continue;
+                traps = (val >> 24) & 0xff;     /* Number of Traps      */
+                traces = (val >> 16) & 0xff;    /* Number of Traces     */
+                trace_entries = val & 0xffff;   /* Entries per trace    */
+                /* Note: This is a combined loop that dumps both the traps */
+                /* (for the trace == 0 case) as well as the traces 1 to    */
+                /* 'traces'.                                               */
+                for (trace = 0; trace <= traces; trace++) {
+                        u32 diag_sel =
+                                GENWQE_EXTENDED_DIAG_SELECTOR(ring, trace);
+                        addr = (GENWQE_UID_OFFS(uid) |
+                                IO_EXTENDED_DIAG_SELECTOR);
+                        __genwqe_writeq(cd, addr, diag_sel);
+                        for (trace_entry = 0;
+                             trace_entry < (trace ? trace_entries : traps);
+                             trace_entry++) {
+                                addr = (GENWQE_UID_OFFS(uid) |
+                                        IO_EXTENDED_DIAG_READ_MBX);
+                                val = __genwqe_readq(cd, addr);
+                                set_reg_idx(cd, regs, &idx, max_regs, addr,
+                                            (diag_sel<<16) | trace_entry, val);
+                        }
+                }
+        }
+        return 0;
+}
+/**
+ * genwqe_write_vreg() - Write register in virtual window
+ *
+ * Note, these registers are only accessible to the PF through the
+ * VF-window. It is not intended for the VF to access.
+ */
+int genwqe_write_vreg(struct genwqe_dev *cd, u32 reg, u64 val, int func)
+{
+        __genwqe_writeq(cd, IO_PF_SLC_VIRTUAL_WINDOW, func & 0xf);
+        __genwqe_writeq(cd, reg, val);
+        return 0;
+}
+/**
+ * genwqe_read_vreg() - Read register in virtual window
+ *
+ * Note, these registers are only accessible to the PF through the
+ * VF-window. It is not intended for the VF to access.
+ */
+u64 genwqe_read_vreg(struct genwqe_dev *cd, u32 reg, int func)
+{
+        __genwqe_writeq(cd, IO_PF_SLC_VIRTUAL_WINDOW, func & 0xf);
+        return __genwqe_readq(cd, reg);
+}
+/**
+ * genwqe_base_clock_frequency() - Deteremine base clock frequency of the card
+ *
+ * Note: From a design perspective it turned out to be a bad idea to
+ * use codes here to specifiy the frequency/speed values. An old
+ * driver cannot understand new codes and is therefore always a
+ * problem. Better is to measure out the value or put the
+ * speed/frequency directly into a register which is always a valid
+ * value for old as well as for new software.
+ *
+ * Return: Card clock in MHz
+ */
+int genwqe_base_clock_frequency(struct genwqe_dev *cd)
+{
+        u16 speed;              /*         MHz  MHz  MHz  MHz */
+        static const int speed_grade[] = { 250, 200, 166, 175 };
+        speed = (u16)((cd->slu_unitcfg >> 28) & 0x0full);
+        if (speed >= ARRAY_SIZE(speed_grade))
+                return 0;       /* illegal value */
+        return speed_grade[speed];
+}
+/**
+ * genwqe_stop_traps() - Stop traps
+ *
+ * Before reading out the analysis data, we need to stop the traps.
+ */
+void genwqe_stop_traps(struct genwqe_dev *cd)
+{
+        __genwqe_writeq(cd, IO_SLC_MISC_DEBUG_SET, 0xcull);
+}
+/**
+ * genwqe_start_traps() - Start traps
+ *
+ * After having read the data, we can/must enable the traps again.
+ */
+void genwqe_start_traps(struct genwqe_dev *cd)
+{
+        __genwqe_writeq(cd, IO_SLC_MISC_DEBUG_CLR, 0xcull);
+        if (genwqe_need_err_masking(cd))
+                __genwqe_writeq(cd, IO_SLC_MISC_DEBUG, 0x0aull);
+}
diff --git a/drivers/misc/genwqe/genwqe_driver.h b/drivers/misc/genwqe/genwqe_driver.h
new file mode 100644
index 000000000000..46e916b36c70
--- /dev/null
+++ b/drivers/misc/genwqe/genwqe_driver.h
@@ -0,0 +1,77 @@
+#ifndef __GENWQE_DRIVER_H__
+#define __GENWQE_DRIVER_H__
+/**
+ * IBM Accelerator Family 'GenWQE'
+ *
+ * (C) Copyright IBM Corp. 2013
+ *
+ * Author: Frank Haverkamp <haver@linux.vnet.ibm.com>
+ * Author: Joerg-Stephan Vogt <jsvogt@de.ibm.com>
+ * Author: Michael Jung <mijung@de.ibm.com>
+ * Author: Michael Ruettger <michael@ibmra.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (version 2 only)
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+#include <linux/types.h>
+#include <linux/stddef.h>
+#include <linux/cdev.h>
+#include <linux/list.h>
+#include <linux/kthread.h>
+#include <linux/scatterlist.h>
+#include <linux/iommu.h>
+#include <linux/spinlock.h>
+#include <linux/mutex.h>
+#include <linux/platform_device.h>
+#include <linux/printk.h>
+#include <asm/byteorder.h>
+#include <linux/genwqe/genwqe_card.h>
+#define DRV_VERS_STRING         "2.0.0"
+/*
+ * Static minor number assignement, until we decide/implement
+ * something dynamic.
+ */
+#define GENWQE_MAX_MINOR        128 /* up to 128 possible genwqe devices */
+/**
+ * genwqe_requ_alloc() - Allocate a new DDCB execution request
+ *
+ * This data structure contains the user visiable fields of the DDCB
+ * to be executed.
+ *
+ * Return: ptr to genwqe_ddcb_cmd data structure
+ */
+struct genwqe_ddcb_cmd *ddcb_requ_alloc(void);
+/**
+ * ddcb_requ_free() - Free DDCB execution request.
+ * @req:       ptr to genwqe_ddcb_cmd data structure.
+ */
+void ddcb_requ_free(struct genwqe_ddcb_cmd *req);
+u32  genwqe_crc32(u8 *buff, size_t len, u32 init);
+static inline void genwqe_hexdump(struct pci_dev *pci_dev,
+                                  const void *buff, unsigned int size)
+{
+        char prefix[32];
+        scnprintf(prefix, sizeof(prefix), "%s %s: ",
+                  GENWQE_DEVNAME, pci_name(pci_dev));
+        print_hex_dump_debug(prefix, DUMP_PREFIX_OFFSET, 16, 1, buff,
+                             size, true);
+}
+#endif  /* __GENWQE_DRIVER_H__ */
diff --git a/drivers/misc/lkdtm.c b/drivers/misc/lkdtm.c
index a2edb2ee0921..49c7a23f02fc 100644
--- a/drivers/misc/lkdtm.c
+++ b/drivers/misc/lkdtm.c
@@ -224,7 +224,7 @@ static int jp_scsi_dispatch_cmd(struct scsi_cmnd *cmd)
 }
 #ifdef CONFIG_IDE
-int jp_generic_ide_ioctl(ide_drive_t *drive, struct file *file,
+static int jp_generic_ide_ioctl(ide_drive_t *drive, struct file *file,
                        struct block_device *bdev, unsigned int cmd,
                        unsigned long arg)
 {
@@ -334,9 +334,10 @@ static void execute_location(void *dst)
 static void execute_user_location(void *dst)
 {
+        /* Intentionally crossing kernel/user memory boundary. */
        void (*func)(void) = dst;
-        if (copy_to_user(dst, do_nothing, EXEC_SIZE))
+        if (copy_to_user((void __user *)dst, do_nothing, EXEC_SIZE))
                return;
        func();
 }
@@ -408,6 +409,8 @@ static void lkdtm_do_action(enum ctype which)
        case CT_SPINLOCKUP:
                /* Must be called twice to trigger. */
                spin_lock(&lock_me_up);
+                /* Let sparse know we intended to exit holding the lock. */
+                __release(&lock_me_up);
                break;
        case CT_HUNG_TASK:
                set_current_state(TASK_UNINTERRUPTIBLE);
diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
index d22c6864508b..2fad84432829 100644
--- a/drivers/misc/mei/amthif.c
+++ b/drivers/misc/mei/amthif.c
@@ -177,7 +177,7 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
        unsigned long timeout;
        int i;
-        /* Only Posible if we are in timeout */
+        /* Only possible if we are in timeout */
        if (!cl || cl != &dev->iamthif_cl) {
                dev_dbg(&dev->pdev->dev, "bad file ext.\n");
                return -ETIMEDOUT;
@@ -249,7 +249,7 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
            cb->response_buffer.size);
        dev_dbg(&dev->pdev->dev, "amthif cb->buf_idx - %lu\n", cb->buf_idx);
-        /* length is being turncated to PAGE_SIZE, however,
+        /* length is being truncated to PAGE_SIZE, however,
         * the buf_idx may point beyond */
        length = min_t(size_t, length, (cb->buf_idx - *offset));
@@ -316,6 +316,7 @@ static int mei_amthif_send_cmd(struct mei_device *dev, struct mei_cl_cb *cb)
                mei_hdr.host_addr = dev->iamthif_cl.host_client_id;
                mei_hdr.me_addr = dev->iamthif_cl.me_client_id;
                mei_hdr.reserved = 0;
+                mei_hdr.internal = 0;
                dev->iamthif_msg_buf_index += mei_hdr.length;
                ret = mei_write_message(dev, &mei_hdr, dev->iamthif_msg_buf);
                if (ret)
@@ -477,6 +478,7 @@ int mei_amthif_irq_write_complete(struct mei_cl *cl, struct mei_cl_cb *cb,
        mei_hdr.host_addr = cl->host_client_id;
        mei_hdr.me_addr = cl->me_client_id;
        mei_hdr.reserved = 0;
+        mei_hdr.internal = 0;
        if (*slots >= msg_slots) {
                mei_hdr.length = len;
diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c
index 87c96e4669e2..1ee2b9492a82 100644
--- a/drivers/misc/mei/client.c
+++ b/drivers/misc/mei/client.c
@@ -154,7 +154,7 @@ int mei_io_cb_alloc_req_buf(struct mei_cl_cb *cb, size_t length)
        return 0;
 }
 /**
- * mei_io_cb_alloc_resp_buf - allocate respose buffer
+ * mei_io_cb_alloc_resp_buf - allocate response buffer
 *
 * @cb: io callback structure
 * @length: size of the buffer
@@ -207,7 +207,7 @@ int mei_cl_flush_queues(struct mei_cl *cl)
 /**
- * mei_cl_init - initializes intialize cl.
+ * mei_cl_init - initializes cl.
 *
 * @cl: host client to be initialized
 * @dev: mei device
@@ -263,10 +263,10 @@ struct mei_cl_cb *mei_cl_find_read_cb(struct mei_cl *cl)
        return NULL;
 }
-/** mei_cl_link: allocte host id in the host map
+/** mei_cl_link: allocate host id in the host map
 *
 * @cl - host client
- * @id - fixed host id or -1 for genereting one
+ * @id - fixed host id or -1 for generic one
 *
 * returns 0 on success
 *      -EINVAL on incorrect values
@@ -282,19 +282,19 @@ int mei_cl_link(struct mei_cl *cl, int id)
        dev = cl->dev;
-        /* If Id is not asigned get one*/
+        /* If Id is not assigned get one*/
        if (id == MEI_HOST_CLIENT_ID_ANY)
                id = find_first_zero_bit(dev->host_clients_map,
                                        MEI_CLIENTS_MAX);
        if (id >= MEI_CLIENTS_MAX) {
-                dev_err(&dev->pdev->dev, "id exceded %d", MEI_CLIENTS_MAX) ;
+                dev_err(&dev->pdev->dev, "id exceeded %d", MEI_CLIENTS_MAX);
                return -EMFILE;
        }
        open_handle_count = dev->open_handle_count + dev->iamthif_open_count;
        if (open_handle_count >= MEI_MAX_OPEN_HANDLE_COUNT) {
-                dev_err(&dev->pdev->dev, "open_handle_count exceded %d",
+                dev_err(&dev->pdev->dev, "open_handle_count exceeded %d",
                        MEI_MAX_OPEN_HANDLE_COUNT);
                return -EMFILE;
        }
@@ -344,8 +344,6 @@ int mei_cl_unlink(struct mei_cl *cl)
        cl->state = MEI_FILE_INITIALIZING;
-        list_del_init(&cl->link);
        return 0;
 }
@@ -372,13 +370,14 @@ void mei_host_client_init(struct work_struct *work)
        }
        dev->dev_state = MEI_DEV_ENABLED;
+        dev->reset_count = 0;
        mutex_unlock(&dev->device_lock);
 }
 /**
- * mei_cl_disconnect - disconnect host clinet form the me one
+ * mei_cl_disconnect - disconnect host client from the me one
 *
 * @cl: host client
 *
@@ -457,7 +456,7 @@ free:
 *
 * @cl: private data of the file object
 *
- * returns ture if other client is connected, 0 - otherwise.
+ * returns true if other client is connected, false - otherwise.
 */
 bool mei_cl_is_other_connecting(struct mei_cl *cl)
 {
@@ -481,7 +480,7 @@ bool mei_cl_is_other_connecting(struct mei_cl *cl)
 }
 /**
- * mei_cl_connect - connect host clinet to the me one
+ * mei_cl_connect - connect host client to the me one
 *
 * @cl: host client
 *
@@ -729,6 +728,7 @@ int mei_cl_irq_write_complete(struct mei_cl *cl, struct mei_cl_cb *cb,
        mei_hdr.host_addr = cl->host_client_id;
        mei_hdr.me_addr = cl->me_client_id;
        mei_hdr.reserved = 0;
+        mei_hdr.internal = cb->internal;
        if (*slots >= msg_slots) {
                mei_hdr.length = len;
@@ -775,7 +775,7 @@ int mei_cl_irq_write_complete(struct mei_cl *cl, struct mei_cl_cb *cb,
 * @cl: host client
 * @cl: write callback with filled data
 *
- * returns numbe of bytes sent on success, <0 on failure.
+ * returns number of bytes sent on success, <0 on failure.
 */
 int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
 {
@@ -828,6 +828,7 @@ int mei_cl_write(struct mei_cl *cl, struct mei_cl_cb *cb, bool blocking)
        mei_hdr.host_addr = cl->host_client_id;
        mei_hdr.me_addr = cl->me_client_id;
        mei_hdr.reserved = 0;
+        mei_hdr.internal = cb->internal;
        rets = mei_write_message(dev, &mei_hdr, buf->data);
diff --git a/drivers/misc/mei/debugfs.c b/drivers/misc/mei/debugfs.c
index e3870f22d238..a3ae154444b2 100644
--- a/drivers/misc/mei/debugfs.c
+++ b/drivers/misc/mei/debugfs.c
@@ -43,7 +43,7 @@ static ssize_t mei_dbgfs_read_meclients(struct file *fp, char __user *ubuf,
        mutex_lock(&dev->device_lock);
-        /*  if the driver is not enabled the list won't b consitent */
+        /*  if the driver is not enabled the list won't be consistent */
        if (dev->dev_state != MEI_DEV_ENABLED)
                goto out;
@@ -101,7 +101,7 @@ static const struct file_operations mei_dbgfs_fops_devstate = {
 /**
 * mei_dbgfs_deregister - Remove the debugfs files and directories
- * @mei - pointer to mei device private dat
+ * @mei - pointer to mei device private data
 */
 void mei_dbgfs_deregister(struct mei_device *dev)
 {
diff --git a/drivers/misc/mei/hbm.c b/drivers/misc/mei/hbm.c
index 9b3a0fb7f265..28cd74c073b9 100644
--- a/drivers/misc/mei/hbm.c
+++ b/drivers/misc/mei/hbm.c
@@ -28,9 +28,9 @@
 *
 * @dev: the device structure
 *
- * returns none.
+ * returns 0 on success -ENOMEM on allocation failure
 */
-static void mei_hbm_me_cl_allocate(struct mei_device *dev)
+static int mei_hbm_me_cl_allocate(struct mei_device *dev)
 {
        struct mei_me_client *clients;
        int b;
@@ -44,7 +44,7 @@ static void mei_hbm_me_cl_allocate(struct mei_device *dev)
                dev->me_clients_num++;
        if (dev->me_clients_num == 0)
-                return;
+                return 0;
        kfree(dev->me_clients);
        dev->me_clients = NULL;
@@ -56,12 +56,10 @@ static void mei_hbm_me_cl_allocate(struct mei_device *dev)
                        sizeof(struct mei_me_client), GFP_KERNEL);
        if (!clients) {
                dev_err(&dev->pdev->dev, "memory allocation for ME clients failed.\n");
-                dev->dev_state = MEI_DEV_RESETTING;
+                return -ENOMEM;
-                mei_reset(dev, 1);
-                return;
        }
        dev->me_clients = clients;
-        return;
+        return 0;
 }
 /**
@@ -85,12 +83,12 @@ void mei_hbm_cl_hdr(struct mei_cl *cl, u8 hbm_cmd, void *buf, size_t len)
 }
 /**
- * same_disconn_addr - tells if they have the same address
+ * mei_hbm_cl_addr_equal - tells if they have the same address
 *
- * @file: private data of the file object.
+ * @cl: - client
- * @disconn: disconnection request.
+ * @buf: buffer with cl header
 *
- * returns true if addres are same
+ * returns true if addresses are the same
 */
 static inline
 bool mei_hbm_cl_addr_equal(struct mei_cl *cl, void *buf)
@@ -128,6 +126,17 @@ static bool is_treat_specially_client(struct mei_cl *cl,
        return false;
 }
+/**
+ * mei_hbm_idle - set hbm to idle state
+ *
+ * @dev: the device structure
+ */
+void mei_hbm_idle(struct mei_device *dev)
+{
+        dev->init_clients_timer = 0;
+        dev->hbm_state = MEI_HBM_IDLE;
+}
 int mei_hbm_start_wait(struct mei_device *dev)
 {
        int ret;
@@ -137,7 +146,7 @@ int mei_hbm_start_wait(struct mei_device *dev)
        mutex_unlock(&dev->device_lock);
        ret = wait_event_interruptible_timeout(dev->wait_recvd_msg,
                        dev->hbm_state == MEI_HBM_IDLE ||
-                        dev->hbm_state > MEI_HBM_START,
+                        dev->hbm_state >= MEI_HBM_STARTED,
                        mei_secs_to_jiffies(MEI_INTEROP_TIMEOUT));
        mutex_lock(&dev->device_lock);
@@ -153,12 +162,15 @@ int mei_hbm_start_wait(struct mei_device *dev)
 * mei_hbm_start_req - sends start request message.
 *
 * @dev: the device structure
+ *
+ * returns 0 on success and < 0 on failure
 */
 int mei_hbm_start_req(struct mei_device *dev)
 {
        struct mei_msg_hdr *mei_hdr = &dev->wr_msg.hdr;
        struct hbm_host_version_request *start_req;
        const size_t len = sizeof(struct hbm_host_version_request);
+        int ret;
        mei_hbm_hdr(mei_hdr, len);
@@ -170,12 +182,13 @@ int mei_hbm_start_req(struct mei_device *dev)
        start_req->host_version.minor_version = HBM_MINOR_VERSION;
        dev->hbm_state = MEI_HBM_IDLE;
-        if (mei_write_message(dev, mei_hdr, dev->wr_msg.data)) {
+        ret = mei_write_message(dev, mei_hdr, dev->wr_msg.data);
-                dev_err(&dev->pdev->dev, "version message write failed\n");
+        if (ret) {
-                dev->dev_state = MEI_DEV_RESETTING;
+                dev_err(&dev->pdev->dev, "version message write failed: ret = %d\n",
-                mei_reset(dev, 1);
+                        ret);
-                return -EIO;
+                return ret;
        }
        dev->hbm_state = MEI_HBM_START;
        dev->init_clients_timer = MEI_CLIENTS_INIT_TIMEOUT;
        return 0;
@@ -186,13 +199,15 @@ int mei_hbm_start_req(struct mei_device *dev)
 *
 * @dev: the device structure
 *
- * returns none.
+ * returns 0 on success and < 0 on failure
 */
-static void mei_hbm_enum_clients_req(struct mei_device *dev)
+static int mei_hbm_enum_clients_req(struct mei_device *dev)
 {
        struct mei_msg_hdr *mei_hdr = &dev->wr_msg.hdr;
        struct hbm_host_enum_request *enum_req;
        const size_t len = sizeof(struct hbm_host_enum_request);
+        int ret;
        /* enumerate clients */
        mei_hbm_hdr(mei_hdr, len);
@@ -200,14 +215,15 @@ static void mei_hbm_enum_clients_req(struct mei_device *dev)
        memset(enum_req, 0, len);
        enum_req->hbm_cmd = HOST_ENUM_REQ_CMD;
-        if (mei_write_message(dev, mei_hdr, dev->wr_msg.data)) {
+        ret = mei_write_message(dev, mei_hdr, dev->wr_msg.data);
-                dev->dev_state = MEI_DEV_RESETTING;
+        if (ret) {
-                dev_err(&dev->pdev->dev, "enumeration request write failed.\n");
+                dev_err(&dev->pdev->dev, "enumeration request write failed: ret = %d.\n",
-                mei_reset(dev, 1);
+                        ret);
+                return ret;
        }
        dev->hbm_state = MEI_HBM_ENUM_CLIENTS;
        dev->init_clients_timer = MEI_CLIENTS_INIT_TIMEOUT;
-        return;
+        return 0;
 }
 /**
@@ -215,7 +231,7 @@ static void mei_hbm_enum_clients_req(struct mei_device *dev)
 *
 * @dev: the device structure
 *
- * returns none.
+ * returns 0 on success and < 0 on failure
 */
 static int mei_hbm_prop_req(struct mei_device *dev)
@@ -226,7 +242,7 @@ static int mei_hbm_prop_req(struct mei_device *dev)
        const size_t len = sizeof(struct hbm_props_request);
        unsigned long next_client_index;
        unsigned long client_num;
+        int ret;
        client_num = dev->me_client_presentation_num;
@@ -253,12 +269,11 @@ static int mei_hbm_prop_req(struct mei_device *dev)
        prop_req->hbm_cmd = HOST_CLIENT_PROPERTIES_REQ_CMD;
        prop_req->address = next_client_index;
-        if (mei_write_message(dev, mei_hdr, dev->wr_msg.data)) {
+        ret = mei_write_message(dev, mei_hdr, dev->wr_msg.data);
-                dev->dev_state = MEI_DEV_RESETTING;
+        if (ret) {
-                dev_err(&dev->pdev->dev, "properties request write failed\n");
+                dev_err(&dev->pdev->dev, "properties request write failed: ret = %d\n",
-                mei_reset(dev, 1);
+                        ret);
+                return ret;
-                return -EIO;
        }
        dev->init_clients_timer = MEI_CLIENTS_INIT_TIMEOUT;
@@ -268,7 +283,7 @@ static int mei_hbm_prop_req(struct mei_device *dev)
 }
 /**
- * mei_hbm_stop_req_prepare - perpare stop request message
+ * mei_hbm_stop_req_prepare - prepare stop request message
 *
 * @dev - mei device
 * @mei_hdr - mei message header
@@ -289,7 +304,7 @@ static void mei_hbm_stop_req_prepare(struct mei_device *dev,
 }
 /**
- * mei_hbm_cl_flow_control_req - sends flow control requst.
+ * mei_hbm_cl_flow_control_req - sends flow control request.
 *
 * @dev: the device structure
 * @cl: client info
@@ -451,7 +466,7 @@ int mei_hbm_cl_connect_req(struct mei_device *dev, struct mei_cl *cl)
 }
 /**
- * mei_hbm_cl_connect_res - connect resposne from the ME
+ * mei_hbm_cl_connect_res - connect response from the ME
 *
 * @dev: the device structure
 * @rs: connect response bus message
@@ -505,8 +520,8 @@ static void mei_hbm_cl_connect_res(struct mei_device *dev,
 /**
- * mei_hbm_fw_disconnect_req - disconnect request initiated by me
+ * mei_hbm_fw_disconnect_req - disconnect request initiated by ME firmware
- *  host sends disoconnect response
+ *  host sends disconnect response
 *
 * @dev: the device structure.
 * @disconnect_req: disconnect request bus message from the me
@@ -559,8 +574,10 @@ bool mei_hbm_version_is_supported(struct mei_device *dev)
 *
 * @dev: the device structure
 * @mei_hdr: header of bus message
+ *
+ * returns 0 on success and < 0 on failure
 */
-void mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
+int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
 {
        struct mei_bus_message *mei_msg;
        struct mei_me_client *me_client;
@@ -577,8 +594,20 @@ void mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
        mei_read_slots(dev, dev->rd_msg_buf, hdr->length);
        mei_msg = (struct mei_bus_message *)dev->rd_msg_buf;
+        /* ignore spurious message and prevent reset nesting
+         * hbm is put to idle during system reset
+         */
+        if (dev->hbm_state == MEI_HBM_IDLE) {
+                dev_dbg(&dev->pdev->dev, "hbm: state is idle ignore spurious messages\n");
+                return 0;
+        }
        switch (mei_msg->hbm_cmd) {
        case HOST_START_RES_CMD:
+                dev_dbg(&dev->pdev->dev, "hbm: start: response message received.\n");
+                dev->init_clients_timer = 0;
                version_res = (struct hbm_host_version_response *)mei_msg;
                dev_dbg(&dev->pdev->dev, "HBM VERSION: DRIVER=%02d:%02d DEVICE=%02d:%02d\n",
@@ -597,73 +626,89 @@ void mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                }
                if (!mei_hbm_version_is_supported(dev)) {
-                        dev_warn(&dev->pdev->dev, "hbm version mismatch: stopping the driver.\n");
+                        dev_warn(&dev->pdev->dev, "hbm: start: version mismatch - stopping the driver.\n");
-                        dev->hbm_state = MEI_HBM_STOP;
+                        dev->hbm_state = MEI_HBM_STOPPED;
                        mei_hbm_stop_req_prepare(dev, &dev->wr_msg.hdr,
                                                dev->wr_msg.data);
-                        mei_write_message(dev, &dev->wr_msg.hdr,
+                        if (mei_write_message(dev, &dev->wr_msg.hdr,
-                                        dev->wr_msg.data);
+                                        dev->wr_msg.data)) {
+                                dev_err(&dev->pdev->dev, "hbm: start: failed to send stop request\n");
+                                return -EIO;
+                        }
+                        break;
+                }
-                        return;
+                if (dev->dev_state != MEI_DEV_INIT_CLIENTS ||
+                    dev->hbm_state != MEI_HBM_START) {
+                        dev_err(&dev->pdev->dev, "hbm: start: state mismatch, [%d, %d]\n",
+                                dev->dev_state, dev->hbm_state);
+                        return -EPROTO;
                }
-                if (dev->dev_state == MEI_DEV_INIT_CLIENTS &&
+                dev->hbm_state = MEI_HBM_STARTED;
-                    dev->hbm_state == MEI_HBM_START) {
-                        dev->init_clients_timer = 0;
+                if (mei_hbm_enum_clients_req(dev)) {
-                        mei_hbm_enum_clients_req(dev);
+                        dev_err(&dev->pdev->dev, "hbm: start: failed to send enumeration request\n");
-                } else {
+                        return -EIO;
-                        dev_err(&dev->pdev->dev, "reset: wrong host start response\n");
-                        mei_reset(dev, 1);
-                        return;
                }
                wake_up_interruptible(&dev->wait_recvd_msg);
-                dev_dbg(&dev->pdev->dev, "host start response message received.\n");
                break;
        case CLIENT_CONNECT_RES_CMD:
+                dev_dbg(&dev->pdev->dev, "hbm: client connect response: message received.\n");
                connect_res = (struct hbm_client_connect_response *) mei_msg;
                mei_hbm_cl_connect_res(dev, connect_res);
-                dev_dbg(&dev->pdev->dev, "client connect response message received.\n");
                wake_up(&dev->wait_recvd_msg);
                break;
        case CLIENT_DISCONNECT_RES_CMD:
+                dev_dbg(&dev->pdev->dev, "hbm: client disconnect response: message received.\n");
                disconnect_res = (struct hbm_client_connect_response *) mei_msg;
                mei_hbm_cl_disconnect_res(dev, disconnect_res);
-                dev_dbg(&dev->pdev->dev, "client disconnect response message received.\n");
                wake_up(&dev->wait_recvd_msg);
                break;
        case MEI_FLOW_CONTROL_CMD:
+                dev_dbg(&dev->pdev->dev, "hbm: client flow control response: message received.\n");
                flow_control = (struct hbm_flow_control *) mei_msg;
                mei_hbm_cl_flow_control_res(dev, flow_control);
-                dev_dbg(&dev->pdev->dev, "client flow control response message received.\n");
                break;
        case HOST_CLIENT_PROPERTIES_RES_CMD:
+                dev_dbg(&dev->pdev->dev, "hbm: properties response: message received.\n");
+                dev->init_clients_timer = 0;
+                if (dev->me_clients == NULL) {
+                        dev_err(&dev->pdev->dev, "hbm: properties response: mei_clients not allocated\n");
+                        return -EPROTO;
+                }
                props_res = (struct hbm_props_response *)mei_msg;
                me_client = &dev->me_clients[dev->me_client_presentation_num];
-                if (props_res->status || !dev->me_clients) {
+                if (props_res->status) {
-                        dev_err(&dev->pdev->dev, "reset: properties response hbm wrong status.\n");
+                        dev_err(&dev->pdev->dev, "hbm: properties response: wrong status = %d\n",
-                        mei_reset(dev, 1);
+                                props_res->status);
-                        return;
+                        return -EPROTO;
                }
                if (me_client->client_id != props_res->address) {
-                        dev_err(&dev->pdev->dev, "reset: host properties response address mismatch\n");
+                        dev_err(&dev->pdev->dev, "hbm: properties response: address mismatch %d ?= %d\n",
-                        mei_reset(dev, 1);
+                                me_client->client_id, props_res->address);
-                        return;
+                        return -EPROTO;
                }
                if (dev->dev_state != MEI_DEV_INIT_CLIENTS ||
                    dev->hbm_state != MEI_HBM_CLIENT_PROPERTIES) {
-                        dev_err(&dev->pdev->dev, "reset: unexpected properties response\n");
+                        dev_err(&dev->pdev->dev, "hbm: properties response: state mismatch, [%d, %d]\n",
-                        mei_reset(dev, 1);
+                                dev->dev_state, dev->hbm_state);
+                        return -EPROTO;
-                        return;
                }
                me_client->props = props_res->client_properties;
@@ -671,49 +716,70 @@ void mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                dev->me_client_presentation_num++;
                /* request property for the next client */
-                mei_hbm_prop_req(dev);
+                if (mei_hbm_prop_req(dev))
+                        return -EIO;
                break;
        case HOST_ENUM_RES_CMD:
+                dev_dbg(&dev->pdev->dev, "hbm: enumeration response: message received\n");
+                dev->init_clients_timer = 0;
                enum_res = (struct hbm_host_enum_response *) mei_msg;
                BUILD_BUG_ON(sizeof(dev->me_clients_map)
                                < sizeof(enum_res->valid_addresses));
                memcpy(dev->me_clients_map, enum_res->valid_addresses,
                        sizeof(enum_res->valid_addresses));
-                if (dev->dev_state == MEI_DEV_INIT_CLIENTS &&
-                    dev->hbm_state == MEI_HBM_ENUM_CLIENTS) {
+                if (dev->dev_state != MEI_DEV_INIT_CLIENTS ||
-                                dev->init_clients_timer = 0;
+                    dev->hbm_state != MEI_HBM_ENUM_CLIENTS) {
-                                mei_hbm_me_cl_allocate(dev);
+                        dev_err(&dev->pdev->dev, "hbm: enumeration response: state mismatch, [%d, %d]\n",
-                                dev->hbm_state = MEI_HBM_CLIENT_PROPERTIES;
+                                dev->dev_state, dev->hbm_state);
+                        return -EPROTO;
-                                /* first property reqeust */
+                }
-                                mei_hbm_prop_req(dev);
-                } else {
+                if (mei_hbm_me_cl_allocate(dev)) {
-                        dev_err(&dev->pdev->dev, "reset: unexpected enumeration response hbm.\n");
+                        dev_err(&dev->pdev->dev, "hbm: enumeration response: cannot allocate clients array\n");
-                        mei_reset(dev, 1);
+                        return -ENOMEM;
-                        return;
                }
+                dev->hbm_state = MEI_HBM_CLIENT_PROPERTIES;
+                /* first property request */
+                if (mei_hbm_prop_req(dev))
+                        return -EIO;
                break;
        case HOST_STOP_RES_CMD:
+                dev_dbg(&dev->pdev->dev, "hbm: stop response: message received\n");
+                dev->init_clients_timer = 0;
-                if (dev->hbm_state != MEI_HBM_STOP)
+                if (dev->hbm_state != MEI_HBM_STOPPED) {
-                        dev_err(&dev->pdev->dev, "unexpected stop response hbm.\n");
+                        dev_err(&dev->pdev->dev, "hbm: stop response: state mismatch, [%d, %d]\n",
-                dev->dev_state = MEI_DEV_DISABLED;
+                                dev->dev_state, dev->hbm_state);
-                dev_info(&dev->pdev->dev, "reset: FW stop response.\n");
+                        return -EPROTO;
-                mei_reset(dev, 1);
+                }
+                dev->dev_state = MEI_DEV_POWER_DOWN;
+                dev_info(&dev->pdev->dev, "hbm: stop response: resetting.\n");
+                /* force the reset */
+                return -EPROTO;
                break;
        case CLIENT_DISCONNECT_REQ_CMD:
-                /* search for client */
+                dev_dbg(&dev->pdev->dev, "hbm: disconnect request: message received\n");
                disconnect_req = (struct hbm_client_connect_request *)mei_msg;
                mei_hbm_fw_disconnect_req(dev, disconnect_req);
                break;
        case ME_STOP_REQ_CMD:
+                dev_dbg(&dev->pdev->dev, "hbm: stop request: message received\n");
-                dev->hbm_state = MEI_HBM_STOP;
+                dev->hbm_state = MEI_HBM_STOPPED;
                mei_hbm_stop_req_prepare(dev, &dev->wr_ext_msg.hdr,
                                        dev->wr_ext_msg.data);
                break;
@@ -722,5 +788,6 @@ void mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr)
                break;
        }
+        return 0;
 }
diff --git a/drivers/misc/mei/hbm.h b/drivers/misc/mei/hbm.h
index 4ae2e56e404f..5f92188a5cd7 100644
--- a/drivers/misc/mei/hbm.h
+++ b/drivers/misc/mei/hbm.h
@@ -32,13 +32,13 @@ struct mei_cl;
 enum mei_hbm_state {
        MEI_HBM_IDLE = 0,
        MEI_HBM_START,
+        MEI_HBM_STARTED,
        MEI_HBM_ENUM_CLIENTS,
        MEI_HBM_CLIENT_PROPERTIES,
-        MEI_HBM_STARTED,
+        MEI_HBM_STOPPED,
-        MEI_HBM_STOP,
 };
-void mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr);
+int mei_hbm_dispatch(struct mei_device *dev, struct mei_msg_hdr *hdr);
 static inline void mei_hbm_hdr(struct mei_msg_hdr *hdr, size_t length)
 {
@@ -49,6 +49,7 @@ static inline void mei_hbm_hdr(struct mei_msg_hdr *hdr, size_t length)
        hdr->reserved = 0;
 }
+void mei_hbm_idle(struct mei_device *dev);
 int mei_hbm_start_req(struct mei_device *dev);
 int mei_hbm_start_wait(struct mei_device *dev);
 int mei_hbm_cl_flow_control_req(struct mei_device *dev, struct mei_cl *cl);
diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
index 3412adcdaeb0..6f656c053b14 100644
--- a/drivers/misc/mei/hw-me.c
+++ b/drivers/misc/mei/hw-me.c
@@ -185,7 +185,7 @@ static int mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
        mei_me_reg_write(hw, H_CSR, hcsr);
-        if (dev->dev_state == MEI_DEV_POWER_DOWN)
+        if (intr_enable == false)
                mei_me_hw_reset_release(dev);
        return 0;
@@ -469,7 +469,7 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id)
        struct mei_device *dev = (struct mei_device *) dev_id;
        struct mei_cl_cb complete_list;
        s32 slots;
-        int rets;
+        int rets = 0;
        dev_dbg(&dev->pdev->dev, "function called after ISR to handle the interrupt processing.\n");
        /* initialize our complete list */
@@ -482,15 +482,10 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id)
                mei_clear_interrupts(dev);
        /* check if ME wants a reset */
-        if (!mei_hw_is_ready(dev) &&
+        if (!mei_hw_is_ready(dev) && dev->dev_state != MEI_DEV_RESETTING) {
-            dev->dev_state != MEI_DEV_RESETTING &&
+                dev_warn(&dev->pdev->dev, "FW not ready: resetting.\n");
-            dev->dev_state != MEI_DEV_INITIALIZING &&
+                schedule_work(&dev->reset_work);
-            dev->dev_state != MEI_DEV_POWER_DOWN &&
+                goto end;
-            dev->dev_state != MEI_DEV_POWER_UP) {
-                dev_dbg(&dev->pdev->dev, "FW not ready.\n");
-                mei_reset(dev, 1);
-                mutex_unlock(&dev->device_lock);
-                return IRQ_HANDLED;
        }
        /*  check if we need to start the dev */
@@ -500,15 +495,12 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id)
                        dev->recvd_hw_ready = true;
                        wake_up_interruptible(&dev->wait_hw_ready);
-                        mutex_unlock(&dev->device_lock);
-                        return IRQ_HANDLED;
                } else {
                        dev_dbg(&dev->pdev->dev, "Reset Completed.\n");
                        mei_me_hw_reset_release(dev);
-                        mutex_unlock(&dev->device_lock);
-                        return IRQ_HANDLED;
                }
+                goto end;
        }
        /* check slots available for reading */
        slots = mei_count_full_read_slots(dev);
@@ -516,21 +508,23 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id)
                /* we have urgent data to send so break the read */
                if (dev->wr_ext_msg.hdr.length)
                        break;
-                dev_dbg(&dev->pdev->dev, "slots =%08x\n", slots);
+                dev_dbg(&dev->pdev->dev, "slots to read = %08x\n", slots);
-                dev_dbg(&dev->pdev->dev, "call mei_irq_read_handler.\n");
                rets = mei_irq_read_handler(dev, &complete_list, &slots);
-                if (rets)
+                if (rets && dev->dev_state != MEI_DEV_RESETTING) {
+                        schedule_work(&dev->reset_work);
                        goto end;
+                }
        }
        rets = mei_irq_write_handler(dev, &complete_list);
-end:
-        dev_dbg(&dev->pdev->dev, "end of bottom half function.\n");
-        dev->hbuf_is_ready = mei_hbuf_is_ready(dev);
-        mutex_unlock(&dev->device_lock);
+        dev->hbuf_is_ready = mei_hbuf_is_ready(dev);
        mei_irq_compl_handler(dev, &complete_list);
+end:
+        dev_dbg(&dev->pdev->dev, "interrupt thread end ret = %d\n", rets);
+        mutex_unlock(&dev->device_lock);
        return IRQ_HANDLED;
 }
 static const struct mei_hw_ops mei_me_hw_ops = {
diff --git a/drivers/misc/mei/hw.h b/drivers/misc/mei/hw.h
index cb2f556b4252..dd44e33ad2b6 100644
--- a/drivers/misc/mei/hw.h
+++ b/drivers/misc/mei/hw.h
@@ -111,7 +111,8 @@ struct mei_msg_hdr {
        u32 me_addr:8;
        u32 host_addr:8;
        u32 length:9;
-        u32 reserved:6;
+        u32 reserved:5;
+        u32 internal:1;
        u32 msg_complete:1;
 } __packed;
diff --git a/drivers/misc/mei/init.c b/drivers/misc/mei/init.c
index f7f3abbe12b6..cdd31c2a2a2b 100644
--- a/drivers/misc/mei/init.c
+++ b/drivers/misc/mei/init.c
@@ -43,41 +43,119 @@ const char *mei_dev_state_str(int state)
 #undef MEI_DEV_STATE
 }
-void mei_device_init(struct mei_device *dev)
-{
-        /* setup our list array */
-        INIT_LIST_HEAD(&dev->file_list);
-        INIT_LIST_HEAD(&dev->device_list);
-        mutex_init(&dev->device_lock);
-        init_waitqueue_head(&dev->wait_hw_ready);
-        init_waitqueue_head(&dev->wait_recvd_msg);
-        init_waitqueue_head(&dev->wait_stop_wd);
-        dev->dev_state = MEI_DEV_INITIALIZING;
-        mei_io_list_init(&dev->read_list);
+/**
-        mei_io_list_init(&dev->write_list);
+ * mei_cancel_work. Cancel mei background jobs
-        mei_io_list_init(&dev->write_waiting_list);
+ *
-        mei_io_list_init(&dev->ctrl_wr_list);
+ * @dev: the device structure
-        mei_io_list_init(&dev->ctrl_rd_list);
+ *
+ * returns 0 on success or < 0 if the reset hasn't succeeded
+ */
+void mei_cancel_work(struct mei_device *dev)
+{
+        cancel_work_sync(&dev->init_work);
+        cancel_work_sync(&dev->reset_work);
-        INIT_DELAYED_WORK(&dev->timer_work, mei_timer);
+        cancel_delayed_work(&dev->timer_work);
-        INIT_WORK(&dev->init_work, mei_host_client_init);
+}
+EXPORT_SYMBOL_GPL(mei_cancel_work);
-        INIT_LIST_HEAD(&dev->wd_cl.link);
+/**
-        INIT_LIST_HEAD(&dev->iamthif_cl.link);
+ * mei_reset - resets host and fw.
-        mei_io_list_init(&dev->amthif_cmd_list);
+ *
-        mei_io_list_init(&dev->amthif_rd_complete_list);
+ * @dev: the device structure
+ */
+int mei_reset(struct mei_device *dev)
+{
+        enum mei_dev_state state = dev->dev_state;
+        bool interrupts_enabled;
+        int ret;
-        bitmap_zero(dev->host_clients_map, MEI_CLIENTS_MAX);
+        if (state != MEI_DEV_INITIALIZING &&
-        dev->open_handle_count = 0;
+            state != MEI_DEV_DISABLED &&
+            state != MEI_DEV_POWER_DOWN &&
+            state != MEI_DEV_POWER_UP)
+                dev_warn(&dev->pdev->dev, "unexpected reset: dev_state = %s\n",
+                         mei_dev_state_str(state));
-        /*
+        /* we're already in reset, cancel the init timer
-         * Reserving the first client ID
+         * if the reset was called due the hbm protocol error
-         * 0: Reserved for MEI Bus Message communications
+         * we need to call it before hw start
+         * so the hbm watchdog won't kick in
         */
-        bitmap_set(dev->host_clients_map, 0, 1);
+        mei_hbm_idle(dev);
+        /* enter reset flow */
+        interrupts_enabled = state != MEI_DEV_POWER_DOWN;
+        dev->dev_state = MEI_DEV_RESETTING;
+        dev->reset_count++;
+        if (dev->reset_count > MEI_MAX_CONSEC_RESET) {
+                dev_err(&dev->pdev->dev, "reset: reached maximal consecutive resets: disabling the device\n");
+                dev->dev_state = MEI_DEV_DISABLED;
+                return -ENODEV;
+        }
+        ret = mei_hw_reset(dev, interrupts_enabled);
+        /* fall through and remove the sw state even if hw reset has failed */
+        /* no need to clean up software state in case of power up */
+        if (state != MEI_DEV_INITIALIZING &&
+            state != MEI_DEV_POWER_UP) {
+                /* remove all waiting requests */
+                mei_cl_all_write_clear(dev);
+                mei_cl_all_disconnect(dev);
+                /* wake up all readers and writers so they can be interrupted */
+                mei_cl_all_wakeup(dev);
+                /* remove entry if already in list */
+                dev_dbg(&dev->pdev->dev, "remove iamthif and wd from the file list.\n");
+                mei_cl_unlink(&dev->wd_cl);
+                mei_cl_unlink(&dev->iamthif_cl);
+                mei_amthif_reset_params(dev);
+                memset(&dev->wr_ext_msg, 0, sizeof(dev->wr_ext_msg));
+        }
+        dev->me_clients_num = 0;
+        dev->rd_msg_hdr = 0;
+        dev->wd_pending = false;
+        if (ret) {
+                dev_err(&dev->pdev->dev, "hw_reset failed ret = %d\n", ret);
+                dev->dev_state = MEI_DEV_DISABLED;
+                return ret;
+        }
+        if (state == MEI_DEV_POWER_DOWN) {
+                dev_dbg(&dev->pdev->dev, "powering down: end of reset\n");
+                dev->dev_state = MEI_DEV_DISABLED;
+                return 0;
+        }
+        ret = mei_hw_start(dev);
+        if (ret) {
+                dev_err(&dev->pdev->dev, "hw_start failed ret = %d\n", ret);
+                dev->dev_state = MEI_DEV_DISABLED;
+                return ret;
+        }
+        dev_dbg(&dev->pdev->dev, "link is established start sending messages.\n");
+        dev->dev_state = MEI_DEV_INIT_CLIENTS;
+        ret = mei_hbm_start_req(dev);
+        if (ret) {
+                dev_err(&dev->pdev->dev, "hbm_start failed ret = %d\n", ret);
+                dev->dev_state = MEI_DEV_DISABLED;
+                return ret;
+        }
+        return 0;
 }
-EXPORT_SYMBOL_GPL(mei_device_init);
+EXPORT_SYMBOL_GPL(mei_reset);
 /**
 * mei_start - initializes host and fw to start work.
@@ -90,14 +168,21 @@ int mei_start(struct mei_device *dev)
 {
        mutex_lock(&dev->device_lock);
-        /* acknowledge interrupt and stop interupts */
+        /* acknowledge interrupt and stop interrupts */
        mei_clear_interrupts(dev);
        mei_hw_config(dev);
        dev_dbg(&dev->pdev->dev, "reset in start the mei device.\n");
-        mei_reset(dev, 1);
+        dev->dev_state = MEI_DEV_INITIALIZING;
+        dev->reset_count = 0;
+        mei_reset(dev);
+        if (dev->dev_state == MEI_DEV_DISABLED) {
+                dev_err(&dev->pdev->dev, "reset failed");
+                goto err;
+        }
        if (mei_hbm_start_wait(dev)) {
                dev_err(&dev->pdev->dev, "HBM haven't started");
@@ -132,101 +217,64 @@ err:
 EXPORT_SYMBOL_GPL(mei_start);
 /**
- * mei_reset - resets host and fw.
+ * mei_restart - restart device after suspend
 *
 * @dev: the device structure
- * @interrupts_enabled: if interrupt should be enabled after reset.
+ *
+ * returns 0 on success or -ENODEV if the restart hasn't succeeded
 */
-void mei_reset(struct mei_device *dev, int interrupts_enabled)
+int mei_restart(struct mei_device *dev)
 {
-        bool unexpected;
+        int err;
-        int ret;
-        unexpected = (dev->dev_state != MEI_DEV_INITIALIZING &&
-                        dev->dev_state != MEI_DEV_DISABLED &&
-                        dev->dev_state != MEI_DEV_POWER_DOWN &&
-                        dev->dev_state != MEI_DEV_POWER_UP);
-        if (unexpected)
+        mutex_lock(&dev->device_lock);
-                dev_warn(&dev->pdev->dev, "unexpected reset: dev_state = %s\n",
-                         mei_dev_state_str(dev->dev_state));
-        ret = mei_hw_reset(dev, interrupts_enabled);
-        if (ret) {
-                dev_err(&dev->pdev->dev, "hw reset failed disabling the device\n");
-                interrupts_enabled = false;
-                dev->dev_state = MEI_DEV_DISABLED;
-        }
-        dev->hbm_state = MEI_HBM_IDLE;
-        if (dev->dev_state != MEI_DEV_INITIALIZING &&
+        mei_clear_interrupts(dev);
-            dev->dev_state != MEI_DEV_POWER_UP) {
-                if (dev->dev_state != MEI_DEV_DISABLED &&
-                    dev->dev_state != MEI_DEV_POWER_DOWN)
-                        dev->dev_state = MEI_DEV_RESETTING;
-                /* remove all waiting requests */
+        dev->dev_state = MEI_DEV_POWER_UP;
-                mei_cl_all_write_clear(dev);
+        dev->reset_count = 0;
-                mei_cl_all_disconnect(dev);
+        err = mei_reset(dev);
-                /* wake up all readings so they can be interrupted */
+        mutex_unlock(&dev->device_lock);
-                mei_cl_all_wakeup(dev);
-                /* remove entry if already in list */
-                dev_dbg(&dev->pdev->dev, "remove iamthif and wd from the file list.\n");
-                mei_cl_unlink(&dev->wd_cl);
-                mei_cl_unlink(&dev->iamthif_cl);
-                mei_amthif_reset_params(dev);
-                memset(&dev->wr_ext_msg, 0, sizeof(dev->wr_ext_msg));
-        }
-        /* we're already in reset, cancel the init timer */
+        if (err || dev->dev_state == MEI_DEV_DISABLED)
-        dev->init_clients_timer = 0;
+                return -ENODEV;
-        dev->me_clients_num = 0;
+        return 0;
-        dev->rd_msg_hdr = 0;
+}
-        dev->wd_pending = false;
+EXPORT_SYMBOL_GPL(mei_restart);
-        if (!interrupts_enabled) {
-                dev_dbg(&dev->pdev->dev, "intr not enabled end of reset\n");
-                return;
-        }
-        ret = mei_hw_start(dev);
+static void mei_reset_work(struct work_struct *work)
-        if (ret) {
+{
-                dev_err(&dev->pdev->dev, "hw_start failed disabling the device\n");
+        struct mei_device *dev =
-                dev->dev_state = MEI_DEV_DISABLED;
+                container_of(work, struct mei_device,  reset_work);
-                return;
-        }
-        dev_dbg(&dev->pdev->dev, "link is established start sending messages.\n");
+        mutex_lock(&dev->device_lock);
-        /* link is established * start sending messages.  */
-        dev->dev_state = MEI_DEV_INIT_CLIENTS;
+        mei_reset(dev);
-        mei_hbm_start_req(dev);
+        mutex_unlock(&dev->device_lock);
+        if (dev->dev_state == MEI_DEV_DISABLED)
+                dev_err(&dev->pdev->dev, "reset failed");
 }
-EXPORT_SYMBOL_GPL(mei_reset);
 void mei_stop(struct mei_device *dev)
 {
        dev_dbg(&dev->pdev->dev, "stopping the device.\n");
-        flush_scheduled_work();
+        mei_cancel_work(dev);
-        mutex_lock(&dev->device_lock);
+        mei_nfc_host_exit(dev);
-        cancel_delayed_work(&dev->timer_work);
+        mutex_lock(&dev->device_lock);
        mei_wd_stop(dev);
-        mei_nfc_host_exit();
        dev->dev_state = MEI_DEV_POWER_DOWN;
-        mei_reset(dev, 0);
+        mei_reset(dev);
        mutex_unlock(&dev->device_lock);
@@ -236,3 +284,41 @@ EXPORT_SYMBOL_GPL(mei_stop);
+void mei_device_init(struct mei_device *dev)
+{
+        /* setup our list array */
+        INIT_LIST_HEAD(&dev->file_list);
+        INIT_LIST_HEAD(&dev->device_list);
+        mutex_init(&dev->device_lock);
+        init_waitqueue_head(&dev->wait_hw_ready);
+        init_waitqueue_head(&dev->wait_recvd_msg);
+        init_waitqueue_head(&dev->wait_stop_wd);
+        dev->dev_state = MEI_DEV_INITIALIZING;
+        dev->reset_count = 0;
+        mei_io_list_init(&dev->read_list);
+        mei_io_list_init(&dev->write_list);
+        mei_io_list_init(&dev->write_waiting_list);
+        mei_io_list_init(&dev->ctrl_wr_list);
+        mei_io_list_init(&dev->ctrl_rd_list);
+        INIT_DELAYED_WORK(&dev->timer_work, mei_timer);
+        INIT_WORK(&dev->init_work, mei_host_client_init);
+        INIT_WORK(&dev->reset_work, mei_reset_work);
+        INIT_LIST_HEAD(&dev->wd_cl.link);
+        INIT_LIST_HEAD(&dev->iamthif_cl.link);
+        mei_io_list_init(&dev->amthif_cmd_list);
+        mei_io_list_init(&dev->amthif_rd_complete_list);
+        bitmap_zero(dev->host_clients_map, MEI_CLIENTS_MAX);
+        dev->open_handle_count = 0;
+        /*
+         * Reserving the first client ID
+         * 0: Reserved for MEI Bus Message communications
+         */
+        bitmap_set(dev->host_clients_map, 0, 1);
+}
+EXPORT_SYMBOL_GPL(mei_device_init);
diff --git a/drivers/misc/mei/interrupt.c b/drivers/misc/mei/interrupt.c
index 7a95c07e59a6..f0fbb5179f80 100644
--- a/drivers/misc/mei/interrupt.c
+++ b/drivers/misc/mei/interrupt.c
@@ -31,7 +31,7 @@
 /**
- * mei_irq_compl_handler - dispatch complete handelers
+ * mei_irq_compl_handler - dispatch complete handlers
 *      for the completed callbacks
 *
 * @dev - mei device
@@ -301,13 +301,11 @@ int mei_irq_read_handler(struct mei_device *dev,
                struct mei_cl_cb *cmpl_list, s32 *slots)
 {
        struct mei_msg_hdr *mei_hdr;
-        struct mei_cl *cl_pos = NULL;
+        struct mei_cl *cl;
-        struct mei_cl *cl_next = NULL;
+        int ret;
-        int ret = 0;
        if (!dev->rd_msg_hdr) {
                dev->rd_msg_hdr = mei_read_hdr(dev);
-                dev_dbg(&dev->pdev->dev, "slots =%08x.\n", *slots);
                (*slots)--;
                dev_dbg(&dev->pdev->dev, "slots =%08x.\n", *slots);
        }
@@ -315,61 +313,67 @@ int mei_irq_read_handler(struct mei_device *dev,
        dev_dbg(&dev->pdev->dev, MEI_HDR_FMT, MEI_HDR_PRM(mei_hdr));
        if (mei_hdr->reserved || !dev->rd_msg_hdr) {
-                dev_dbg(&dev->pdev->dev, "corrupted message header.\n");
+                dev_err(&dev->pdev->dev, "corrupted message header 0x%08X\n",
+                                dev->rd_msg_hdr);
                ret = -EBADMSG;
                goto end;
        }
-        if (mei_hdr->host_addr || mei_hdr->me_addr) {
+        if (mei_slots2data(*slots) < mei_hdr->length) {
-                list_for_each_entry_safe(cl_pos, cl_next,
+                dev_err(&dev->pdev->dev, "less data available than length=%08x.\n",
-                                        &dev->file_list, link) {
-                        dev_dbg(&dev->pdev->dev,
-                                        "list_for_each_entry_safe read host"
-                                        " client = %d, ME client = %d\n",
-                                        cl_pos->host_client_id,
-                                        cl_pos->me_client_id);
-                        if (mei_cl_hbm_equal(cl_pos, mei_hdr))
-                                break;
-                }
-                if (&cl_pos->link == &dev->file_list) {
-                        dev_dbg(&dev->pdev->dev, "corrupted message header\n");
-                        ret = -EBADMSG;
-                        goto end;
-                }
-        }
-        if (((*slots) * sizeof(u32)) < mei_hdr->length) {
-                dev_err(&dev->pdev->dev,
-                                "we can't read the message slots =%08x.\n",
                                *slots);
                /* we can't read the message */
                ret = -ERANGE;
                goto end;
        }
-        /* decide where to read the message too */
+        /*  HBM message */
-        if (!mei_hdr->host_addr) {
+        if (mei_hdr->host_addr == 0 && mei_hdr->me_addr == 0) {
-                dev_dbg(&dev->pdev->dev, "call mei_hbm_dispatch.\n");
+                ret = mei_hbm_dispatch(dev, mei_hdr);
-                mei_hbm_dispatch(dev, mei_hdr);
+                if (ret) {
-                dev_dbg(&dev->pdev->dev, "end mei_hbm_dispatch.\n");
+                        dev_dbg(&dev->pdev->dev, "mei_hbm_dispatch failed ret = %d\n",
-        } else if (mei_hdr->host_addr == dev->iamthif_cl.host_client_id &&
+                                        ret);
-                   (MEI_FILE_CONNECTED == dev->iamthif_cl.state) &&
+                        goto end;
-                   (dev->iamthif_state == MEI_IAMTHIF_READING)) {
+                }
+                goto reset_slots;
+        }
+        /* find recipient cl */
+        list_for_each_entry(cl, &dev->file_list, link) {
+                if (mei_cl_hbm_equal(cl, mei_hdr)) {
+                        cl_dbg(dev, cl, "got a message\n");
+                        break;
+                }
+        }
+        /* if no recipient cl was found we assume corrupted header */
+        if (&cl->link == &dev->file_list) {
+                dev_err(&dev->pdev->dev, "no destination client found 0x%08X\n",
+                                dev->rd_msg_hdr);
+                ret = -EBADMSG;
+                goto end;
+        }
-                dev_dbg(&dev->pdev->dev, "call mei_amthif_irq_read_msg.\n");
+        if (mei_hdr->host_addr == dev->iamthif_cl.host_client_id &&
-                dev_dbg(&dev->pdev->dev, MEI_HDR_FMT, MEI_HDR_PRM(mei_hdr));
+            MEI_FILE_CONNECTED == dev->iamthif_cl.state &&
+            dev->iamthif_state == MEI_IAMTHIF_READING) {
                ret = mei_amthif_irq_read_msg(dev, mei_hdr, cmpl_list);
-                if (ret)
+                if (ret) {
+                        dev_err(&dev->pdev->dev, "mei_amthif_irq_read_msg failed = %d\n",
+                                        ret);
                        goto end;
+                }
        } else {
-                dev_dbg(&dev->pdev->dev, "call mei_cl_irq_read_msg.\n");
-                dev_dbg(&dev->pdev->dev, MEI_HDR_FMT, MEI_HDR_PRM(mei_hdr));
                ret = mei_cl_irq_read_msg(dev, mei_hdr, cmpl_list);
-                if (ret)
+                if (ret) {
+                        dev_err(&dev->pdev->dev, "mei_cl_irq_read_msg failed = %d\n",
+                                        ret);
                        goto end;
+                }
        }
+reset_slots:
        /* reset the number of slots and header */
        *slots = mei_count_full_read_slots(dev);
        dev->rd_msg_hdr = 0;
@@ -533,7 +537,6 @@ EXPORT_SYMBOL_GPL(mei_irq_write_handler);
 *
 * @work: pointer to the work_struct structure
 *
- * NOTE: This function is called by timer interrupt work
 */
 void mei_timer(struct work_struct *work)
 {
@@ -548,24 +551,30 @@ void mei_timer(struct work_struct *work)
        mutex_lock(&dev->device_lock);
-        if (dev->dev_state != MEI_DEV_ENABLED) {
-                if (dev->dev_state == MEI_DEV_INIT_CLIENTS) {
+        /* Catch interrupt stalls during HBM init handshake */
-                        if (dev->init_clients_timer) {
+        if (dev->dev_state == MEI_DEV_INIT_CLIENTS &&
-                                if (--dev->init_clients_timer == 0) {
+            dev->hbm_state != MEI_HBM_IDLE) {
-                                        dev_err(&dev->pdev->dev, "reset: init clients timeout hbm_state = %d.\n",
-                                                dev->hbm_state);
+                if (dev->init_clients_timer) {
-                                        mei_reset(dev, 1);
+                        if (--dev->init_clients_timer == 0) {
-                                }
+                                dev_err(&dev->pdev->dev, "timer: init clients timeout hbm_state = %d.\n",
+                                        dev->hbm_state);
+                                mei_reset(dev);
+                                goto out;
                        }
                }
-                goto out;
        }
+        if (dev->dev_state != MEI_DEV_ENABLED)
+                goto out;
        /*** connect/disconnect timeouts ***/
        list_for_each_entry_safe(cl_pos, cl_next, &dev->file_list, link) {
                if (cl_pos->timer_count) {
                        if (--cl_pos->timer_count == 0) {
-                                dev_err(&dev->pdev->dev, "reset: connect/disconnect timeout.\n");
+                                dev_err(&dev->pdev->dev, "timer: connect/disconnect timeout.\n");
-                                mei_reset(dev, 1);
+                                mei_reset(dev);
                                goto out;
                        }
                }
@@ -573,8 +582,8 @@ void mei_timer(struct work_struct *work)
        if (dev->iamthif_stall_timer) {
                if (--dev->iamthif_stall_timer == 0) {
-                        dev_err(&dev->pdev->dev, "reset: amthif  hanged.\n");
+                        dev_err(&dev->pdev->dev, "timer: amthif  hanged.\n");
-                        mei_reset(dev, 1);
+                        mei_reset(dev);
                        dev->iamthif_msg_buf_size = 0;
                        dev->iamthif_msg_buf_index = 0;
                        dev->iamthif_canceled = false;
@@ -627,7 +636,8 @@ void mei_timer(struct work_struct *work)
                }
        }
 out:
-        schedule_delayed_work(&dev->timer_work, 2 * HZ);
+        if (dev->dev_state != MEI_DEV_DISABLED)
+                schedule_delayed_work(&dev->timer_work, 2 * HZ);
        mutex_unlock(&dev->device_lock);
 }
diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c
index 9661a812f550..5424f8ff3f7f 100644
--- a/drivers/misc/mei/main.c
+++ b/drivers/misc/mei/main.c
@@ -48,7 +48,7 @@
 *
 * @inode: pointer to inode structure
 * @file: pointer to file structure
- e
+ *
 * returns 0 on success, <0 on error
 */
 static int mei_open(struct inode *inode, struct file *file)
diff --git a/drivers/misc/mei/mei_dev.h b/drivers/misc/mei/mei_dev.h
index 406f68e05b4e..f7de95b4cdd9 100644
--- a/drivers/misc/mei/mei_dev.h
+++ b/drivers/misc/mei/mei_dev.h
@@ -61,11 +61,16 @@ extern const uuid_le mei_wd_guid;
 #define MEI_CLIENTS_MAX 256
 /*
+ * maximum number of consecutive resets
+ */
+#define MEI_MAX_CONSEC_RESET  3
+/*
 * Number of File descriptors/handles
 * that can be opened to the driver.
 *
 * Limit to 255: 256 Total Clients
- * minus internal client for MEI Bus Messags
+ * minus internal client for MEI Bus Messages
 */
 #define  MEI_MAX_OPEN_HANDLE_COUNT (MEI_CLIENTS_MAX - 1)
@@ -178,9 +183,10 @@ struct mei_cl_cb {
        unsigned long buf_idx;
        unsigned long read_time;
        struct file *file_object;
+        u32 internal:1;
 };
-/* MEI client instance carried as file->pirvate_data*/
+/* MEI client instance carried as file->private_data*/
 struct mei_cl {
        struct list_head link;
        struct mei_device *dev;
@@ -326,6 +332,7 @@ struct mei_cl_device {
 /**
 * struct mei_device -  MEI private device struct
+ * @reset_count - limits the number of consecutive resets
 * @hbm_state - state of host bus message protocol
 * @mem_addr - mem mapped base register address
@@ -369,6 +376,7 @@ struct mei_device {
        /*
         * mei device  states
         */
+        unsigned long reset_count;
        enum mei_dev_state dev_state;
        enum mei_hbm_state hbm_state;
        u16 init_clients_timer;
@@ -427,6 +435,7 @@ struct mei_device {
        bool iamthif_canceled;
        struct work_struct init_work;
+        struct work_struct reset_work;
        /* List of bus devices */
        struct list_head device_list;
@@ -456,13 +465,25 @@ static inline u32 mei_data2slots(size_t length)
        return DIV_ROUND_UP(sizeof(struct mei_msg_hdr) + length, 4);
 }
+/**
+ * mei_slots2data- get data in slots - bytes from slots
+ * @slots -  number of available slots
+ * returns  - number of bytes in slots
+ */
+static inline u32 mei_slots2data(int slots)
+{
+        return slots * 4;
+}
 /*
 * mei init function prototypes
 */
 void mei_device_init(struct mei_device *dev);
-void mei_reset(struct mei_device *dev, int interrupts);
+int mei_reset(struct mei_device *dev);
 int mei_start(struct mei_device *dev);
+int mei_restart(struct mei_device *dev);
 void mei_stop(struct mei_device *dev);
+void mei_cancel_work(struct mei_device *dev);
 /*
 *  MEI interrupt functions prototype
@@ -510,7 +531,7 @@ int mei_amthif_irq_read(struct mei_device *dev, s32 *slots);
 * NFC functions
 */
 int mei_nfc_host_init(struct mei_device *dev);
-void mei_nfc_host_exit(void);
+void mei_nfc_host_exit(struct mei_device *dev);
 /*
 * NFC Client UUID
@@ -626,9 +647,9 @@ static inline void mei_dbgfs_deregister(struct mei_device *dev) {}
 int mei_register(struct mei_device *dev);
 void mei_deregister(struct mei_device *dev);
-#define MEI_HDR_FMT "hdr:host=%02d me=%02d len=%d comp=%1d"
+#define MEI_HDR_FMT "hdr:host=%02d me=%02d len=%d internal=%1d comp=%1d"
 #define MEI_HDR_PRM(hdr)                  \
        (hdr)->host_addr, (hdr)->me_addr, \
-        (hdr)->length, (hdr)->msg_complete
+        (hdr)->length, (hdr)->internal, (hdr)->msg_complete
 #endif
diff --git a/drivers/misc/mei/nfc.c b/drivers/misc/mei/nfc.c
index 994ca4aff1a3..a58320c0c049 100644
--- a/drivers/misc/mei/nfc.c
+++ b/drivers/misc/mei/nfc.c
@@ -92,7 +92,7 @@ struct mei_nfc_hci_hdr {
 * @cl: NFC host client
 * @cl_info: NFC info host client
 * @init_work: perform connection to the info client
- * @fw_ivn: NFC Intervace Version Number
+ * @fw_ivn: NFC Interface Version Number
 * @vendor_id: NFC manufacturer ID
 * @radio_type: NFC radio type
 */
@@ -163,7 +163,7 @@ static int mei_nfc_build_bus_name(struct mei_nfc_dev *ndev)
                        return 0;
                default:
-                        dev_err(&dev->pdev->dev, "Unknow radio type 0x%x\n",
+                        dev_err(&dev->pdev->dev, "Unknown radio type 0x%x\n",
                                ndev->radio_type);
                        return -EINVAL;
@@ -175,14 +175,14 @@ static int mei_nfc_build_bus_name(struct mei_nfc_dev *ndev)
                        ndev->bus_name = "pn544";
                        return 0;
                default:
-                        dev_err(&dev->pdev->dev, "Unknow radio type 0x%x\n",
+                        dev_err(&dev->pdev->dev, "Unknown radio type 0x%x\n",
                                ndev->radio_type);
                        return -EINVAL;
                }
        default:
-                dev_err(&dev->pdev->dev, "Unknow vendor ID 0x%x\n",
+                dev_err(&dev->pdev->dev, "Unknown vendor ID 0x%x\n",
                        ndev->vendor_id);
                return -EINVAL;
@@ -428,7 +428,7 @@ static void mei_nfc_init(struct work_struct *work)
        mutex_unlock(&dev->device_lock);
        if (mei_nfc_if_version(ndev) < 0) {
-                dev_err(&dev->pdev->dev, "Could not get the NFC interfave version");
+                dev_err(&dev->pdev->dev, "Could not get the NFC interface version");
                goto err;
        }
@@ -469,7 +469,9 @@ static void mei_nfc_init(struct work_struct *work)
        return;
 err:
+        mutex_lock(&dev->device_lock);
        mei_nfc_free(ndev);
+        mutex_unlock(&dev->device_lock);
        return;
 }
@@ -481,7 +483,7 @@ int mei_nfc_host_init(struct mei_device *dev)
        struct mei_cl *cl_info, *cl = NULL;
        int i, ret;
-        /* already initialzed */
+        /* already initialized */
        if (ndev->cl_info)
                return 0;
@@ -547,12 +549,16 @@ err:
        return ret;
 }
-void mei_nfc_host_exit(void)
+void mei_nfc_host_exit(struct mei_device *dev)
 {
        struct mei_nfc_dev *ndev = &nfc_dev;
+        cancel_work_sync(&ndev->init_work);
+        mutex_lock(&dev->device_lock);
        if (ndev->cl && ndev->cl->device)
                mei_cl_remove_device(ndev->cl->device);
        mei_nfc_free(ndev);
+        mutex_unlock(&dev->device_lock);
 }
diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
index 2cab3c0a6805..ddadd08956f4 100644
--- a/drivers/misc/mei/pci-me.c
+++ b/drivers/misc/mei/pci-me.c
@@ -144,6 +144,21 @@ static int mei_me_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
                dev_err(&pdev->dev, "failed to get pci regions.\n");
                goto disable_device;
        }
+        if (dma_set_mask(&pdev->dev, DMA_BIT_MASK(64)) ||
+            dma_set_coherent_mask(&pdev->dev, DMA_BIT_MASK(64))) {
+                err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(32));
+                if (err)
+                        err = dma_set_coherent_mask(&pdev->dev,
+                                                    DMA_BIT_MASK(32));
+        }
+        if (err) {
+                dev_err(&pdev->dev, "No usable DMA configuration, aborting\n");
+                goto release_regions;
+        }
        /* allocates and initializes the mei dev structure */
        dev = mei_me_dev_init(pdev);
        if (!dev) {
@@ -197,8 +212,8 @@ static int mei_me_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        return 0;
 release_irq:
+        mei_cancel_work(dev);
        mei_disable_interrupts(dev);
-        flush_scheduled_work();
        free_irq(pdev->irq, dev);
 disable_msi:
        pci_disable_msi(pdev);
@@ -306,16 +321,14 @@ static int mei_me_pci_resume(struct device *device)
                return err;
        }
-        mutex_lock(&dev->device_lock);
+        err = mei_restart(dev);
-        dev->dev_state = MEI_DEV_POWER_UP;
+        if (err)
-        mei_clear_interrupts(dev);
+                return err;
-        mei_reset(dev, 1);
-        mutex_unlock(&dev->device_lock);
        /* Start timer if stopped in suspend */
        schedule_delayed_work(&dev->timer_work, HZ);
-        return err;
+        return 0;
 }
 static SIMPLE_DEV_PM_OPS(mei_me_pm_ops, mei_me_pci_suspend, mei_me_pci_resume);
 #define MEI_ME_PM_OPS   (&mei_me_pm_ops)
diff --git a/drivers/misc/mei/wd.c b/drivers/misc/mei/wd.c
index 9e354216c163..f70945ed96f6 100644
--- a/drivers/misc/mei/wd.c
+++ b/drivers/misc/mei/wd.c
@@ -115,6 +115,7 @@ int mei_wd_send(struct mei_device *dev)
        hdr.me_addr = dev->wd_cl.me_client_id;
        hdr.msg_complete = 1;
        hdr.reserved = 0;
+        hdr.internal = 0;
        if (!memcmp(dev->wd_data, mei_start_wd_params, MEI_WD_HDR_SIZE))
                hdr.length = MEI_WD_START_MSG_SIZE;
diff --git a/drivers/misc/mic/host/mic_device.h b/drivers/misc/mic/host/mic_device.h
index 538e3d3d3c8c..1a6edce2ecde 100644
--- a/drivers/misc/mic/host/mic_device.h
+++ b/drivers/misc/mic/host/mic_device.h
@@ -134,6 +134,8 @@ struct mic_device {
 * @send_intr: Send an interrupt for a particular doorbell on the card.
 * @ack_interrupt: Hardware specific operations to ack the h/w on
 * receipt of an interrupt.
+ * @intr_workarounds: Hardware specific workarounds needed after
+ * handling an interrupt.
 * @reset: Reset the remote processor.
 * @reset_fw_ready: Reset firmware ready field.
 * @is_fw_ready: Check if firmware is ready for OS download.
@@ -149,6 +151,7 @@ struct mic_hw_ops {
        void (*write_spad)(struct mic_device *mdev, unsigned int idx, u32 val);
        void (*send_intr)(struct mic_device *mdev, int doorbell);
        u32 (*ack_interrupt)(struct mic_device *mdev);
+        void (*intr_workarounds)(struct mic_device *mdev);
        void (*reset)(struct mic_device *mdev);
        void (*reset_fw_ready)(struct mic_device *mdev);
        bool (*is_fw_ready)(struct mic_device *mdev);
diff --git a/drivers/misc/mic/host/mic_main.c b/drivers/misc/mic/host/mic_main.c
index ad838c7651c4..c04a021e20c7 100644
--- a/drivers/misc/mic/host/mic_main.c
+++ b/drivers/misc/mic/host/mic_main.c
@@ -115,7 +115,7 @@ static irqreturn_t mic_shutdown_db(int irq, void *data)
        struct mic_device *mdev = data;
        struct mic_bootparam *bootparam = mdev->dp;
-        mdev->ops->ack_interrupt(mdev);
+        mdev->ops->intr_workarounds(mdev);
        switch (bootparam->shutdown_status) {
        case MIC_HALTED:
diff --git a/drivers/misc/mic/host/mic_virtio.c b/drivers/misc/mic/host/mic_virtio.c
index e04bb4fe6823..752ff873f891 100644
--- a/drivers/misc/mic/host/mic_virtio.c
+++ b/drivers/misc/mic/host/mic_virtio.c
@@ -369,7 +369,7 @@ static irqreturn_t mic_virtio_intr_handler(int irq, void *data)
        struct mic_vdev *mvdev = data;
        struct mic_device *mdev = mvdev->mdev;
-        mdev->ops->ack_interrupt(mdev);
+        mdev->ops->intr_workarounds(mdev);
        schedule_work(&mvdev->virtio_bh_work);
        return IRQ_HANDLED;
 }
diff --git a/drivers/misc/mic/host/mic_x100.c b/drivers/misc/mic/host/mic_x100.c
index 0dfa8a81436e..5562fdd3ef4e 100644
--- a/drivers/misc/mic/host/mic_x100.c
+++ b/drivers/misc/mic/host/mic_x100.c
@@ -174,35 +174,38 @@ static void mic_x100_send_intr(struct mic_device *mdev, int doorbell)
 }
 /**
- * mic_ack_interrupt - Device specific interrupt handling.
+ * mic_x100_ack_interrupt - Read the interrupt sources register and
- * @mdev: pointer to mic_device instance
+ * clear it. This function will be called in the MSI/INTx case.
+ * @mdev: Pointer to mic_device instance.
 *
- * Returns: bitmask of doorbell events triggered.
+ * Returns: bitmask of interrupt sources triggered.
 */
 static u32 mic_x100_ack_interrupt(struct mic_device *mdev)
 {
-        u32 reg = 0;
-        struct mic_mw *mw = &mdev->mmio;
        u32 sicr0 = MIC_X100_SBOX_BASE_ADDRESS + MIC_X100_SBOX_SICR0;
+        u32 reg = mic_mmio_read(&mdev->mmio, sicr0);
+        mic_mmio_write(&mdev->mmio, reg, sicr0);
+        return reg;
+}
+/**
+ * mic_x100_intr_workarounds - These hardware specific workarounds are
+ * to be invoked everytime an interrupt is handled.
+ * @mdev: Pointer to mic_device instance.
+ *
+ * Returns: none
+ */
+static void mic_x100_intr_workarounds(struct mic_device *mdev)
+{
+        struct mic_mw *mw = &mdev->mmio;
        /* Clear pending bit array. */
        if (MIC_A0_STEP == mdev->stepping)
                mic_mmio_write(mw, 1, MIC_X100_SBOX_BASE_ADDRESS +
                        MIC_X100_SBOX_MSIXPBACR);
-        if (mdev->irq_info.num_vectors <= 1) {
-                reg = mic_mmio_read(mw, sicr0);
-                if (unlikely(!reg))
-                        goto done;
-                mic_mmio_write(mw, reg, sicr0);
-        }
        if (mdev->stepping >= MIC_B0_STEP)
                mdev->intr_ops->enable_interrupts(mdev);
-done:
-        return reg;
 }
 /**
@@ -553,6 +556,7 @@ struct mic_hw_ops mic_x100_ops = {
        .write_spad = mic_x100_write_spad,
        .send_intr = mic_x100_send_intr,
        .ack_interrupt = mic_x100_ack_interrupt,
+        .intr_workarounds = mic_x100_intr_workarounds,
        .reset = mic_x100_hw_reset,
        .reset_fw_ready = mic_x100_reset_fw_ready,
        .is_fw_ready = mic_x100_is_fw_ready,
diff --git a/drivers/misc/sgi-xp/xpc_channel.c b/drivers/misc/sgi-xp/xpc_channel.c
index 652593fc486d..128d5615c804 100644
--- a/drivers/misc/sgi-xp/xpc_channel.c
+++ b/drivers/misc/sgi-xp/xpc_channel.c
@@ -828,6 +828,7 @@ enum xp_retval
 xpc_allocate_msg_wait(struct xpc_channel *ch)
 {
        enum xp_retval ret;
+        DEFINE_WAIT(wait);
        if (ch->flags & XPC_C_DISCONNECTING) {
                DBUG_ON(ch->reason == xpInterrupted);
@@ -835,7 +836,9 @@ xpc_allocate_msg_wait(struct xpc_channel *ch)
        }
        atomic_inc(&ch->n_on_msg_allocate_wq);
-        ret = interruptible_sleep_on_timeout(&ch->msg_allocate_wq, 1);
+        prepare_to_wait(&ch->msg_allocate_wq, &wait, TASK_INTERRUPTIBLE);
+        ret = schedule_timeout(1);
+        finish_wait(&ch->msg_allocate_wq, &wait);
        atomic_dec(&ch->n_on_msg_allocate_wq);
        if (ch->flags & XPC_C_DISCONNECTING) {
diff --git a/drivers/misc/ti-st/st_core.c b/drivers/misc/ti-st/st_core.c
index 8d64b681dd93..3aed525e55b4 100644
--- a/drivers/misc/ti-st/st_core.c
+++ b/drivers/misc/ti-st/st_core.c
@@ -812,7 +812,7 @@ static void st_tty_flush_buffer(struct tty_struct *tty)
        kfree_skb(st_gdata->tx_skb);
        st_gdata->tx_skb = NULL;
-        tty->ops->flush_buffer(tty);
+        tty_driver_flush_buffer(tty);
        return;
 }
diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index 96853a09788a..9d3dbb28734b 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -531,7 +531,6 @@ long st_kim_stop(void *kim_data)
                /* Flush any pending characters in the driver and discipline. */
                tty_ldisc_flush(tty);
                tty_driver_flush_buffer(tty);
-                tty->ops->flush_buffer(tty);
        }
        /* send uninstall notification to UIM */
diff --git a/drivers/misc/vmw_vmci/vmci_guest.c b/drivers/misc/vmw_vmci/vmci_guest.c
index c98b03b99353..d35cda06b5e8 100644
--- a/drivers/misc/vmw_vmci/vmci_guest.c
+++ b/drivers/misc/vmw_vmci/vmci_guest.c
@@ -165,7 +165,7 @@ static void vmci_guest_cid_update(u32 sub_id,
 * true if required hypercalls (or fallback hypercalls) are
 * supported by the host, false otherwise.
 */
-static bool vmci_check_host_caps(struct pci_dev *pdev)
+static int vmci_check_host_caps(struct pci_dev *pdev)
 {
        bool result;
        struct vmci_resource_query_msg *msg;
@@ -176,7 +176,7 @@ static bool vmci_check_host_caps(struct pci_dev *pdev)
        check_msg = kmalloc(msg_size, GFP_KERNEL);
        if (!check_msg) {
                dev_err(&pdev->dev, "%s: Insufficient memory\n", __func__);
-                return false;
+                return -ENOMEM;
        }
        check_msg->dst = vmci_make_handle(VMCI_HYPERVISOR_CONTEXT_ID,
@@ -196,7 +196,7 @@ static bool vmci_check_host_caps(struct pci_dev *pdev)
                __func__, result ? "PASSED" : "FAILED");
        /* We need the vector. There are no fallbacks. */
-        return result;
+        return result ? 0 : -ENXIO;
 }
 /*
@@ -564,12 +564,14 @@ static int vmci_guest_probe_device(struct pci_dev *pdev,
                        dev_warn(&pdev->dev,
                                 "VMCI device unable to register notification bitmap with PPN 0x%x\n",
                                 (u32) bitmap_ppn);
+                        error = -ENXIO;
                        goto err_remove_vmci_dev_g;
                }
        }
        /* Check host capabilities. */
-        if (!vmci_check_host_caps(pdev))
+        error = vmci_check_host_caps(pdev);
+        if (error)
                goto err_remove_bitmap;
        /* Enable device. */
diff --git a/drivers/mtd/maps/pxa2xx-flash.c b/drivers/mtd/maps/pxa2xx-flash.c
index d210d131fef2..0f55589a56b8 100644
--- a/drivers/mtd/maps/pxa2xx-flash.c
+++ b/drivers/mtd/maps/pxa2xx-flash.c
@@ -73,7 +73,7 @@ static int pxa2xx_flash_probe(struct platform_device *pdev)
                return -ENOMEM;
        }
        info->map.cached =
-                ioremap_cached(info->map.phys, info->map.size);
+                ioremap_cache(info->map.phys, info->map.size);
        if (!info->map.cached)
                printk(KERN_WARNING "Failed to ioremap cached %s\n",
                       info->map.name);
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 187b1b7772ef..4ced59436558 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -2201,20 +2201,25 @@ void bond_3ad_adapter_speed_changed(struct slave *slave)
        port = &(SLAVE_AD_INFO(slave).port);
-        // if slave is null, the whole port is not initialized
+        /* if slave is null, the whole port is not initialized */
        if (!port->slave) {
                pr_warning("Warning: %s: speed changed for uninitialized port on %s\n",
                           slave->bond->dev->name, slave->dev->name);
                return;
        }
+        __get_state_machine_lock(port);
        port->actor_admin_port_key &= ~AD_SPEED_KEY_BITS;
        port->actor_oper_port_key = port->actor_admin_port_key |=
                (__get_link_speed(port) << 1);
        pr_debug("Port %d changed speed\n", port->actor_port_number);
-        // there is no need to reselect a new aggregator, just signal the
+        /* there is no need to reselect a new aggregator, just signal the
-        // state machines to reinitialize
+         * state machines to reinitialize
+         */
        port->sm_vars |= AD_PORT_BEGIN;
+        __release_state_machine_lock(port);
 }
 /**
@@ -2229,20 +2234,25 @@ void bond_3ad_adapter_duplex_changed(struct slave *slave)
        port = &(SLAVE_AD_INFO(slave).port);
-        // if slave is null, the whole port is not initialized
+        /* if slave is null, the whole port is not initialized */
        if (!port->slave) {
                pr_warning("%s: Warning: duplex changed for uninitialized port on %s\n",
                           slave->bond->dev->name, slave->dev->name);
                return;
        }
+        __get_state_machine_lock(port);
        port->actor_admin_port_key &= ~AD_DUPLEX_KEY_BITS;
        port->actor_oper_port_key = port->actor_admin_port_key |=
                __get_duplex(port);
        pr_debug("Port %d changed duplex\n", port->actor_port_number);
-        // there is no need to reselect a new aggregator, just signal the
+        /* there is no need to reselect a new aggregator, just signal the
-        // state machines to reinitialize
+         * state machines to reinitialize
+         */
        port->sm_vars |= AD_PORT_BEGIN;
+        __release_state_machine_lock(port);
 }
 /**
@@ -2258,15 +2268,21 @@ void bond_3ad_handle_link_change(struct slave *slave, char link)
        port = &(SLAVE_AD_INFO(slave).port);
-        // if slave is null, the whole port is not initialized
+        /* if slave is null, the whole port is not initialized */
        if (!port->slave) {
                pr_warning("Warning: %s: link status changed for uninitialized port on %s\n",
                           slave->bond->dev->name, slave->dev->name);
                return;
        }
-        // on link down we are zeroing duplex and speed since some of the adaptors(ce1000.lan) report full duplex/speed instead of N/A(duplex) / 0(speed)
+        __get_state_machine_lock(port);
-        // on link up we are forcing recheck on the duplex and speed since some of he adaptors(ce1000.lan) report
+        /* on link down we are zeroing duplex and speed since
+         * some of the adaptors(ce1000.lan) report full duplex/speed
+         * instead of N/A(duplex) / 0(speed).
+         *
+         * on link up we are forcing recheck on the duplex and speed since
+         * some of he adaptors(ce1000.lan) report.
+         */
        if (link == BOND_LINK_UP) {
                port->is_enabled = true;
                port->actor_admin_port_key &= ~AD_DUPLEX_KEY_BITS;
@@ -2282,10 +2298,15 @@ void bond_3ad_handle_link_change(struct slave *slave, char link)
                port->actor_oper_port_key = (port->actor_admin_port_key &=
                                             ~AD_SPEED_KEY_BITS);
        }
-        //BOND_PRINT_DBG(("Port %d changed link status to %s", port->actor_port_number, ((link == BOND_LINK_UP)?"UP":"DOWN")));
+        pr_debug("Port %d changed link status to %s",
-        // there is no need to reselect a new aggregator, just signal the
+                port->actor_port_number,
-        // state machines to reinitialize
+                (link == BOND_LINK_UP) ? "UP" : "DOWN");
+        /* there is no need to reselect a new aggregator, just signal the
+         * state machines to reinitialize
+         */
        port->sm_vars |= AD_PORT_BEGIN;
+        __release_state_machine_lock(port);
 }
 /*
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 398e299ee1bd..6191b551a0e8 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1763,7 +1763,7 @@ static int __bond_release_one(struct net_device *bond_dev,
        }
        if (all) {
-                rcu_assign_pointer(bond->curr_active_slave, NULL);
+                RCU_INIT_POINTER(bond->curr_active_slave, NULL);
        } else if (oldcurrent == slave) {
                /*
                 * Note that we hold RTNL over this sequence, so there
@@ -3732,7 +3732,8 @@ static inline int bond_slave_override(struct bonding *bond,
 }
-static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 bond_select_queue(struct net_device *dev, struct sk_buff *skb,
+                             void *accel_priv)
 {
        /*
         * This helper function exists to help dev_pick_tx get the correct
diff --git a/drivers/net/ethernet/8390/hydra.c b/drivers/net/ethernet/8390/hydra.c
index fb3dd4399cf3..f615fdec0f1b 100644
--- a/drivers/net/ethernet/8390/hydra.c
+++ b/drivers/net/ethernet/8390/hydra.c
@@ -113,7 +113,7 @@ static const struct net_device_ops hydra_netdev_ops = {
 static int hydra_init(struct zorro_dev *z)
 {
    struct net_device *dev;
-    unsigned long board = ZTWO_VADDR(z->resource.start);
+    unsigned long board = (unsigned long)ZTWO_VADDR(z->resource.start);
    unsigned long ioaddr = board+HYDRA_NIC_BASE;
    const char name[] = "NE2000";
    int start_page, stop_page;
diff --git a/drivers/net/ethernet/8390/zorro8390.c b/drivers/net/ethernet/8390/zorro8390.c
index 85ec4c2d2645..ae2a12b7db62 100644
--- a/drivers/net/ethernet/8390/zorro8390.c
+++ b/drivers/net/ethernet/8390/zorro8390.c
@@ -287,7 +287,7 @@ static const struct net_device_ops zorro8390_netdev_ops = {
 };
 static int zorro8390_init(struct net_device *dev, unsigned long board,
-                          const char *name, unsigned long ioaddr)
+                          const char *name, void __iomem *ioaddr)
 {
        int i;
        int err;
@@ -354,7 +354,7 @@ static int zorro8390_init(struct net_device *dev, unsigned long board,
        start_page = NESM_START_PG;
        stop_page = NESM_STOP_PG;
-        dev->base_addr = ioaddr;
+        dev->base_addr = (unsigned long)ioaddr;
        dev->irq = IRQ_AMIGA_PORTS;
        /* Install the Interrupt handler */
diff --git a/drivers/net/ethernet/amd/a2065.c b/drivers/net/ethernet/amd/a2065.c
index 0866e7627433..56139184b801 100644
--- a/drivers/net/ethernet/amd/a2065.c
+++ b/drivers/net/ethernet/amd/a2065.c
@@ -57,6 +57,7 @@
 #include <linux/zorro.h>
 #include <linux/bitops.h>
+#include <asm/byteorder.h>
 #include <asm/irq.h>
 #include <asm/amigaints.h>
 #include <asm/amigahw.h>
@@ -678,6 +679,7 @@ static int a2065_init_one(struct zorro_dev *z,
        unsigned long base_addr = board + A2065_LANCE;
        unsigned long mem_start = board + A2065_RAM;
        struct resource *r1, *r2;
+        u32 serial;
        int err;
        r1 = request_mem_region(base_addr, sizeof(struct lance_regs),
@@ -702,6 +704,7 @@ static int a2065_init_one(struct zorro_dev *z,
        r1->name = dev->name;
        r2->name = dev->name;
+        serial = be32_to_cpu(z->rom.er_SerialNumber);
        dev->dev_addr[0] = 0x00;
        if (z->id != ZORRO_PROD_AMERISTAR_A2065) {      /* Commodore */
                dev->dev_addr[1] = 0x80;
@@ -710,11 +713,11 @@ static int a2065_init_one(struct zorro_dev *z,
                dev->dev_addr[1] = 0x00;
                dev->dev_addr[2] = 0x9f;
        }
-        dev->dev_addr[3] = (z->rom.er_SerialNumber >> 16) & 0xff;
+        dev->dev_addr[3] = (serial >> 16) & 0xff;
-        dev->dev_addr[4] = (z->rom.er_SerialNumber >> 8) & 0xff;
+        dev->dev_addr[4] = (serial >> 8) & 0xff;
-        dev->dev_addr[5] = z->rom.er_SerialNumber & 0xff;
+        dev->dev_addr[5] = serial & 0xff;
-        dev->base_addr = ZTWO_VADDR(base_addr);
+        dev->base_addr = (unsigned long)ZTWO_VADDR(base_addr);
-        dev->mem_start = ZTWO_VADDR(mem_start);
+        dev->mem_start = (unsigned long)ZTWO_VADDR(mem_start);
        dev->mem_end = dev->mem_start + A2065_RAM_SIZE;
        priv->ll = (volatile struct lance_regs *)dev->base_addr;
diff --git a/drivers/net/ethernet/amd/ariadne.c b/drivers/net/ethernet/amd/ariadne.c
index c178eb4c8166..b08101b31b8b 100644
--- a/drivers/net/ethernet/amd/ariadne.c
+++ b/drivers/net/ethernet/amd/ariadne.c
@@ -51,6 +51,7 @@
 #include <linux/zorro.h>
 #include <linux/bitops.h>
+#include <asm/byteorder.h>
 #include <asm/amigaints.h>
 #include <asm/amigahw.h>
 #include <asm/irq.h>
@@ -718,6 +719,7 @@ static int ariadne_init_one(struct zorro_dev *z,
        struct resource *r1, *r2;
        struct net_device *dev;
        struct ariadne_private *priv;
+        u32 serial;
        int err;
        r1 = request_mem_region(base_addr, sizeof(struct Am79C960), "Am79C960");
@@ -741,14 +743,15 @@ static int ariadne_init_one(struct zorro_dev *z,
        r1->name = dev->name;
        r2->name = dev->name;
+        serial = be32_to_cpu(z->rom.er_SerialNumber);
        dev->dev_addr[0] = 0x00;
        dev->dev_addr[1] = 0x60;
        dev->dev_addr[2] = 0x30;
-        dev->dev_addr[3] = (z->rom.er_SerialNumber >> 16) & 0xff;
+        dev->dev_addr[3] = (serial >> 16) & 0xff;
-        dev->dev_addr[4] = (z->rom.er_SerialNumber >> 8) & 0xff;
+        dev->dev_addr[4] = (serial >> 8) & 0xff;
-        dev->dev_addr[5] = z->rom.er_SerialNumber & 0xff;
+        dev->dev_addr[5] = serial & 0xff;
-        dev->base_addr = ZTWO_VADDR(base_addr);
+        dev->base_addr = (unsigned long)ZTWO_VADDR(base_addr);
-        dev->mem_start = ZTWO_VADDR(mem_start);
+        dev->mem_start = (unsigned long)ZTWO_VADDR(mem_start);
        dev->mem_end = dev->mem_start + ARIADNE_RAM_SIZE;
        dev->netdev_ops = &ariadne_netdev_ops;
diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c
index b2ffad1304d2..248baf6273fb 100644
--- a/drivers/net/ethernet/arc/emac_main.c
+++ b/drivers/net/ethernet/arc/emac_main.c
@@ -565,6 +565,8 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
        /* Make sure pointer to data buffer is set */
        wmb();
+        skb_tx_timestamp(skb);
        *info = cpu_to_le32(FOR_EMAC | FIRST_OR_LAST_MASK | len);
        /* Increment index to point to the next BD */
@@ -579,8 +581,6 @@ static int arc_emac_tx(struct sk_buff *skb, struct net_device *ndev)
        arc_reg_set(priv, R_STATUS, TXPL_MASK);
-        skb_tx_timestamp(skb);
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index a36a760ada28..29801750f239 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -145,9 +145,11 @@ static void atl1c_reset_pcie(struct atl1c_hw *hw, u32 flag)
         * Mask some pcie error bits
         */
        pos = pci_find_ext_capability(pdev, PCI_EXT_CAP_ID_ERR);
-        pci_read_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, &data);
+        if (pos) {
-        data &= ~(PCI_ERR_UNC_DLP | PCI_ERR_UNC_FCP);
+                pci_read_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, &data);
-        pci_write_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, data);
+                data &= ~(PCI_ERR_UNC_DLP | PCI_ERR_UNC_FCP);
+                pci_write_config_dword(pdev, pos + PCI_ERR_UNCOR_SEVER, data);
+        }
        /* clear error status */
        pcie_capability_write_word(pdev, PCI_EXP_DEVSTA,
                        PCI_EXP_DEVSTA_NFED |
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
index a1f66e2c9a86..ec6119089b82 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
@@ -520,10 +520,12 @@ struct bnx2x_fastpath {
 #define BNX2X_FP_STATE_IDLE                   0
 #define BNX2X_FP_STATE_NAPI             (1 << 0)    /* NAPI owns this FP */
 #define BNX2X_FP_STATE_POLL             (1 << 1)    /* poll owns this FP */
-#define BNX2X_FP_STATE_NAPI_YIELD       (1 << 2)    /* NAPI yielded this FP */
+#define BNX2X_FP_STATE_DISABLED         (1 << 2)
-#define BNX2X_FP_STATE_POLL_YIELD       (1 << 3)    /* poll yielded this FP */
+#define BNX2X_FP_STATE_NAPI_YIELD       (1 << 3)    /* NAPI yielded this FP */
+#define BNX2X_FP_STATE_POLL_YIELD       (1 << 4)    /* poll yielded this FP */
+#define BNX2X_FP_OWNED  (BNX2X_FP_STATE_NAPI | BNX2X_FP_STATE_POLL)
 #define BNX2X_FP_YIELD  (BNX2X_FP_STATE_NAPI_YIELD | BNX2X_FP_STATE_POLL_YIELD)
-#define BNX2X_FP_LOCKED (BNX2X_FP_STATE_NAPI | BNX2X_FP_STATE_POLL)
+#define BNX2X_FP_LOCKED (BNX2X_FP_OWNED | BNX2X_FP_STATE_DISABLED)
 #define BNX2X_FP_USER_PEND (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_POLL_YIELD)
        /* protect state */
        spinlock_t lock;
@@ -613,7 +615,7 @@ static inline bool bnx2x_fp_lock_napi(struct bnx2x_fastpath *fp)
 {
        bool rc = true;
-        spin_lock(&fp->lock);
+        spin_lock_bh(&fp->lock);
        if (fp->state & BNX2X_FP_LOCKED) {
                WARN_ON(fp->state & BNX2X_FP_STATE_NAPI);
                fp->state |= BNX2X_FP_STATE_NAPI_YIELD;
@@ -622,7 +624,7 @@ static inline bool bnx2x_fp_lock_napi(struct bnx2x_fastpath *fp)
                /* we don't care if someone yielded */
                fp->state = BNX2X_FP_STATE_NAPI;
        }
-        spin_unlock(&fp->lock);
+        spin_unlock_bh(&fp->lock);
        return rc;
 }
@@ -631,14 +633,16 @@ static inline bool bnx2x_fp_unlock_napi(struct bnx2x_fastpath *fp)
 {
        bool rc = false;
-        spin_lock(&fp->lock);
+        spin_lock_bh(&fp->lock);
        WARN_ON(fp->state &
                (BNX2X_FP_STATE_POLL | BNX2X_FP_STATE_NAPI_YIELD));
        if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
                rc = true;
-        fp->state = BNX2X_FP_STATE_IDLE;
-        spin_unlock(&fp->lock);
+        /* state ==> idle, unless currently disabled */
+        fp->state &= BNX2X_FP_STATE_DISABLED;
+        spin_unlock_bh(&fp->lock);
        return rc;
 }
@@ -669,7 +673,9 @@ static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
        if (fp->state & BNX2X_FP_STATE_POLL_YIELD)
                rc = true;
-        fp->state = BNX2X_FP_STATE_IDLE;
+        /* state ==> idle, unless currently disabled */
+        fp->state &= BNX2X_FP_STATE_DISABLED;
        spin_unlock_bh(&fp->lock);
        return rc;
 }
@@ -677,9 +683,23 @@ static inline bool bnx2x_fp_unlock_poll(struct bnx2x_fastpath *fp)
 /* true if a socket is polling, even if it did not get the lock */
 static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
 {
-        WARN_ON(!(fp->state & BNX2X_FP_LOCKED));
+        WARN_ON(!(fp->state & BNX2X_FP_OWNED));
        return fp->state & BNX2X_FP_USER_PEND;
 }
+/* false if fp is currently owned */
+static inline bool bnx2x_fp_ll_disable(struct bnx2x_fastpath *fp)
+{
+        int rc = true;
+        spin_lock_bh(&fp->lock);
+        if (fp->state & BNX2X_FP_OWNED)
+                rc = false;
+        fp->state |= BNX2X_FP_STATE_DISABLED;
+        spin_unlock_bh(&fp->lock);
+        return rc;
+}
 #else
 static inline void bnx2x_fp_init_lock(struct bnx2x_fastpath *fp)
 {
@@ -709,6 +729,10 @@ static inline bool bnx2x_fp_ll_polling(struct bnx2x_fastpath *fp)
 {
        return false;
 }
+static inline bool bnx2x_fp_ll_disable(struct bnx2x_fastpath *fp)
+{
+        return true;
+}
 #endif /* CONFIG_NET_RX_BUSY_POLL */
 /* Use 2500 as a mini-jumbo MTU for FCoE */
@@ -1250,7 +1274,10 @@ struct bnx2x_slowpath {
         * Therefore, if they would have been defined in the same union,
         * data can get corrupted.
         */
-        struct afex_vif_list_ramrod_data func_afex_rdata;
+        union {
+                struct afex_vif_list_ramrod_data        viflist_data;
+                struct function_update_data             func_update;
+        } func_afex_rdata;
        /* used by dmae command executer */
        struct dmae_command             dmae[MAX_DMAE_C];
@@ -2499,4 +2526,6 @@ void bnx2x_set_local_cmng(struct bnx2x *bp);
 #define MCPR_SCRATCH_BASE(bp) \
        (CHIP_IS_E1x(bp) ? MCP_REG_MCPR_SCRATCH : MCP_A_REG_MCPR_SCRATCH)
+#define E1H_MAX_MF_SB_COUNT (HC_SB_MAX_SB_E1X/(E1HVN_MAX * PORT_MAX))
 #endif /* bnx2x.h */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index ec96130533cc..bf811565ee24 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -160,6 +160,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
        struct sk_buff *skb = tx_buf->skb;
        u16 bd_idx = TX_BD(tx_buf->first_bd), new_cons;
        int nbd;
+        u16 split_bd_len = 0;
        /* prefetch skb end pointer to speedup dev_kfree_skb() */
        prefetch(&skb->end);
@@ -167,10 +168,7 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
        DP(NETIF_MSG_TX_DONE, "fp[%d]: pkt_idx %d  buff @(%p)->skb %p\n",
           txdata->txq_index, idx, tx_buf, skb);
-        /* unmap first bd */
        tx_start_bd = &txdata->tx_desc_ring[bd_idx].start_bd;
-        dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
-                         BD_UNMAP_LEN(tx_start_bd), DMA_TO_DEVICE);
        nbd = le16_to_cpu(tx_start_bd->nbd) - 1;
 #ifdef BNX2X_STOP_ON_ERROR
@@ -188,12 +186,19 @@ static u16 bnx2x_free_tx_pkt(struct bnx2x *bp, struct bnx2x_fp_txdata *txdata,
        --nbd;
        bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
-        /* ...and the TSO split header bd since they have no mapping */
+        /* TSO headers+data bds share a common mapping. See bnx2x_tx_split() */
        if (tx_buf->flags & BNX2X_TSO_SPLIT_BD) {
+                tx_data_bd = &txdata->tx_desc_ring[bd_idx].reg_bd;
+                split_bd_len = BD_UNMAP_LEN(tx_data_bd);
                --nbd;
                bd_idx = TX_BD(NEXT_TX_IDX(bd_idx));
        }
+        /* unmap first bd */
+        dma_unmap_single(&bp->pdev->dev, BD_UNMAP_ADDR(tx_start_bd),
+                         BD_UNMAP_LEN(tx_start_bd) + split_bd_len,
+                         DMA_TO_DEVICE);
        /* now free frags */
        while (nbd > 0) {
@@ -1790,26 +1795,22 @@ static void bnx2x_napi_disable_cnic(struct bnx2x *bp)
 {
        int i;
-        local_bh_disable();
        for_each_rx_queue_cnic(bp, i) {
                napi_disable(&bnx2x_fp(bp, i, napi));
-                while (!bnx2x_fp_lock_napi(&bp->fp[i]))
+                while (!bnx2x_fp_ll_disable(&bp->fp[i]))
-                        mdelay(1);
+                        usleep_range(1000, 2000);
        }
-        local_bh_enable();
 }
 static void bnx2x_napi_disable(struct bnx2x *bp)
 {
        int i;
-        local_bh_disable();
        for_each_eth_queue(bp, i) {
                napi_disable(&bnx2x_fp(bp, i, napi));
-                while (!bnx2x_fp_lock_napi(&bp->fp[i]))
+                while (!bnx2x_fp_ll_disable(&bp->fp[i]))
-                        mdelay(1);
+                        usleep_range(1000, 2000);
        }
-        local_bh_enable();
 }
 void bnx2x_netif_start(struct bnx2x *bp)
@@ -1832,7 +1833,8 @@ void bnx2x_netif_stop(struct bnx2x *bp, int disable_hw)
                bnx2x_napi_disable_cnic(bp);
 }
-u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb)
+u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
+                       void *accel_priv)
 {
        struct bnx2x *bp = netdev_priv(dev);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
index da8fcaa74495..41f3ca5ad972 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.h
@@ -524,7 +524,8 @@ int bnx2x_set_vf_mac(struct net_device *dev, int queue, u8 *mac);
 int bnx2x_set_vf_vlan(struct net_device *netdev, int vf, u16 vlan, u8 qos);
 /* select_queue callback */
-u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb);
+u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb,
+                       void *accel_priv);
 static inline void bnx2x_update_rx_prod(struct bnx2x *bp,
                                        struct bnx2x_fastpath *fp,
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
index 20dcc02431ca..11fc79585491 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
@@ -3865,6 +3865,19 @@ static void bnx2x_warpcore_enable_AN_KR(struct bnx2x_phy *phy,
                bnx2x_warpcore_enable_AN_KR2(phy, params, vars);
        } else {
+                /* Enable Auto-Detect to support 1G over CL37 as well */
+                bnx2x_cl45_write(bp, phy, MDIO_WC_DEVAD,
+                                 MDIO_WC_REG_SERDESDIGITAL_CONTROL1000X1, 0x10);
+                /* Force cl48 sync_status LOW to avoid getting stuck in CL73
+                 * parallel-detect loop when CL73 and CL37 are enabled.
+                 */
+                CL22_WR_OVER_CL45(bp, phy, MDIO_REG_BANK_AER_BLOCK,
+                                  MDIO_AER_BLOCK_AER_REG, 0);
+                bnx2x_cl45_write(bp, phy, MDIO_WC_DEVAD,
+                                 MDIO_WC_REG_RXB_ANA_RX_CONTROL_PCI, 0x0800);
+                bnx2x_set_aer_mmd(params, phy);
                bnx2x_disable_kr2(params, vars, phy);
        }
@@ -8120,17 +8133,20 @@ static int bnx2x_get_edc_mode(struct bnx2x_phy *phy,
                                *edc_mode = EDC_MODE_ACTIVE_DAC;
                        else
                                check_limiting_mode = 1;
-                } else if (copper_module_type &
+                } else {
-                        SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_PASSIVE) {
+                        *edc_mode = EDC_MODE_PASSIVE_DAC;
+                        /* Even in case PASSIVE_DAC indication is not set,
+                         * treat it as a passive DAC cable, since some cables
+                         * don't have this indication.
+                         */
+                        if (copper_module_type &
+                            SFP_EEPROM_FC_TX_TECH_BITMASK_COPPER_PASSIVE) {
                                DP(NETIF_MSG_LINK,
                                   "Passive Copper cable detected\n");
-                                *edc_mode =
+                        } else {
-                                      EDC_MODE_PASSIVE_DAC;
+                                DP(NETIF_MSG_LINK,
-                } else {
+                                   "Unknown copper-cable-type\n");
-                        DP(NETIF_MSG_LINK,
+                        }
-                           "Unknown copper-cable-type 0x%x !!!\n",
-                           copper_module_type);
-                        return -EINVAL;
                }
                break;
        }
@@ -10825,9 +10841,9 @@ static int bnx2x_54618se_config_init(struct bnx2x_phy *phy,
                           (1<<11));
        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
-                        (phy->speed_cap_mask &
+             (phy->speed_cap_mask &
-                        PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)) ||
+              PORT_HW_CFG_SPEED_CAPABILITY_D0_1G)) ||
-                        (phy->req_line_speed == SPEED_1000)) {
+            (phy->req_line_speed == SPEED_1000)) {
                an_1000_val |= (1<<8);
                autoneg_val |= (1<<9 | 1<<12);
                if (phy->req_duplex == DUPLEX_FULL)
@@ -10843,30 +10859,32 @@ static int bnx2x_54618se_config_init(struct bnx2x_phy *phy,
                        0x09,
                        &an_1000_val);
-        /* Set 100 speed advertisement */
+        /* Advertise 10/100 link speed */
-        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
+        if (phy->req_line_speed == SPEED_AUTO_NEG) {
-                        (phy->speed_cap_mask &
+                if (phy->speed_cap_mask &
-                        (PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL |
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF) {
-                        PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF)))) {
+                        an_10_100_val |= (1<<5);
-                an_10_100_val |= (1<<7);
+                        autoneg_val |= (1<<9 | 1<<12);
-                /* Enable autoneg and restart autoneg for legacy speeds */
+                        DP(NETIF_MSG_LINK, "Advertising 10M-HD\n");
-                autoneg_val |= (1<<9 | 1<<12);
+                }
+                if (phy->speed_cap_mask &
-                if (phy->req_duplex == DUPLEX_FULL)
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL) {
-                        an_10_100_val |= (1<<8);
-                DP(NETIF_MSG_LINK, "Advertising 100M\n");
-        }
-        /* Set 10 speed advertisement */
-        if (((phy->req_line_speed == SPEED_AUTO_NEG) &&
-                        (phy->speed_cap_mask &
-                        (PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_FULL |
-                        PORT_HW_CFG_SPEED_CAPABILITY_D0_10M_HALF)))) {
-                an_10_100_val |= (1<<5);
-                autoneg_val |= (1<<9 | 1<<12);
-                if (phy->req_duplex == DUPLEX_FULL)
                        an_10_100_val |= (1<<6);
-                DP(NETIF_MSG_LINK, "Advertising 10M\n");
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 10M-FD\n");
+                }
+                if (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_HALF) {
+                        an_10_100_val |= (1<<7);
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 100M-HD\n");
+                }
+                if (phy->speed_cap_mask &
+                    PORT_HW_CFG_SPEED_CAPABILITY_D0_100M_FULL) {
+                        an_10_100_val |= (1<<8);
+                        autoneg_val |= (1<<9 | 1<<12);
+                        DP(NETIF_MSG_LINK, "Advertising 100M-FD\n");
+                }
        }
        /* Only 10/100 are allowed to work in FORCE mode */
@@ -13342,6 +13360,10 @@ static u8 bnx2x_analyze_link_error(struct link_params *params,
        DP(NETIF_MSG_LINK, "Link changed:[%x %x]->%x\n", vars->link_up,
           old_status, status);
+        /* Do not touch the link in case physical link down */
+        if ((vars->phy_flags & PHY_PHYSICAL_LINK_FLAG) == 0)
+                return 1;
        /* a. Update shmem->link_status accordingly
         * b. Update link_vars->link_up
         */
@@ -13550,7 +13572,7 @@ static void bnx2x_check_kr2_wa(struct link_params *params,
         */
        not_kr2_device = (((base_page & 0x8000) == 0) ||
                          (((base_page & 0x8000) &&
-                            ((next_page & 0xe0) == 0x2))));
+                            ((next_page & 0xe0) == 0x20))));
        /* In case KR2 is already disabled, check if we need to re-enable it */
        if (!(vars->link_attr_sync & LINK_ATTR_SYNC_KR2_ENABLE)) {
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 814d0eca9b33..0067b975873f 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -11447,9 +11447,9 @@ static int bnx2x_get_hwinfo(struct bnx2x *bp)
                }
        }
-        /* adjust igu_sb_cnt to MF for E1x */
+        /* adjust igu_sb_cnt to MF for E1H */
-        if (CHIP_IS_E1x(bp) && IS_MF(bp))
+        if (CHIP_IS_E1H(bp) && IS_MF(bp))
-                bp->igu_sb_cnt /= E1HVN_MAX;
+                bp->igu_sb_cnt = min_t(u8, bp->igu_sb_cnt, E1H_MAX_MF_SB_COUNT);
        /* port info */
        bnx2x_get_port_hwinfo(bp);
@@ -12942,25 +12942,26 @@ static void __bnx2x_remove(struct pci_dev *pdev,
                pci_set_power_state(pdev, PCI_D3hot);
        }
-        if (bp->regview)
+        if (remove_netdev) {
-                iounmap(bp->regview);
+                if (bp->regview)
+                        iounmap(bp->regview);
-        /* for vf doorbells are part of the regview and were unmapped along with
+                /* For vfs, doorbells are part of the regview and were unmapped
-         * it. FW is only loaded by PF.
+                 * along with it. FW is only loaded by PF.
-         */
+                 */
-        if (IS_PF(bp)) {
+                if (IS_PF(bp)) {
-                if (bp->doorbells)
+                        if (bp->doorbells)
-                        iounmap(bp->doorbells);
+                                iounmap(bp->doorbells);
-                bnx2x_release_firmware(bp);
+                        bnx2x_release_firmware(bp);
-        }
+                }
-        bnx2x_free_mem_bp(bp);
+                bnx2x_free_mem_bp(bp);
-        if (remove_netdev)
                free_netdev(dev);
-        if (atomic_read(&pdev->enable_cnt) == 1)
+                if (atomic_read(&pdev->enable_cnt) == 1)
-                pci_release_regions(pdev);
+                        pci_release_regions(pdev);
+        }
        pci_disable_device(pdev);
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
index 3efbb35267c8..14ffb6e56e59 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_reg.h
@@ -7179,6 +7179,7 @@ Theotherbitsarereservedandshouldbezero*/
 #define MDIO_WC_REG_RX1_PCI_CTRL                        0x80ca
 #define MDIO_WC_REG_RX2_PCI_CTRL                        0x80da
 #define MDIO_WC_REG_RX3_PCI_CTRL                        0x80ea
+#define MDIO_WC_REG_RXB_ANA_RX_CONTROL_PCI              0x80fa
 #define MDIO_WC_REG_XGXSBLK2_UNICORE_MODE_10G           0x8104
 #define MDIO_WC_REG_XGXS_STATUS3                        0x8129
 #define MDIO_WC_REG_PAR_DET_10G_STATUS                  0x8130
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
index 32c92abf5094..18438a504d57 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
@@ -2038,6 +2038,7 @@ static int bnx2x_vlan_mac_del_all(struct bnx2x *bp,
        struct bnx2x_vlan_mac_ramrod_params p;
        struct bnx2x_exe_queue_obj *exeq = &o->exe_queue;
        struct bnx2x_exeq_elem *exeq_pos, *exeq_pos_n;
+        unsigned long flags;
        int read_lock;
        int rc = 0;
@@ -2046,8 +2047,9 @@ static int bnx2x_vlan_mac_del_all(struct bnx2x *bp,
        spin_lock_bh(&exeq->lock);
        list_for_each_entry_safe(exeq_pos, exeq_pos_n, &exeq->exe_queue, link) {
-                if (exeq_pos->cmd_data.vlan_mac.vlan_mac_flags ==
+                flags = exeq_pos->cmd_data.vlan_mac.vlan_mac_flags;
-                    *vlan_mac_flags) {
+                if (BNX2X_VLAN_MAC_CMP_FLAGS(flags) ==
+                    BNX2X_VLAN_MAC_CMP_FLAGS(*vlan_mac_flags)) {
                        rc = exeq->remove(bp, exeq->owner, exeq_pos);
                        if (rc) {
                                BNX2X_ERR("Failed to remove command\n");
@@ -2080,7 +2082,9 @@ static int bnx2x_vlan_mac_del_all(struct bnx2x *bp,
                return read_lock;
        list_for_each_entry(pos, &o->head, link) {
-                if (pos->vlan_mac_flags == *vlan_mac_flags) {
+                flags = pos->vlan_mac_flags;
+                if (BNX2X_VLAN_MAC_CMP_FLAGS(flags) ==
+                    BNX2X_VLAN_MAC_CMP_FLAGS(*vlan_mac_flags)) {
                        p.user_req.vlan_mac_flags = pos->vlan_mac_flags;
                        memcpy(&p.user_req.u, &pos->u, sizeof(pos->u));
                        rc = bnx2x_config_vlan_mac(bp, &p);
@@ -4382,8 +4386,11 @@ int bnx2x_config_rss(struct bnx2x *bp,
        struct bnx2x_raw_obj *r = &o->raw;
        /* Do nothing if only driver cleanup was requested */
-        if (test_bit(RAMROD_DRV_CLR_ONLY, &p->ramrod_flags))
+        if (test_bit(RAMROD_DRV_CLR_ONLY, &p->ramrod_flags)) {
+                DP(BNX2X_MSG_SP, "Not configuring RSS ramrod_flags=%lx\n",
+                   p->ramrod_flags);
                return 0;
+        }
        r->set_pending(r);
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
index 658f4e33abf9..6a53c15c85a3 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.h
@@ -266,6 +266,13 @@ enum {
        BNX2X_DONT_CONSUME_CAM_CREDIT,
        BNX2X_DONT_CONSUME_CAM_CREDIT_DEST,
 };
+/* When looking for matching filters, some flags are not interesting */
+#define BNX2X_VLAN_MAC_CMP_MASK (1 << BNX2X_UC_LIST_MAC | \
+                                 1 << BNX2X_ETH_MAC | \
+                                 1 << BNX2X_ISCSI_ETH_MAC | \
+                                 1 << BNX2X_NETQ_ETH_MAC)
+#define BNX2X_VLAN_MAC_CMP_FLAGS(flags) \
+        ((flags) & BNX2X_VLAN_MAC_CMP_MASK)
 struct bnx2x_vlan_mac_ramrod_params {
        /* Object to run the command from */
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
index 2e46c28fc601..e7845e5be1c7 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c
@@ -1209,6 +1209,11 @@ static void bnx2x_vfop_rxmode(struct bnx2x *bp, struct bnx2x_virtf *vf)
                /* next state */
                vfop->state = BNX2X_VFOP_RXMODE_DONE;
+                /* record the accept flags in vfdb so hypervisor can modify them
+                 * if necessary
+                 */
+                bnx2x_vfq(vf, ramrod->cl_id - vf->igu_base_id, accept_flags) =
+                        ramrod->rx_accept_flags;
                vfop->rc = bnx2x_config_rx_mode(bp, ramrod);
                bnx2x_vfop_finalize(vf, vfop->rc, VFOP_DONE);
 op_err:
@@ -1224,39 +1229,43 @@ op_pending:
        return;
 }
+static void bnx2x_vf_prep_rx_mode(struct bnx2x *bp, u8 qid,
+                                  struct bnx2x_rx_mode_ramrod_params *ramrod,
+                                  struct bnx2x_virtf *vf,
+                                  unsigned long accept_flags)
+{
+        struct bnx2x_vf_queue *vfq = vfq_get(vf, qid);
+        memset(ramrod, 0, sizeof(*ramrod));
+        ramrod->cid = vfq->cid;
+        ramrod->cl_id = vfq_cl_id(vf, vfq);
+        ramrod->rx_mode_obj = &bp->rx_mode_obj;
+        ramrod->func_id = FW_VF_HANDLE(vf->abs_vfid);
+        ramrod->rx_accept_flags = accept_flags;
+        ramrod->tx_accept_flags = accept_flags;
+        ramrod->pstate = &vf->filter_state;
+        ramrod->state = BNX2X_FILTER_RX_MODE_PENDING;
+        set_bit(BNX2X_FILTER_RX_MODE_PENDING, &vf->filter_state);
+        set_bit(RAMROD_RX, &ramrod->ramrod_flags);
+        set_bit(RAMROD_TX, &ramrod->ramrod_flags);
+        ramrod->rdata = bnx2x_vf_sp(bp, vf, rx_mode_rdata.e2);
+        ramrod->rdata_mapping = bnx2x_vf_sp_map(bp, vf, rx_mode_rdata.e2);
+}
 int bnx2x_vfop_rxmode_cmd(struct bnx2x *bp,
                          struct bnx2x_virtf *vf,
                          struct bnx2x_vfop_cmd *cmd,
                          int qid, unsigned long accept_flags)
 {
-        struct bnx2x_vf_queue *vfq = vfq_get(vf, qid);
        struct bnx2x_vfop *vfop = bnx2x_vfop_add(bp, vf);
        if (vfop) {
                struct bnx2x_rx_mode_ramrod_params *ramrod =
                        &vf->op_params.rx_mode;
-                memset(ramrod, 0, sizeof(*ramrod));
+                bnx2x_vf_prep_rx_mode(bp, qid, ramrod, vf, accept_flags);
-                /* Prepare ramrod parameters */
-                ramrod->cid = vfq->cid;
-                ramrod->cl_id = vfq_cl_id(vf, vfq);
-                ramrod->rx_mode_obj = &bp->rx_mode_obj;
-                ramrod->func_id = FW_VF_HANDLE(vf->abs_vfid);
-                ramrod->rx_accept_flags = accept_flags;
-                ramrod->tx_accept_flags = accept_flags;
-                ramrod->pstate = &vf->filter_state;
-                ramrod->state = BNX2X_FILTER_RX_MODE_PENDING;
-                set_bit(BNX2X_FILTER_RX_MODE_PENDING, &vf->filter_state);
-                set_bit(RAMROD_RX, &ramrod->ramrod_flags);
-                set_bit(RAMROD_TX, &ramrod->ramrod_flags);
-                ramrod->rdata =
-                        bnx2x_vf_sp(bp, vf, rx_mode_rdata.e2);
-                ramrod->rdata_mapping =
-                        bnx2x_vf_sp_map(bp, vf, rx_mode_rdata.e2);
                bnx2x_vfop_opset(BNX2X_VFOP_RXMODE_CONFIG,
                                 bnx2x_vfop_rxmode, cmd->done);
@@ -3202,13 +3211,16 @@ int bnx2x_enable_sriov(struct bnx2x *bp)
                bnx2x_iov_static_resc(bp, vf);
        }
-        /* prepare msix vectors in VF configuration space */
+        /* prepare msix vectors in VF configuration space - the value in the
+         * PCI configuration space should be the index of the last entry,
+         * namely one less than the actual size of the table
+         */
        for (vf_idx = first_vf; vf_idx < first_vf + req_vfs; vf_idx++) {
                bnx2x_pretend_func(bp, HW_VF_HANDLE(bp, vf_idx));
                REG_WR(bp, PCICFG_OFFSET + GRC_CONFIG_REG_VF_MSIX_CONTROL,
-                       num_vf_queues);
+                       num_vf_queues - 1);
                DP(BNX2X_MSG_IOV, "set msix vec num in VF %d cfg space to %d\n",
-                   vf_idx, num_vf_queues);
+                   vf_idx, num_vf_queues - 1);
        }
        bnx2x_pretend_func(bp, BP_ABS_FUNC(bp));
@@ -3436,10 +3448,18 @@ out:
 int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
 {
+        struct bnx2x_queue_state_params q_params = {NULL};
+        struct bnx2x_vlan_mac_ramrod_params ramrod_param;
+        struct bnx2x_queue_update_params *update_params;
+        struct pf_vf_bulletin_content *bulletin = NULL;
+        struct bnx2x_rx_mode_ramrod_params rx_ramrod;
        struct bnx2x *bp = netdev_priv(dev);
-        int rc, q_logical_state;
+        struct bnx2x_vlan_mac_obj *vlan_obj;
+        unsigned long vlan_mac_flags = 0;
+        unsigned long ramrod_flags = 0;
        struct bnx2x_virtf *vf = NULL;
-        struct pf_vf_bulletin_content *bulletin = NULL;
+        unsigned long accept_flags;
+        int rc;
        /* sanity and init */
        rc = bnx2x_vf_ndo_prep(bp, vfidx, &vf, &bulletin);
@@ -3457,104 +3477,118 @@ int bnx2x_set_vf_vlan(struct net_device *dev, int vfidx, u16 vlan, u8 qos)
        /* update PF's copy of the VF's bulletin. No point in posting the vlan
         * to the VF since it doesn't have anything to do with it. But it useful
         * to store it here in case the VF is not up yet and we can only
-         * configure the vlan later when it does.
+         * configure the vlan later when it does. Treat vlan id 0 as remove the
+         * Host tag.
         */
-        bulletin->valid_bitmap |= 1 << VLAN_VALID;
+        if (vlan > 0)
+                bulletin->valid_bitmap |= 1 << VLAN_VALID;
+        else
+                bulletin->valid_bitmap &= ~(1 << VLAN_VALID);
        bulletin->vlan = vlan;
        /* is vf initialized and queue set up? */
-        q_logical_state =
+        if (vf->state != VF_ENABLED ||
-                bnx2x_get_q_logical_state(bp, &bnx2x_leading_vfq(vf, sp_obj));
+            bnx2x_get_q_logical_state(bp, &bnx2x_leading_vfq(vf, sp_obj)) !=
-        if (vf->state == VF_ENABLED &&
+            BNX2X_Q_LOGICAL_STATE_ACTIVE)
-            q_logical_state == BNX2X_Q_LOGICAL_STATE_ACTIVE) {
+                return rc;
-                /* configure the vlan in device on this vf's queue */
-                unsigned long ramrod_flags = 0;
-                unsigned long vlan_mac_flags = 0;
-                struct bnx2x_vlan_mac_obj *vlan_obj =
-                        &bnx2x_leading_vfq(vf, vlan_obj);
-                struct bnx2x_vlan_mac_ramrod_params ramrod_param;
-                struct bnx2x_queue_state_params q_params = {NULL};
-                struct bnx2x_queue_update_params *update_params;
-                rc = validate_vlan_mac(bp, &bnx2x_leading_vfq(vf, mac_obj));
+        /* configure the vlan in device on this vf's queue */
-                if (rc)
+        vlan_obj = &bnx2x_leading_vfq(vf, vlan_obj);
-                        return rc;
+        rc = validate_vlan_mac(bp, &bnx2x_leading_vfq(vf, mac_obj));
-                memset(&ramrod_param, 0, sizeof(ramrod_param));
+        if (rc)
+                return rc;
-                /* must lock vfpf channel to protect against vf flows */
+        /* must lock vfpf channel to protect against vf flows */
-                bnx2x_lock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
+        bnx2x_lock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
-                /* remove existing vlans */
+        /* remove existing vlans */
-                __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
+        __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
-                rc = vlan_obj->delete_all(bp, vlan_obj, &vlan_mac_flags,
+        rc = vlan_obj->delete_all(bp, vlan_obj, &vlan_mac_flags,
-                                          &ramrod_flags);
+                                  &ramrod_flags);
-                if (rc) {
+        if (rc) {
-                        BNX2X_ERR("failed to delete vlans\n");
+                BNX2X_ERR("failed to delete vlans\n");
-                        rc = -EINVAL;
+                rc = -EINVAL;
-                        goto out;
+                goto out;
-                }
+        }
+        /* need to remove/add the VF's accept_any_vlan bit */
+        accept_flags = bnx2x_leading_vfq(vf, accept_flags);
+        if (vlan)
+                clear_bit(BNX2X_ACCEPT_ANY_VLAN, &accept_flags);
+        else
+                set_bit(BNX2X_ACCEPT_ANY_VLAN, &accept_flags);
+        bnx2x_vf_prep_rx_mode(bp, LEADING_IDX, &rx_ramrod, vf,
+                              accept_flags);
+        bnx2x_leading_vfq(vf, accept_flags) = accept_flags;
+        bnx2x_config_rx_mode(bp, &rx_ramrod);
+        /* configure the new vlan to device */
+        memset(&ramrod_param, 0, sizeof(ramrod_param));
+        __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
+        ramrod_param.vlan_mac_obj = vlan_obj;
+        ramrod_param.ramrod_flags = ramrod_flags;
+        set_bit(BNX2X_DONT_CONSUME_CAM_CREDIT,
+                &ramrod_param.user_req.vlan_mac_flags);
+        ramrod_param.user_req.u.vlan.vlan = vlan;
+        ramrod_param.user_req.cmd = BNX2X_VLAN_MAC_ADD;
+        rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
+        if (rc) {
+                BNX2X_ERR("failed to configure vlan\n");
+                rc =  -EINVAL;
+                goto out;
+        }
-                /* send queue update ramrod to configure default vlan and silent
+        /* send queue update ramrod to configure default vlan and silent
-                 * vlan removal
+         * vlan removal
+         */
+        __set_bit(RAMROD_COMP_WAIT, &q_params.ramrod_flags);
+        q_params.cmd = BNX2X_Q_CMD_UPDATE;
+        q_params.q_obj = &bnx2x_leading_vfq(vf, sp_obj);
+        update_params = &q_params.params.update;
+        __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN_CHNG,
+                  &update_params->update_flags);
+        __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM_CHNG,
+                  &update_params->update_flags);
+        if (vlan == 0) {
+                /* if vlan is 0 then we want to leave the VF traffic
+                 * untagged, and leave the incoming traffic untouched
+                 * (i.e. do not remove any vlan tags).
                 */
-                __set_bit(RAMROD_COMP_WAIT, &q_params.ramrod_flags);
+                __clear_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
-                q_params.cmd = BNX2X_Q_CMD_UPDATE;
+                            &update_params->update_flags);
-                q_params.q_obj = &bnx2x_leading_vfq(vf, sp_obj);
+                __clear_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
-                update_params = &q_params.params.update;
+                            &update_params->update_flags);
-                __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN_CHNG,
+        } else {
+                /* configure default vlan to vf queue and set silent
+                 * vlan removal (the vf remains unaware of this vlan).
+                 */
+                __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
                          &update_params->update_flags);
-                __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM_CHNG,
+                __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
                          &update_params->update_flags);
+                update_params->def_vlan = vlan;
+                update_params->silent_removal_value =
+                        vlan & VLAN_VID_MASK;
+                update_params->silent_removal_mask = VLAN_VID_MASK;
+        }
-                if (vlan == 0) {
+        /* Update the Queue state */
-                        /* if vlan is 0 then we want to leave the VF traffic
+        rc = bnx2x_queue_state_change(bp, &q_params);
-                         * untagged, and leave the incoming traffic untouched
+        if (rc) {
-                         * (i.e. do not remove any vlan tags).
+                BNX2X_ERR("Failed to configure default VLAN\n");
-                         */
+                goto out;
-                        __clear_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
+        }
-                                    &update_params->update_flags);
-                        __clear_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
-                                    &update_params->update_flags);
-                } else {
-                        /* configure the new vlan to device */
-                        __set_bit(RAMROD_COMP_WAIT, &ramrod_flags);
-                        ramrod_param.vlan_mac_obj = vlan_obj;
-                        ramrod_param.ramrod_flags = ramrod_flags;
-                        ramrod_param.user_req.u.vlan.vlan = vlan;
-                        ramrod_param.user_req.cmd = BNX2X_VLAN_MAC_ADD;
-                        rc = bnx2x_config_vlan_mac(bp, &ramrod_param);
-                        if (rc) {
-                                BNX2X_ERR("failed to configure vlan\n");
-                                rc =  -EINVAL;
-                                goto out;
-                        }
-                        /* configure default vlan to vf queue and set silent
-                         * vlan removal (the vf remains unaware of this vlan).
-                         */
-                        update_params = &q_params.params.update;
-                        __set_bit(BNX2X_Q_UPDATE_DEF_VLAN_EN,
-                                  &update_params->update_flags);
-                        __set_bit(BNX2X_Q_UPDATE_SILENT_VLAN_REM,
-                                  &update_params->update_flags);
-                        update_params->def_vlan = vlan;
-                }
-                /* Update the Queue state */
-                rc = bnx2x_queue_state_change(bp, &q_params);
-                if (rc) {
-                        BNX2X_ERR("Failed to configure default VLAN\n");
-                        goto out;
-                }
-                /* clear the flag indicating that this VF needs its vlan
+        /* clear the flag indicating that this VF needs its vlan
-                 * (will only be set if the HV configured the Vlan before vf was
+         * (will only be set if the HV configured the Vlan before vf was
-                 * up and we were called because the VF came up later
+         * up and we were called because the VF came up later
-                 */
+         */
 out:
-                vf->cfg_flags &= ~VF_CFG_VLAN;
+        vf->cfg_flags &= ~VF_CFG_VLAN;
-                bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
+        bnx2x_unlock_vf_pf_channel(bp, vf, CHANNEL_TLV_PF_SET_VLAN);
-        }
        return rc;
 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
index 1ff6a9366629..8c213fa52174 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h
@@ -74,6 +74,7 @@ struct bnx2x_vf_queue {
        /* VLANs object */
        struct bnx2x_vlan_mac_obj       vlan_obj;
        atomic_t vlan_count;            /* 0 means vlan-0 is set  ~ untagged */
+        unsigned long accept_flags;     /* last accept flags configured */
        /* Queue Slow-path State object */
        struct bnx2x_queue_sp_obj       sp_obj;
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
index efa8a151d789..0756d7dabdd5 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c
@@ -208,7 +208,7 @@ static int bnx2x_get_vf_id(struct bnx2x *bp, u32 *vf_id)
                return -EINVAL;
        }
-        BNX2X_ERR("valid ME register value: 0x%08x\n", me_reg);
+        DP(BNX2X_MSG_IOV, "valid ME register value: 0x%08x\n", me_reg);
        *vf_id = (me_reg & ME_REG_VF_NUM_MASK) >> ME_REG_VF_NUM_SHIFT;
@@ -1598,6 +1598,8 @@ static void bnx2x_vfop_mbx_qfilters(struct bnx2x *bp, struct bnx2x_virtf *vf)
                if (msg->flags & VFPF_SET_Q_FILTERS_RX_MASK_CHANGED) {
                        unsigned long accept = 0;
+                        struct pf_vf_bulletin_content *bulletin =
+                                BP_VF_BULLETIN(bp, vf->index);
                        /* covert VF-PF if mask to bnx2x accept flags */
                        if (msg->rx_mask & VFPF_RX_MASK_ACCEPT_MATCHED_UNICAST)
@@ -1617,9 +1619,11 @@ static void bnx2x_vfop_mbx_qfilters(struct bnx2x *bp, struct bnx2x_virtf *vf)
                                __set_bit(BNX2X_ACCEPT_BROADCAST, &accept);
                        /* A packet arriving the vf's mac should be accepted
-                         * with any vlan
+                         * with any vlan, unless a vlan has already been
+                         * configured.
                         */
-                        __set_bit(BNX2X_ACCEPT_ANY_VLAN, &accept);
+                        if (!(bulletin->valid_bitmap & (1 << VLAN_VALID)))
+                                __set_bit(BNX2X_ACCEPT_ANY_VLAN, &accept);
                        /* set rx-mode */
                        rc = bnx2x_vfop_rxmode_cmd(bp, vf, &cmd,
@@ -1710,6 +1714,21 @@ static void bnx2x_vf_mbx_set_q_filters(struct bnx2x *bp,
                        goto response;
                }
        }
+        /* if vlan was set by hypervisor we don't allow guest to config vlan */
+        if (bulletin->valid_bitmap & 1 << VLAN_VALID) {
+                int i;
+                /* search for vlan filters */
+                for (i = 0; i < filters->n_mac_vlan_filters; i++) {
+                        if (filters->filters[i].flags &
+                            VFPF_Q_FILTER_VLAN_TAG_VALID) {
+                                BNX2X_ERR("VF[%d] attempted to configure vlan but one was already set by Hypervisor. Aborting request\n",
+                                          vf->abs_vfid);
+                                vf->op_rc = -EPERM;
+                                goto response;
+                        }
+                }
+        }
        /* verify vf_qid */
        if (filters->vf_qid > vf_rxq_count(vf))
@@ -1805,6 +1824,9 @@ static void bnx2x_vf_mbx_update_rss(struct bnx2x *bp, struct bnx2x_virtf *vf,
        vf_op_params->rss_result_mask = rss_tlv->rss_result_mask;
        /* flags handled individually for backward/forward compatability */
+        vf_op_params->rss_flags = 0;
+        vf_op_params->ramrod_flags = 0;
        if (rss_tlv->rss_flags & VFPF_RSS_MODE_DISABLED)
                __set_bit(BNX2X_RSS_MODE_DISABLED, &vf_op_params->rss_flags);
        if (rss_tlv->rss_flags & VFPF_RSS_MODE_REGULAR)
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index f3dd93b4aeaa..15a66e4b1f57 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -7622,7 +7622,7 @@ static inline int tg3_4g_overflow_test(dma_addr_t mapping, int len)
 {
        u32 base = (u32) mapping & 0xffffffff;
-        return (base > 0xffffdcc0) && (base + len + 8 < base);
+        return base + len + 8 < base;
 }
 /* Test for TSO DMA buffers that cross into regions which are within MSS bytes
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
index 6c9308850453..56e0415f8cdf 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4.h
@@ -228,6 +228,25 @@ struct tp_params {
        uint32_t dack_re;            /* DACK timer resolution */
        unsigned short tx_modq[NCHAN];  /* channel to modulation queue map */
+        u32 vlan_pri_map;               /* cached TP_VLAN_PRI_MAP */
+        u32 ingress_config;             /* cached TP_INGRESS_CONFIG */
+        /* TP_VLAN_PRI_MAP Compressed Filter Tuple field offsets.  This is a
+         * subset of the set of fields which may be present in the Compressed
+         * Filter Tuple portion of filters and TCP TCB connections.  The
+         * fields which are present are controlled by the TP_VLAN_PRI_MAP.
+         * Since a variable number of fields may or may not be present, their
+         * shifted field positions within the Compressed Filter Tuple may
+         * vary, or not even be present if the field isn't selected in
+         * TP_VLAN_PRI_MAP.  Since some of these fields are needed in various
+         * places we store their offsets here, or a -1 if the field isn't
+         * present.
+         */
+        int vlan_shift;
+        int vnic_shift;
+        int port_shift;
+        int protocol_shift;
 };
 struct vpd_params {
@@ -926,6 +945,8 @@ int t4_prep_fw(struct adapter *adap, struct fw_info *fw_info,
               const u8 *fw_data, unsigned int fw_size,
               struct fw_hdr *card_fw, enum dev_state state, int *reset);
 int t4_prep_adapter(struct adapter *adapter);
+int t4_init_tp_params(struct adapter *adap);
+int t4_filter_field_shift(const struct adapter *adap, int filter_sel);
 int t4_port_init(struct adapter *adap, int mbox, int pf, int vf);
 void t4_fatal_err(struct adapter *adapter);
 int t4_config_rss_range(struct adapter *adapter, int mbox, unsigned int viid,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index d6b12e035a7d..fff02ed1295e 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -2986,7 +2986,14 @@ int cxgb4_alloc_stid(struct tid_info *t, int family, void *data)
        if (stid >= 0) {
                t->stid_tab[stid].data = data;
                stid += t->stid_base;
-                t->stids_in_use++;
+                /* IPv6 requires max of 520 bits or 16 cells in TCAM
+                 * This is equivalent to 4 TIDs. With CLIP enabled it
+                 * needs 2 TIDs.
+                 */
+                if (family == PF_INET)
+                        t->stids_in_use++;
+                else
+                        t->stids_in_use += 4;
        }
        spin_unlock_bh(&t->stid_lock);
        return stid;
@@ -3012,7 +3019,8 @@ int cxgb4_alloc_sftid(struct tid_info *t, int family, void *data)
        }
        if (stid >= 0) {
                t->stid_tab[stid].data = data;
-                stid += t->stid_base;
+                stid -= t->nstids;
+                stid += t->sftid_base;
                t->stids_in_use++;
        }
        spin_unlock_bh(&t->stid_lock);
@@ -3024,14 +3032,24 @@ EXPORT_SYMBOL(cxgb4_alloc_sftid);
 */
 void cxgb4_free_stid(struct tid_info *t, unsigned int stid, int family)
 {
-        stid -= t->stid_base;
+        /* Is it a server filter TID? */
+        if (t->nsftids && (stid >= t->sftid_base)) {
+                stid -= t->sftid_base;
+                stid += t->nstids;
+        } else {
+                stid -= t->stid_base;
+        }
        spin_lock_bh(&t->stid_lock);
        if (family == PF_INET)
                __clear_bit(stid, t->stid_bmap);
        else
                bitmap_release_region(t->stid_bmap, stid, 2);
        t->stid_tab[stid].data = NULL;
-        t->stids_in_use--;
+        if (family == PF_INET)
+                t->stids_in_use--;
+        else
+                t->stids_in_use -= 4;
        spin_unlock_bh(&t->stid_lock);
 }
 EXPORT_SYMBOL(cxgb4_free_stid);
@@ -3134,6 +3152,7 @@ static int tid_init(struct tid_info *t)
        size_t size;
        unsigned int stid_bmap_size;
        unsigned int natids = t->natids;
+        struct adapter *adap = container_of(t, struct adapter, tids);
        stid_bmap_size = BITS_TO_LONGS(t->nstids + t->nsftids);
        size = t->ntids * sizeof(*t->tid_tab) +
@@ -3167,6 +3186,11 @@ static int tid_init(struct tid_info *t)
                t->afree = t->atid_tab;
        }
        bitmap_zero(t->stid_bmap, t->nstids + t->nsftids);
+        /* Reserve stid 0 for T4/T5 adapters */
+        if (!t->stid_base &&
+            (is_t4(adap->params.chip) || is_t5(adap->params.chip)))
+                __set_bit(0, t->stid_bmap);
        return 0;
 }
@@ -3731,7 +3755,7 @@ static void uld_attach(struct adapter *adap, unsigned int uld)
        lli.ucq_density = 1 << QUEUESPERPAGEPF0_GET(
                        t4_read_reg(adap, SGE_INGRESS_QUEUES_PER_PAGE_PF) >>
                        (adap->fn * 4));
-        lli.filt_mode = adap->filter_mode;
+        lli.filt_mode = adap->params.tp.vlan_pri_map;
        /* MODQ_REQ_MAP sets queues 0-3 to chan 0-3 */
        for (i = 0; i < NCHAN; i++)
                lli.tx_modq[i] = i;
@@ -4179,7 +4203,7 @@ int cxgb4_create_server_filter(const struct net_device *dev, unsigned int stid,
        adap = netdev2adap(dev);
        /* Adjust stid to correct filter index */
-        stid -= adap->tids.nstids;
+        stid -= adap->tids.sftid_base;
        stid += adap->tids.nftids;
        /* Check to make sure the filter requested is writable ...
@@ -4205,12 +4229,17 @@ int cxgb4_create_server_filter(const struct net_device *dev, unsigned int stid,
                        f->fs.val.lip[i] = val[i];
                        f->fs.mask.lip[i] = ~0;
                }
-                if (adap->filter_mode & F_PORT) {
+                if (adap->params.tp.vlan_pri_map & F_PORT) {
                        f->fs.val.iport = port;
                        f->fs.mask.iport = mask;
                }
        }
+        if (adap->params.tp.vlan_pri_map & F_PROTOCOL) {
+                f->fs.val.proto = IPPROTO_TCP;
+                f->fs.mask.proto = ~0;
+        }
        f->fs.dirsteer = 1;
        f->fs.iq = queue;
        /* Mark filter as locked */
@@ -4237,7 +4266,7 @@ int cxgb4_remove_server_filter(const struct net_device *dev, unsigned int stid,
        adap = netdev2adap(dev);
        /* Adjust stid to correct filter index */
-        stid -= adap->tids.nstids;
+        stid -= adap->tids.sftid_base;
        stid += adap->tids.nftids;
        f = &adap->tids.ftid_tab[stid];
@@ -5092,7 +5121,7 @@ static int adap_init0(struct adapter *adap)
        enum dev_state state;
        u32 params[7], val[7];
        struct fw_caps_config_cmd caps_cmd;
-        int reset = 1, j;
+        int reset = 1;
        /*
         * Contact FW, advertising Master capability (and potentially forcing
@@ -5434,21 +5463,11 @@ static int adap_init0(struct adapter *adap)
        /*
         * These are finalized by FW initialization, load their values now.
         */
-        v = t4_read_reg(adap, TP_TIMER_RESOLUTION);
-        adap->params.tp.tre = TIMERRESOLUTION_GET(v);
-        adap->params.tp.dack_re = DELAYEDACKRESOLUTION_GET(v);
        t4_read_mtu_tbl(adap, adap->params.mtus, NULL);
        t4_load_mtus(adap, adap->params.mtus, adap->params.a_wnd,
                     adap->params.b_wnd);
-        /* MODQ_REQ_MAP defaults to setting queues 0-3 to chan 0-3 */
+        t4_init_tp_params(adap);
-        for (j = 0; j < NCHAN; j++)
-                adap->params.tp.tx_modq[j] = j;
-        t4_read_indirect(adap, TP_PIO_ADDR, TP_PIO_DATA,
-                         &adap->filter_mode, 1,
-                         TP_VLAN_PRI_MAP);
        adap->flags |= FW_OK;
        return 0;
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
index 6f21f2451c30..4dd0a82533e4 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.h
@@ -131,7 +131,14 @@ static inline void *lookup_atid(const struct tid_info *t, unsigned int atid)
 static inline void *lookup_stid(const struct tid_info *t, unsigned int stid)
 {
-        stid -= t->stid_base;
+        /* Is it a server filter TID? */
+        if (t->nsftids && (stid >= t->sftid_base)) {
+                stid -= t->sftid_base;
+                stid += t->nstids;
+        } else {
+                stid -= t->stid_base;
+        }
        return stid < (t->nstids + t->nsftids) ? t->stid_tab[stid].data : NULL;
 }
diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.c b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
index 29878098101e..81e8402a74b4 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.c
@@ -45,6 +45,7 @@
 #include "l2t.h"
 #include "t4_msg.h"
 #include "t4fw_api.h"
+#include "t4_regs.h"
 #define VLAN_NONE 0xfff
@@ -411,6 +412,40 @@ done:
 }
 EXPORT_SYMBOL(cxgb4_l2t_get);
+u64 cxgb4_select_ntuple(struct net_device *dev,
+                        const struct l2t_entry *l2t)
+{
+        struct adapter *adap = netdev2adap(dev);
+        struct tp_params *tp = &adap->params.tp;
+        u64 ntuple = 0;
+        /* Initialize each of the fields which we care about which are present
+         * in the Compressed Filter Tuple.
+         */
+        if (tp->vlan_shift >= 0 && l2t->vlan != VLAN_NONE)
+                ntuple |= (u64)(F_FT_VLAN_VLD | l2t->vlan) << tp->vlan_shift;
+        if (tp->port_shift >= 0)
+                ntuple |= (u64)l2t->lport << tp->port_shift;
+        if (tp->protocol_shift >= 0)
+                ntuple |= (u64)IPPROTO_TCP << tp->protocol_shift;
+        if (tp->vnic_shift >= 0) {
+                u32 viid = cxgb4_port_viid(dev);
+                u32 vf = FW_VIID_VIN_GET(viid);
+                u32 pf = FW_VIID_PFN_GET(viid);
+                u32 vld = FW_VIID_VIVLD_GET(viid);
+                ntuple |= (u64)(V_FT_VNID_ID_VF(vf) |
+                                V_FT_VNID_ID_PF(pf) |
+                                V_FT_VNID_ID_VLD(vld)) << tp->vnic_shift;
+        }
+        return ntuple;
+}
+EXPORT_SYMBOL(cxgb4_select_ntuple);
 /*
 * Called when address resolution fails for an L2T entry to handle packets
 * on the arpq head.  If a packet specifies a failure handler it is invoked,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/l2t.h b/drivers/net/ethernet/chelsio/cxgb4/l2t.h
index 108c0f1fce1c..85eb5c71358d 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/l2t.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/l2t.h
@@ -98,7 +98,8 @@ int cxgb4_l2t_send(struct net_device *dev, struct sk_buff *skb,
 struct l2t_entry *cxgb4_l2t_get(struct l2t_data *d, struct neighbour *neigh,
                                const struct net_device *physdev,
                                unsigned int priority);
+u64 cxgb4_select_ntuple(struct net_device *dev,
+                        const struct l2t_entry *l2t);
 void t4_l2t_update(struct adapter *adap, struct neighbour *neigh);
 struct l2t_entry *t4_l2t_alloc_switching(struct l2t_data *d);
 int t4_l2t_set_switching(struct adapter *adap, struct l2t_entry *e, u16 vlan,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/sge.c b/drivers/net/ethernet/chelsio/cxgb4/sge.c
index cc380c36e1a8..cc3511a5cd0c 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/sge.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/sge.c
@@ -2581,7 +2581,7 @@ static int t4_sge_init_soft(struct adapter *adap)
        #undef READ_FL_BUF
        if (fl_small_pg != PAGE_SIZE ||
-            (fl_large_pg != 0 && (fl_large_pg <= fl_small_pg ||
+            (fl_large_pg != 0 && (fl_large_pg < fl_small_pg ||
                                  (fl_large_pg & (fl_large_pg-1)) != 0))) {
                dev_err(adap->pdev_dev, "bad SGE FL page buffer sizes [%d, %d]\n",
                        fl_small_pg, fl_large_pg);
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
index 74a6fce5a15a..e1413eacdbd2 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c
@@ -3808,6 +3808,109 @@ int t4_prep_adapter(struct adapter *adapter)
        return 0;
 }
+/**
+ *      t4_init_tp_params - initialize adap->params.tp
+ *      @adap: the adapter
+ *
+ *      Initialize various fields of the adapter's TP Parameters structure.
+ */
+int t4_init_tp_params(struct adapter *adap)
+{
+        int chan;
+        u32 v;
+        v = t4_read_reg(adap, TP_TIMER_RESOLUTION);
+        adap->params.tp.tre = TIMERRESOLUTION_GET(v);
+        adap->params.tp.dack_re = DELAYEDACKRESOLUTION_GET(v);
+        /* MODQ_REQ_MAP defaults to setting queues 0-3 to chan 0-3 */
+        for (chan = 0; chan < NCHAN; chan++)
+                adap->params.tp.tx_modq[chan] = chan;
+        /* Cache the adapter's Compressed Filter Mode and global Incress
+         * Configuration.
+         */
+        t4_read_indirect(adap, TP_PIO_ADDR, TP_PIO_DATA,
+                         &adap->params.tp.vlan_pri_map, 1,
+                         TP_VLAN_PRI_MAP);
+        t4_read_indirect(adap, TP_PIO_ADDR, TP_PIO_DATA,
+                         &adap->params.tp.ingress_config, 1,
+                         TP_INGRESS_CONFIG);
+        /* Now that we have TP_VLAN_PRI_MAP cached, we can calculate the field
+         * shift positions of several elements of the Compressed Filter Tuple
+         * for this adapter which we need frequently ...
+         */
+        adap->params.tp.vlan_shift = t4_filter_field_shift(adap, F_VLAN);
+        adap->params.tp.vnic_shift = t4_filter_field_shift(adap, F_VNIC_ID);
+        adap->params.tp.port_shift = t4_filter_field_shift(adap, F_PORT);
+        adap->params.tp.protocol_shift = t4_filter_field_shift(adap,
+                                                               F_PROTOCOL);
+        /* If TP_INGRESS_CONFIG.VNID == 0, then TP_VLAN_PRI_MAP.VNIC_ID
+         * represents the presense of an Outer VLAN instead of a VNIC ID.
+         */
+        if ((adap->params.tp.ingress_config & F_VNIC) == 0)
+                adap->params.tp.vnic_shift = -1;
+        return 0;
+}
+/**
+ *      t4_filter_field_shift - calculate filter field shift
+ *      @adap: the adapter
+ *      @filter_sel: the desired field (from TP_VLAN_PRI_MAP bits)
+ *
+ *      Return the shift position of a filter field within the Compressed
+ *      Filter Tuple.  The filter field is specified via its selection bit
+ *      within TP_VLAN_PRI_MAL (filter mode).  E.g. F_VLAN.
+ */
+int t4_filter_field_shift(const struct adapter *adap, int filter_sel)
+{
+        unsigned int filter_mode = adap->params.tp.vlan_pri_map;
+        unsigned int sel;
+        int field_shift;
+        if ((filter_mode & filter_sel) == 0)
+                return -1;
+        for (sel = 1, field_shift = 0; sel < filter_sel; sel <<= 1) {
+                switch (filter_mode & sel) {
+                case F_FCOE:
+                        field_shift += W_FT_FCOE;
+                        break;
+                case F_PORT:
+                        field_shift += W_FT_PORT;
+                        break;
+                case F_VNIC_ID:
+                        field_shift += W_FT_VNIC_ID;
+                        break;
+                case F_VLAN:
+                        field_shift += W_FT_VLAN;
+                        break;
+                case F_TOS:
+                        field_shift += W_FT_TOS;
+                        break;
+                case F_PROTOCOL:
+                        field_shift += W_FT_PROTOCOL;
+                        break;
+                case F_ETHERTYPE:
+                        field_shift += W_FT_ETHERTYPE;
+                        break;
+                case F_MACMATCH:
+                        field_shift += W_FT_MACMATCH;
+                        break;
+                case F_MPSHITTYPE:
+                        field_shift += W_FT_MPSHITTYPE;
+                        break;
+                case F_FRAGMENTATION:
+                        field_shift += W_FT_FRAGMENTATION;
+                        break;
+                }
+        }
+        return field_shift;
+}
 int t4_port_init(struct adapter *adap, int mbox, int pf, int vf)
 {
        u8 addr[6];
diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
index 0a8205d69d2c..4082522d8140 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
+++ b/drivers/net/ethernet/chelsio/cxgb4/t4_regs.h
@@ -1171,10 +1171,50 @@
 #define A_TP_TX_SCHED_PCMD 0x25
+#define S_VNIC    11
+#define V_VNIC(x) ((x) << S_VNIC)
+#define F_VNIC    V_VNIC(1U)
+#define S_FRAGMENTATION    9
+#define V_FRAGMENTATION(x) ((x) << S_FRAGMENTATION)
+#define F_FRAGMENTATION    V_FRAGMENTATION(1U)
+#define S_MPSHITTYPE    8
+#define V_MPSHITTYPE(x) ((x) << S_MPSHITTYPE)
+#define F_MPSHITTYPE    V_MPSHITTYPE(1U)
+#define S_MACMATCH    7
+#define V_MACMATCH(x) ((x) << S_MACMATCH)
+#define F_MACMATCH    V_MACMATCH(1U)
+#define S_ETHERTYPE    6
+#define V_ETHERTYPE(x) ((x) << S_ETHERTYPE)
+#define F_ETHERTYPE    V_ETHERTYPE(1U)
+#define S_PROTOCOL    5
+#define V_PROTOCOL(x) ((x) << S_PROTOCOL)
+#define F_PROTOCOL    V_PROTOCOL(1U)
+#define S_TOS    4
+#define V_TOS(x) ((x) << S_TOS)
+#define F_TOS    V_TOS(1U)
+#define S_VLAN    3
+#define V_VLAN(x) ((x) << S_VLAN)
+#define F_VLAN    V_VLAN(1U)
+#define S_VNIC_ID    2
+#define V_VNIC_ID(x) ((x) << S_VNIC_ID)
+#define F_VNIC_ID    V_VNIC_ID(1U)
 #define S_PORT    1
 #define V_PORT(x) ((x) << S_PORT)
 #define F_PORT    V_PORT(1U)
+#define S_FCOE    0
+#define V_FCOE(x) ((x) << S_FCOE)
+#define F_FCOE    V_FCOE(1U)
 #define NUM_MPS_CLS_SRAM_L_INSTANCES 336
 #define NUM_MPS_T5_CLS_SRAM_L_INSTANCES 512
@@ -1213,4 +1253,37 @@
 #define V_CHIPID(x) ((x) << S_CHIPID)
 #define G_CHIPID(x) (((x) >> S_CHIPID) & M_CHIPID)
+/* TP_VLAN_PRI_MAP controls which subset of fields will be present in the
+ * Compressed Filter Tuple for LE filters.  Each bit set in TP_VLAN_PRI_MAP
+ * selects for a particular field being present.  These fields, when present
+ * in the Compressed Filter Tuple, have the following widths in bits.
+ */
+#define W_FT_FCOE                       1
+#define W_FT_PORT                       3
+#define W_FT_VNIC_ID                    17
+#define W_FT_VLAN                       17
+#define W_FT_TOS                        8
+#define W_FT_PROTOCOL                   8
+#define W_FT_ETHERTYPE                  16
+#define W_FT_MACMATCH                   9
+#define W_FT_MPSHITTYPE                 3
+#define W_FT_FRAGMENTATION              1
+/* Some of the Compressed Filter Tuple fields have internal structure.  These
+ * bit shifts/masks describe those structures.  All shifts are relative to the
+ * base position of the fields within the Compressed Filter Tuple
+ */
+#define S_FT_VLAN_VLD                   16
+#define V_FT_VLAN_VLD(x)                ((x) << S_FT_VLAN_VLD)
+#define F_FT_VLAN_VLD                   V_FT_VLAN_VLD(1U)
+#define S_FT_VNID_ID_VF                 0
+#define V_FT_VNID_ID_VF(x)              ((x) << S_FT_VNID_ID_VF)
+#define S_FT_VNID_ID_PF                 7
+#define V_FT_VNID_ID_PF(x)              ((x) << S_FT_VNID_ID_PF)
+#define S_FT_VNID_ID_VLD                16
+#define V_FT_VNID_ID_VLD(x)             ((x) << S_FT_VNID_ID_VLD)
 #endif /* __T4_REGS_H */
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 5878df619b53..4ccaf9af6fc9 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -104,6 +104,7 @@ static inline char *nic_name(struct pci_dev *pdev)
 #define BE3_MAX_RSS_QS          16
 #define BE3_MAX_TX_QS           16
 #define BE3_MAX_EVT_QS          16
+#define BE3_SRIOV_MAX_EVT_QS    8
 #define MAX_RX_QS               32
 #define MAX_EVT_QS              32
@@ -480,7 +481,7 @@ struct be_adapter {
        struct list_head entry;
        u32 flash_status;
-        struct completion flash_compl;
+        struct completion et_cmd_compl;
        struct be_resources res;        /* resources available for the func */
        u16 num_vfs;                    /* Number of VFs provisioned by PF */
diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c
index e0e8bc1ef14c..94c35c8d799d 100644
--- a/drivers/net/ethernet/emulex/benet/be_cmds.c
+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c
@@ -141,11 +141,17 @@ static int be_mcc_compl_process(struct be_adapter *adapter,
                subsystem = resp_hdr->subsystem;
        }
+        if (opcode == OPCODE_LOWLEVEL_LOOPBACK_TEST &&
+            subsystem == CMD_SUBSYSTEM_LOWLEVEL) {
+                complete(&adapter->et_cmd_compl);
+                return 0;
+        }
        if (((opcode == OPCODE_COMMON_WRITE_FLASHROM) ||
             (opcode == OPCODE_COMMON_WRITE_OBJECT)) &&
            (subsystem == CMD_SUBSYSTEM_COMMON)) {
                adapter->flash_status = compl_status;
-                complete(&adapter->flash_compl);
+                complete(&adapter->et_cmd_compl);
        }
        if (compl_status == MCC_STATUS_SUCCESS) {
@@ -2017,6 +2023,9 @@ int be_cmd_rss_config(struct be_adapter *adapter, u8 *rsstable,
                        0x3ea83c02, 0x4a110304};
        int status;
+        if (!(be_if_cap_flags(adapter) & BE_IF_FLAGS_RSS))
+                return 0;
        if (mutex_lock_interruptible(&adapter->mbox_lock))
                return -1;
@@ -2160,7 +2169,7 @@ int lancer_cmd_write_object(struct be_adapter *adapter, struct be_dma_mem *cmd,
        be_mcc_notify(adapter);
        spin_unlock_bh(&adapter->mcc_lock);
-        if (!wait_for_completion_timeout(&adapter->flash_compl,
+        if (!wait_for_completion_timeout(&adapter->et_cmd_compl,
                                         msecs_to_jiffies(60000)))
                status = -1;
        else
@@ -2255,8 +2264,8 @@ int be_cmd_write_flashrom(struct be_adapter *adapter, struct be_dma_mem *cmd,
        be_mcc_notify(adapter);
        spin_unlock_bh(&adapter->mcc_lock);
-        if (!wait_for_completion_timeout(&adapter->flash_compl,
+        if (!wait_for_completion_timeout(&adapter->et_cmd_compl,
-                        msecs_to_jiffies(40000)))
+                                         msecs_to_jiffies(40000)))
                status = -1;
        else
                status = adapter->flash_status;
@@ -2367,6 +2376,7 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
 {
        struct be_mcc_wrb *wrb;
        struct be_cmd_req_loopback_test *req;
+        struct be_cmd_resp_loopback_test *resp;
        int status;
        spin_lock_bh(&adapter->mcc_lock);
@@ -2381,8 +2391,8 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
        be_wrb_cmd_hdr_prepare(&req->hdr, CMD_SUBSYSTEM_LOWLEVEL,
                        OPCODE_LOWLEVEL_LOOPBACK_TEST, sizeof(*req), wrb, NULL);
-        req->hdr.timeout = cpu_to_le32(4);
+        req->hdr.timeout = cpu_to_le32(15);
        req->pattern = cpu_to_le64(pattern);
        req->src_port = cpu_to_le32(port_num);
        req->dest_port = cpu_to_le32(port_num);
@@ -2390,12 +2400,15 @@ int be_cmd_loopback_test(struct be_adapter *adapter, u32 port_num,
        req->num_pkts = cpu_to_le32(num_pkts);
        req->loopback_type = cpu_to_le32(loopback_type);
-        status = be_mcc_notify_wait(adapter);
+        be_mcc_notify(adapter);
-        if (!status) {
-                struct be_cmd_resp_loopback_test *resp = embedded_payload(wrb);
+        spin_unlock_bh(&adapter->mcc_lock);
-                status = le32_to_cpu(resp->status);
-        }
+        wait_for_completion(&adapter->et_cmd_compl);
+        resp = embedded_payload(wrb);
+        status = le32_to_cpu(resp->status);
+        return status;
 err:
        spin_unlock_bh(&adapter->mcc_lock);
        return status;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 0fde69d5cb6a..a37039d353c5 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1776,6 +1776,7 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
        struct be_rx_page_info *page_info = NULL, *prev_page_info = NULL;
        struct be_queue_info *rxq = &rxo->q;
        struct page *pagep = NULL;
+        struct device *dev = &adapter->pdev->dev;
        struct be_eth_rx_d *rxd;
        u64 page_dmaaddr = 0, frag_dmaaddr;
        u32 posted, page_offset = 0;
@@ -1788,9 +1789,15 @@ static void be_post_rx_frags(struct be_rx_obj *rxo, gfp_t gfp)
                                rx_stats(rxo)->rx_post_fail++;
                                break;
                        }
-                        page_dmaaddr = dma_map_page(&adapter->pdev->dev, pagep,
+                        page_dmaaddr = dma_map_page(dev, pagep, 0,
-                                                    0, adapter->big_page_size,
+                                                    adapter->big_page_size,
                                                    DMA_FROM_DEVICE);
+                        if (dma_mapping_error(dev, page_dmaaddr)) {
+                                put_page(pagep);
+                                pagep = NULL;
+                                rx_stats(rxo)->rx_post_fail++;
+                                break;
+                        }
                        page_info->page_offset = 0;
                } else {
                        get_page(pagep);
@@ -2744,13 +2751,16 @@ static int be_rx_qs_create(struct be_adapter *adapter)
                if (!BEx_chip(adapter))
                        adapter->rss_flags |= RSS_ENABLE_UDP_IPV4 |
                                                RSS_ENABLE_UDP_IPV6;
+        } else {
+                /* Disable RSS, if only default RX Q is created */
+                adapter->rss_flags = RSS_ENABLE_NONE;
+        }
-                rc = be_cmd_rss_config(adapter, rsstable, adapter->rss_flags,
+        rc = be_cmd_rss_config(adapter, rsstable, adapter->rss_flags,
-                                       128);
+                               128);
-                if (rc) {
+        if (rc) {
-                        adapter->rss_flags = 0;
+                adapter->rss_flags = RSS_ENABLE_NONE;
-                        return rc;
+                return rc;
-                }
        }
        /* First time posting */
@@ -3124,11 +3134,11 @@ static void BEx_get_resources(struct be_adapter *adapter,
 {
        struct pci_dev *pdev = adapter->pdev;
        bool use_sriov = false;
+        int max_vfs;
-        if (BE3_chip(adapter) && sriov_want(adapter)) {
+        max_vfs = pci_sriov_get_totalvfs(pdev);
-                int max_vfs;
-                max_vfs = pci_sriov_get_totalvfs(pdev);
+        if (BE3_chip(adapter) && sriov_want(adapter)) {
                res->max_vfs = max_vfs > 0 ? min(MAX_VFS, max_vfs) : 0;
                use_sriov = res->max_vfs;
        }
@@ -3159,7 +3169,11 @@ static void BEx_get_resources(struct be_adapter *adapter,
                                           BE3_MAX_RSS_QS : BE2_MAX_RSS_QS;
        res->max_rx_qs = res->max_rss_qs + 1;
-        res->max_evt_qs = be_physfn(adapter) ? BE3_MAX_EVT_QS : 1;
+        if (be_physfn(adapter))
+                res->max_evt_qs = (max_vfs > 0) ?
+                                        BE3_SRIOV_MAX_EVT_QS : BE3_MAX_EVT_QS;
+        else
+                res->max_evt_qs = 1;
        res->if_cap_flags = BE_IF_CAP_FLAGS_WANT;
        if (!(adapter->function_caps & BE_FUNCTION_CAPS_RSS))
@@ -4205,7 +4219,7 @@ static int be_ctrl_init(struct be_adapter *adapter)
        spin_lock_init(&adapter->mcc_lock);
        spin_lock_init(&adapter->mcc_cq_lock);
-        init_completion(&adapter->flash_compl);
+        init_completion(&adapter->et_cmd_compl);
        pci_save_state(adapter->pdev);
        return 0;
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index e7c8b749c5a5..50bb71c663e2 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -428,6 +428,8 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
        /* If this was the last BD in the ring, start at the beginning again. */
        bdp = fec_enet_get_nextdesc(bdp, fep);
+        skb_tx_timestamp(skb);
        fep->cur_tx = bdp;
        if (fep->cur_tx == fep->dirty_tx)
@@ -436,8 +438,6 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
        /* Trigger transmission start */
        writel(0, fep->hwp + FEC_X_DES_ACTIVE);
-        skb_tx_timestamp(skb);
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/ethernet/intel/e1000e/80003es2lan.c b/drivers/net/ethernet/intel/e1000e/80003es2lan.c
index 895450e9bb3c..ff2d806eaef7 100644
--- a/drivers/net/ethernet/intel/e1000e/80003es2lan.c
+++ b/drivers/net/ethernet/intel/e1000e/80003es2lan.c
@@ -718,8 +718,11 @@ static s32 e1000_reset_hw_80003es2lan(struct e1000_hw *hw)
        e1000_release_phy_80003es2lan(hw);
        /* Disable IBIST slave mode (far-end loopback) */
-        e1000_read_kmrn_reg_80003es2lan(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
+        ret_val =
-                                        &kum_reg_data);
+            e1000_read_kmrn_reg_80003es2lan(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
+                                            &kum_reg_data);
+        if (ret_val)
+                return ret_val;
        kum_reg_data |= E1000_KMRNCTRLSTA_IBIST_DISABLE;
        e1000_write_kmrn_reg_80003es2lan(hw, E1000_KMRNCTRLSTA_INBAND_PARAM,
                                         kum_reg_data);
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index 8d3945ab7334..6d14eea17918 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -7015,13 +7015,11 @@ static DEFINE_PCI_DEVICE_TABLE(e1000_pci_tbl) = {
 };
 MODULE_DEVICE_TABLE(pci, e1000_pci_tbl);
-#ifdef CONFIG_PM
 static const struct dev_pm_ops e1000_pm_ops = {
        SET_SYSTEM_SLEEP_PM_OPS(e1000_suspend, e1000_resume)
        SET_RUNTIME_PM_OPS(e1000_runtime_suspend, e1000_runtime_resume,
                           e1000_idle)
 };
-#endif
 /* PCI Device API Driver */
 static struct pci_driver e1000_driver = {
@@ -7029,11 +7027,9 @@ static struct pci_driver e1000_driver = {
        .id_table = e1000_pci_tbl,
        .probe    = e1000_probe,
        .remove   = e1000_remove,
-#ifdef CONFIG_PM
        .driver   = {
                .pm = &e1000_pm_ops,
        },
-#endif
        .shutdown = e1000_shutdown,
        .err_handler = &e1000_err_handler
 };
diff --git a/drivers/net/ethernet/intel/e1000e/phy.c b/drivers/net/ethernet/intel/e1000e/phy.c
index da2be59505c0..20e71f4ca426 100644
--- a/drivers/net/ethernet/intel/e1000e/phy.c
+++ b/drivers/net/ethernet/intel/e1000e/phy.c
@@ -1757,19 +1757,23 @@ s32 e1000e_phy_has_link_generic(struct e1000_hw *hw, u32 iterations,
                 * it across the board.
                 */
                ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
-                if (ret_val)
+                if (ret_val) {
                        /* If the first read fails, another entity may have
                         * ownership of the resources, wait and try again to
                         * see if they have relinquished the resources yet.
                         */
-                        udelay(usec_interval);
+                        if (usec_interval >= 1000)
+                                msleep(usec_interval / 1000);
+                        else
+                                udelay(usec_interval);
+                }
                ret_val = e1e_rphy(hw, MII_BMSR, &phy_status);
                if (ret_val)
                        break;
                if (phy_status & BMSR_LSTATUS)
                        break;
                if (usec_interval >= 1000)
-                        mdelay(usec_interval / 1000);
+                        msleep(usec_interval / 1000);
                else
                        udelay(usec_interval);
        }
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index cc06854296a3..5bcc870f8367 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6827,12 +6827,20 @@ static inline int ixgbe_maybe_stop_tx(struct ixgbe_ring *tx_ring, u16 size)
        return __ixgbe_maybe_stop_tx(tx_ring, size);
 }
-#ifdef IXGBE_FCOE
+static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb,
-static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
+                              void *accel_priv)
 {
+        struct ixgbe_fwd_adapter *fwd_adapter = accel_priv;
+#ifdef IXGBE_FCOE
        struct ixgbe_adapter *adapter;
        struct ixgbe_ring_feature *f;
        int txq;
+#endif
+        if (fwd_adapter)
+                return skb->queue_mapping + fwd_adapter->tx_base_queue;
+#ifdef IXGBE_FCOE
        /*
         * only execute the code below if protocol is FCoE
@@ -6858,9 +6866,11 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
                txq -= f->indices;
        return txq + f->offset;
+#else
+        return __netdev_pick_tx(dev, skb);
+#endif
 }
-#endif
 netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb,
                          struct ixgbe_adapter *adapter,
                          struct ixgbe_ring *tx_ring)
@@ -7629,27 +7639,11 @@ static void ixgbe_fwd_del(struct net_device *pdev, void *priv)
        kfree(fwd_adapter);
 }
-static netdev_tx_t ixgbe_fwd_xmit(struct sk_buff *skb,
-                                  struct net_device *dev,
-                                  void *priv)
-{
-        struct ixgbe_fwd_adapter *fwd_adapter = priv;
-        unsigned int queue;
-        struct ixgbe_ring *tx_ring;
-        queue = skb->queue_mapping + fwd_adapter->tx_base_queue;
-        tx_ring = fwd_adapter->real_adapter->tx_ring[queue];
-        return __ixgbe_xmit_frame(skb, dev, tx_ring);
-}
 static const struct net_device_ops ixgbe_netdev_ops = {
        .ndo_open               = ixgbe_open,
        .ndo_stop               = ixgbe_close,
        .ndo_start_xmit         = ixgbe_xmit_frame,
-#ifdef IXGBE_FCOE
        .ndo_select_queue       = ixgbe_select_queue,
-#endif
        .ndo_set_rx_mode        = ixgbe_set_rx_mode,
        .ndo_validate_addr      = eth_validate_addr,
        .ndo_set_mac_address    = ixgbe_set_mac,
@@ -7689,7 +7683,6 @@ static const struct net_device_ops ixgbe_netdev_ops = {
        .ndo_bridge_getlink     = ixgbe_ndo_bridge_getlink,
        .ndo_dfwd_add_station   = ixgbe_fwd_add,
        .ndo_dfwd_del_station   = ixgbe_fwd_del,
-        .ndo_dfwd_start_xmit    = ixgbe_fwd_xmit,
 };
 /**
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
index d6f0c0d8cf11..72084f70adbb 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -291,7 +291,9 @@ static int ixgbe_pci_sriov_disable(struct pci_dev *dev)
 {
        struct ixgbe_adapter *adapter = pci_get_drvdata(dev);
        int err;
+#ifdef CONFIG_PCI_IOV
        u32 current_flags = adapter->flags;
+#endif
        err = ixgbe_disable_sriov(adapter);
diff --git a/drivers/net/ethernet/lantiq_etop.c b/drivers/net/ethernet/lantiq_etop.c
index 6a6c1f76d8e0..ec94a20d7099 100644
--- a/drivers/net/ethernet/lantiq_etop.c
+++ b/drivers/net/ethernet/lantiq_etop.c
@@ -619,7 +619,8 @@ ltq_etop_set_multicast_list(struct net_device *dev)
 }
 static u16
-ltq_etop_select_queue(struct net_device *dev, struct sk_buff *skb)
+ltq_etop_select_queue(struct net_device *dev, struct sk_buff *skb,
+                      void *accel_priv)
 {
        /* we are currently only using the first queue */
        return 0;
diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c
index 7354960b583b..c4eeb69a5bee 100644
--- a/drivers/net/ethernet/marvell/mvmdio.c
+++ b/drivers/net/ethernet/marvell/mvmdio.c
@@ -92,6 +92,12 @@ static int orion_mdio_wait_ready(struct mii_bus *bus)
                        if (time_is_before_jiffies(end))
                                ++timedout;
                } else {
+                        /* wait_event_timeout does not guarantee a delay of at
+                         * least one whole jiffie, so timeout must be no less
+                         * than two.
+                         */
+                        if (timeout < 2)
+                                timeout = 2;
                        wait_event_timeout(dev->smi_busy_wait,
                                           orion_mdio_smi_is_done(dev),
                                           timeout);
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index f54ebd5a1702..a7fcd593b2db 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -592,7 +592,8 @@ static void build_inline_wqe(struct mlx4_en_tx_desc *tx_desc, struct sk_buff *sk
        }
 }
-u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb)
+u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
+                         void *accel_priv)
 {
        struct mlx4_en_priv *priv = netdev_priv(dev);
        u16 rings_p_up = priv->num_tx_rings_p_up;
diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
index f3758de59c05..d5758adceaa2 100644
--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
@@ -714,7 +714,8 @@ int mlx4_en_set_cq_moder(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq);
 int mlx4_en_arm_cq(struct mlx4_en_priv *priv, struct mlx4_en_cq *cq);
 void mlx4_en_tx_irq(struct mlx4_cq *mcq);
-u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb);
+u16 mlx4_en_select_queue(struct net_device *dev, struct sk_buff *skb,
+                         void *accel_priv);
 netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev);
 int mlx4_en_create_tx_ring(struct mlx4_en_priv *priv,
diff --git a/drivers/net/ethernet/natsemi/macsonic.c b/drivers/net/ethernet/natsemi/macsonic.c
index 346a4e025c34..04b3ec1352f1 100644
--- a/drivers/net/ethernet/natsemi/macsonic.c
+++ b/drivers/net/ethernet/natsemi/macsonic.c
@@ -52,7 +52,6 @@
 #include <linux/bitrev.h>
 #include <linux/slab.h>
-#include <asm/bootinfo.h>
 #include <asm/pgtable.h>
 #include <asm/io.h>
 #include <asm/hwtest.h>
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
index 7692dfd4f262..cc68657f0536 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
@@ -1604,13 +1604,13 @@ netxen_process_lro(struct netxen_adapter *adapter,
        u32 seq_number;
        u8 vhdr_len = 0;
-        if (unlikely(ring > adapter->max_rds_rings))
+        if (unlikely(ring >= adapter->max_rds_rings))
                return NULL;
        rds_ring = &recv_ctx->rds_rings[ring];
        index = netxen_get_lro_sts_refhandle(sts_data0);
-        if (unlikely(index > rds_ring->num_desc))
+        if (unlikely(index >= rds_ring->num_desc))
                return NULL;
        buffer = &rds_ring->rx_buf_arr[index];
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 631ea0ac1cd8..f2a7c7166e24 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -487,6 +487,7 @@ struct qlcnic_hardware_context {
        struct qlcnic_mailbox *mailbox;
        u8 extend_lb_time;
        u8 phys_port_id[ETH_ALEN];
+        u8 lb_mode;
 };
 struct qlcnic_adapter_stats {
@@ -578,6 +579,8 @@ struct qlcnic_host_tx_ring {
        dma_addr_t phys_addr;
        dma_addr_t hw_cons_phys_addr;
        struct netdev_queue *txq;
+        /* Lock to protect Tx descriptors cleanup */
+        spinlock_t tx_clean_lock;
 } ____cacheline_internodealigned_in_smp;
 /*
@@ -808,6 +811,7 @@ struct qlcnic_mac_list_s {
 #define QLCNIC_ILB_MODE         0x1
 #define QLCNIC_ELB_MODE         0x2
+#define QLCNIC_LB_MODE_MASK     0x3
 #define QLCNIC_LINKEVENT        0x1
 #define QLCNIC_LB_RESPONSE      0x2
@@ -1093,7 +1097,6 @@ struct qlcnic_adapter {
        struct qlcnic_filter_hash rx_fhash;
        struct list_head vf_mc_list;
-        spinlock_t tx_clean_lock;
        spinlock_t mac_learn_lock;
        /* spinlock for catching rcv filters for eswitch traffic */
        spinlock_t rx_mac_learn_lock;
@@ -1708,6 +1711,7 @@ int qlcnic_83xx_init_mailbox_work(struct qlcnic_adapter *);
 void qlcnic_83xx_detach_mailbox_work(struct qlcnic_adapter *);
 void qlcnic_83xx_reinit_mbx_work(struct qlcnic_mailbox *mbx);
 void qlcnic_83xx_free_mailbox(struct qlcnic_mailbox *mbx);
+void qlcnic_update_stats(struct qlcnic_adapter *);
 /* Adapter hardware abstraction */
 struct qlcnic_hardware_ops {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
index 6055d397a29e..f776f99f7915 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
@@ -1684,12 +1684,6 @@ int qlcnic_83xx_loopback_test(struct net_device *netdev, u8 mode)
                }
        } while ((adapter->ahw->linkup && ahw->has_link_events) != 1);
-        /* Make sure carrier is off and queue is stopped during loopback */
-        if (netif_running(netdev)) {
-                netif_carrier_off(netdev);
-                netif_tx_stop_all_queues(netdev);
-        }
        ret = qlcnic_do_lb_test(adapter, mode);
        qlcnic_83xx_clear_lb_mode(adapter, mode);
@@ -2121,6 +2115,7 @@ static void qlcnic_83xx_handle_link_aen(struct qlcnic_adapter *adapter,
        ahw->link_autoneg = MSB(MSW(data[3]));
        ahw->module_type = MSB(LSW(data[3]));
        ahw->has_link_events = 1;
+        ahw->lb_mode = data[4] & QLCNIC_LB_MODE_MASK;
        qlcnic_advert_link_change(adapter, link_status);
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
index e3be2760665c..6b08194aa0d4 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
@@ -167,27 +167,35 @@ static const char qlcnic_gstrings_test[][ETH_GSTRING_LEN] = {
 #define QLCNIC_TEST_LEN ARRAY_SIZE(qlcnic_gstrings_test)
-static inline int qlcnic_82xx_statistics(void)
+static inline int qlcnic_82xx_statistics(struct qlcnic_adapter *adapter)
 {
-        return ARRAY_SIZE(qlcnic_device_gstrings_stats) +
+        return ARRAY_SIZE(qlcnic_gstrings_stats) +
-               ARRAY_SIZE(qlcnic_83xx_mac_stats_strings);
+               ARRAY_SIZE(qlcnic_83xx_mac_stats_strings) +
+               QLCNIC_TX_STATS_LEN * adapter->drv_tx_rings;
 }
-static inline int qlcnic_83xx_statistics(void)
+static inline int qlcnic_83xx_statistics(struct qlcnic_adapter *adapter)
 {
-        return ARRAY_SIZE(qlcnic_83xx_tx_stats_strings) +
+        return ARRAY_SIZE(qlcnic_gstrings_stats) +
+               ARRAY_SIZE(qlcnic_83xx_tx_stats_strings) +
               ARRAY_SIZE(qlcnic_83xx_mac_stats_strings) +
-               ARRAY_SIZE(qlcnic_83xx_rx_stats_strings);
+               ARRAY_SIZE(qlcnic_83xx_rx_stats_strings) +
+               QLCNIC_TX_STATS_LEN * adapter->drv_tx_rings;
 }
 static int qlcnic_dev_statistics_len(struct qlcnic_adapter *adapter)
 {
-        if (qlcnic_82xx_check(adapter))
+        int len = -1;
-                return qlcnic_82xx_statistics();
-        else if (qlcnic_83xx_check(adapter))
+        if (qlcnic_82xx_check(adapter)) {
-                return qlcnic_83xx_statistics();
+                len = qlcnic_82xx_statistics(adapter);
-        else
+                if (adapter->flags & QLCNIC_ESWITCH_ENABLED)
-                return -1;
+                        len += ARRAY_SIZE(qlcnic_device_gstrings_stats);
+        } else if (qlcnic_83xx_check(adapter)) {
+                len = qlcnic_83xx_statistics(adapter);
+        }
+        return len;
 }
 #define QLCNIC_TX_INTR_NOT_CONFIGURED   0X78563412
@@ -920,18 +928,13 @@ static int qlcnic_eeprom_test(struct net_device *dev)
 static int qlcnic_get_sset_count(struct net_device *dev, int sset)
 {
-        int len;
        struct qlcnic_adapter *adapter = netdev_priv(dev);
        switch (sset) {
        case ETH_SS_TEST:
                return QLCNIC_TEST_LEN;
        case ETH_SS_STATS:
-                len = qlcnic_dev_statistics_len(adapter) + QLCNIC_STATS_LEN;
+                return qlcnic_dev_statistics_len(adapter);
-                if ((adapter->flags & QLCNIC_ESWITCH_ENABLED) ||
-                    qlcnic_83xx_check(adapter))
-                        return len;
-                return qlcnic_82xx_statistics();
        default:
                return -EOPNOTSUPP;
        }
@@ -1267,7 +1270,7 @@ static u64 *qlcnic_fill_stats(u64 *data, void *stats, int type)
        return data;
 }
-static void qlcnic_update_stats(struct qlcnic_adapter *adapter)
+void qlcnic_update_stats(struct qlcnic_adapter *adapter)
 {
        struct qlcnic_host_tx_ring *tx_ring;
        int ring;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
index e9c21e5d0ca9..c4262c23ed7c 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_init.c
@@ -134,6 +134,8 @@ void qlcnic_release_tx_buffers(struct qlcnic_adapter *adapter,
        struct qlcnic_skb_frag *buffrag;
        int i, j;
+        spin_lock(&tx_ring->tx_clean_lock);
        cmd_buf = tx_ring->cmd_buf_arr;
        for (i = 0; i < tx_ring->num_desc; i++) {
                buffrag = cmd_buf->frag_array;
@@ -157,6 +159,8 @@ void qlcnic_release_tx_buffers(struct qlcnic_adapter *adapter,
                }
                cmd_buf++;
        }
+        spin_unlock(&tx_ring->tx_clean_lock);
 }
 void qlcnic_free_sw_resources(struct qlcnic_adapter *adapter)
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index eda6c691d897..ad1531ae3aa8 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -689,6 +689,10 @@ void qlcnic_advert_link_change(struct qlcnic_adapter *adapter, int linkup)
                adapter->ahw->linkup = 0;
                netif_carrier_off(netdev);
        } else if (!adapter->ahw->linkup && linkup) {
+                /* Do not advertise Link up if the port is in loopback mode */
+                if (qlcnic_83xx_check(adapter) && adapter->ahw->lb_mode)
+                        return;
                netdev_info(netdev, "NIC Link is up\n");
                adapter->ahw->linkup = 1;
                netif_carrier_on(netdev);
@@ -778,7 +782,7 @@ static int qlcnic_process_cmd_ring(struct qlcnic_adapter *adapter,
        struct net_device *netdev = adapter->netdev;
        struct qlcnic_skb_frag *frag;
-        if (!spin_trylock(&adapter->tx_clean_lock))
+        if (!spin_trylock(&tx_ring->tx_clean_lock))
                return 1;
        sw_consumer = tx_ring->sw_consumer;
@@ -807,8 +811,9 @@ static int qlcnic_process_cmd_ring(struct qlcnic_adapter *adapter,
                        break;
        }
+        tx_ring->sw_consumer = sw_consumer;
        if (count && netif_running(netdev)) {
-                tx_ring->sw_consumer = sw_consumer;
                smp_mb();
                if (netif_tx_queue_stopped(tx_ring->txq) &&
                    netif_carrier_ok(netdev)) {
@@ -834,7 +839,8 @@ static int qlcnic_process_cmd_ring(struct qlcnic_adapter *adapter,
         */
        hw_consumer = le32_to_cpu(*(tx_ring->hw_consumer));
        done = (sw_consumer == hw_consumer);
-        spin_unlock(&adapter->tx_clean_lock);
+        spin_unlock(&tx_ring->tx_clean_lock);
        return done;
 }
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 2c8cac0c6a55..550791b8fbae 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -1756,7 +1756,6 @@ void __qlcnic_down(struct qlcnic_adapter *adapter, struct net_device *netdev)
        if (qlcnic_sriov_vf_check(adapter))
                qlcnic_sriov_cleanup_async_list(&adapter->ahw->sriov->bc);
        smp_mb();
-        spin_lock(&adapter->tx_clean_lock);
        netif_carrier_off(netdev);
        adapter->ahw->linkup = 0;
        netif_tx_disable(netdev);
@@ -1777,7 +1776,6 @@ void __qlcnic_down(struct qlcnic_adapter *adapter, struct net_device *netdev)
        for (ring = 0; ring < adapter->drv_tx_rings; ring++)
                qlcnic_release_tx_buffers(adapter, &adapter->tx_ring[ring]);
-        spin_unlock(&adapter->tx_clean_lock);
 }
 /* Usage: During suspend and firmware recovery module */
@@ -2172,6 +2170,7 @@ int qlcnic_alloc_tx_rings(struct qlcnic_adapter *adapter,
                }
                memset(cmd_buf_arr, 0, TX_BUFF_RINGSIZE(tx_ring));
                tx_ring->cmd_buf_arr = cmd_buf_arr;
+                spin_lock_init(&tx_ring->tx_clean_lock);
        }
        if (qlcnic_83xx_check(adapter) ||
@@ -2299,7 +2298,6 @@ qlcnic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        rwlock_init(&adapter->ahw->crb_lock);
        mutex_init(&adapter->ahw->mem_lock);
-        spin_lock_init(&adapter->tx_clean_lock);
        INIT_LIST_HEAD(&adapter->mac_list);
        qlcnic_register_dcb(adapter);
@@ -2782,6 +2780,9 @@ static struct net_device_stats *qlcnic_get_stats(struct net_device *netdev)
        struct qlcnic_adapter *adapter = netdev_priv(netdev);
        struct net_device_stats *stats = &netdev->stats;
+        if (test_bit(__QLCNIC_DEV_UP, &adapter->state))
+                qlcnic_update_stats(adapter);
        stats->rx_packets = adapter->stats.rx_pkts + adapter->stats.lro_pkts;
        stats->tx_packets = adapter->stats.xmitfinished;
        stats->rx_bytes = adapter->stats.rxbytes + adapter->stats.lrobytes;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
index 686f460b1502..024f8161d2fe 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_sriov_pf.c
@@ -75,7 +75,6 @@ static int qlcnic_sriov_pf_cal_res_limit(struct qlcnic_adapter *adapter,
        num_vfs = sriov->num_vfs;
        max = num_vfs + 1;
        info->bit_offsets = 0xffff;
-        info->max_tx_ques = res->num_tx_queues / max;
        info->max_rx_mcast_mac_filters = res->num_rx_mcast_mac_filters;
        num_vf_macs = QLCNIC_SRIOV_VF_MAX_MAC;
@@ -86,6 +85,7 @@ static int qlcnic_sriov_pf_cal_res_limit(struct qlcnic_adapter *adapter,
                info->max_tx_mac_filters = temp;
                info->min_tx_bw = 0;
                info->max_tx_bw = MAX_BW;
+                info->max_tx_ques = res->num_tx_queues - sriov->num_vfs;
        } else {
                id = qlcnic_sriov_func_to_index(adapter, func);
                if (id < 0)
@@ -95,6 +95,7 @@ static int qlcnic_sriov_pf_cal_res_limit(struct qlcnic_adapter *adapter,
                info->max_tx_bw = vp->max_tx_bw;
                info->max_rx_ucast_mac_filters = num_vf_macs;
                info->max_tx_mac_filters = num_vf_macs;
+                info->max_tx_ques = QLCNIC_SINGLE_RING;
        }
        info->max_rx_ip_addr = res->num_destip / max;
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index 449f506d2e8f..f705aeeba767 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -4765,6 +4765,8 @@ static int qlge_probe(struct pci_dev *pdev,
                            NETIF_F_RXCSUM;
        ndev->features = ndev->hw_features;
        ndev->vlan_features = ndev->hw_features;
+        /* vlan gets same features (except vlan filter) */
+        ndev->vlan_features &= ~NETIF_F_HW_VLAN_CTAG_FILTER;
        if (test_bit(QL_DMA64, &qdev->flags))
                ndev->features |= NETIF_F_HIGHDMA;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 8a7a23a84ac5..797b56a0efc4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -622,17 +622,15 @@ static int stmmac_init_ptp(struct stmmac_priv *priv)
        if (!(priv->dma_cap.time_stamp || priv->dma_cap.atime_stamp))
                return -EOPNOTSUPP;
-        if (netif_msg_hw(priv)) {
+        priv->adv_ts = 0;
-                if (priv->dma_cap.time_stamp) {
+        if (priv->dma_cap.atime_stamp && priv->extend_desc)
-                        pr_debug("IEEE 1588-2002 Time Stamp supported\n");
+                priv->adv_ts = 1;
-                        priv->adv_ts = 0;
-                }
+        if (netif_msg_hw(priv) && priv->dma_cap.time_stamp)
-                if (priv->dma_cap.atime_stamp && priv->extend_desc) {
+                pr_debug("IEEE 1588-2002 Time Stamp supported\n");
-                        pr_debug
-                            ("IEEE 1588-2008 Advanced Time Stamp supported\n");
+        if (netif_msg_hw(priv) && priv->adv_ts)
-                        priv->adv_ts = 1;
+                pr_debug("IEEE 1588-2008 Advanced Time Stamp supported\n");
-                }
-        }
        priv->hw->ptp = &stmmac_ptp;
        priv->hwts_tx_en = 0;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
index b8b0eeed0f92..7680581ebe12 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ptp.c
@@ -56,7 +56,7 @@ static int stmmac_adjust_freq(struct ptp_clock_info *ptp, s32 ppb)
        priv->hw->ptp->config_addend(priv->ioaddr, addend);
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->ptp_lock, flags);
        return 0;
 }
@@ -91,7 +91,7 @@ static int stmmac_adjust_time(struct ptp_clock_info *ptp, s64 delta)
        priv->hw->ptp->adjust_systime(priv->ioaddr, sec, nsec, neg_adj);
-        spin_unlock_irqrestore(&priv->lock, flags);
+        spin_unlock_irqrestore(&priv->ptp_lock, flags);
        return 0;
 }
diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
index 5120d9ce1dd4..5330fd298705 100644
--- a/drivers/net/ethernet/ti/cpsw.c
+++ b/drivers/net/ethernet/ti/cpsw.c
@@ -740,6 +740,8 @@ static void _cpsw_adjust_link(struct cpsw_slave *slave,
                /* set speed_in input in case RMII mode is used in 100Mbps */
                if (phy->speed == 100)
                        mac_control |= BIT(15);
+                else if (phy->speed == 10)
+                        mac_control |= BIT(18); /* In Band mode */
                *link = true;
        } else {
@@ -2106,7 +2108,7 @@ static int cpsw_probe(struct platform_device *pdev)
        while ((res = platform_get_resource(priv->pdev, IORESOURCE_IRQ, k))) {
                for (i = res->start; i <= res->end; i++) {
                        if (devm_request_irq(&pdev->dev, i, cpsw_interrupt, 0,
-                                             dev_name(priv->dev), priv)) {
+                                             dev_name(&pdev->dev), priv)) {
                                dev_err(priv->dev, "error attaching irq\n");
                                goto clean_ale_ret;
                        }
diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c
index 628b736e5ae7..0e9fb3301b11 100644
--- a/drivers/net/ethernet/tile/tilegx.c
+++ b/drivers/net/ethernet/tile/tilegx.c
@@ -2080,7 +2080,8 @@ static int tile_net_tx(struct sk_buff *skb, struct net_device *dev)
 }
 /* Return subqueue id on this core (one per core). */
-static u16 tile_net_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 tile_net_select_queue(struct net_device *dev, struct sk_buff *skb,
+                                 void *accel_priv)
 {
        return smp_processor_id();
 }
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index cce6c4bc556a..ef312bc6b865 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -1618,6 +1618,7 @@ static void rhine_reset_task(struct work_struct *work)
                goto out_unlock;
        napi_disable(&rp->napi);
+        netif_tx_disable(dev);
        spin_lock_bh(&rp->lock);
        /* clear all descriptors */
diff --git a/drivers/net/hamradio/hdlcdrv.c b/drivers/net/hamradio/hdlcdrv.c
index 3169252613fa..5d78c1d08abd 100644
--- a/drivers/net/hamradio/hdlcdrv.c
+++ b/drivers/net/hamradio/hdlcdrv.c
@@ -571,6 +571,8 @@ static int hdlcdrv_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
        case HDLCDRVCTL_CALIBRATE:
                if(!capable(CAP_SYS_RAWIO))
                        return -EPERM;
+                if (bi.data.calibrate > INT_MAX / s->par.bitrate)
+                        return -EINVAL;
                s->hdlctx.calibrate = bi.data.calibrate * s->par.bitrate / 16;
                return 0;
diff --git a/drivers/net/hamradio/yam.c b/drivers/net/hamradio/yam.c
index 1971411574db..61dd2447e1bb 100644
--- a/drivers/net/hamradio/yam.c
+++ b/drivers/net/hamradio/yam.c
@@ -1057,6 +1057,7 @@ static int yam_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                break;
        case SIOCYAMGCFG:
+                memset(&yi, 0, sizeof(yi));
                yi.cfg.mask = 0xffffffff;
                yi.cfg.iobase = yp->iobase;
                yi.cfg.irq = yp->irq;
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index f8135725bcf6..71baeb3ed905 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -261,9 +261,7 @@ int netvsc_recv_callback(struct hv_device *device_obj,
        struct sk_buff *skb;
        net = ((struct netvsc_device *)hv_get_drvdata(device_obj))->ndev;
-        if (!net) {
+        if (!net || net->reg_state != NETREG_REGISTERED) {
-                netdev_err(net, "got receive callback but net device"
-                        " not initialized yet\n");
                packet->status = NVSP_STAT_FAIL;
                return 0;
        }
@@ -435,19 +433,11 @@ static int netvsc_probe(struct hv_device *dev,
        SET_ETHTOOL_OPS(net, &ethtool_ops);
        SET_NETDEV_DEV(net, &dev->device);
-        ret = register_netdev(net);
-        if (ret != 0) {
-                pr_err("Unable to register netdev.\n");
-                free_netdev(net);
-                goto out;
-        }
        /* Notify the netvsc driver of the new device */
        device_info.ring_size = ring_size;
        ret = rndis_filter_device_add(dev, &device_info);
        if (ret != 0) {
                netdev_err(net, "unable to add netvsc device (ret %d)\n", ret);
-                unregister_netdev(net);
                free_netdev(net);
                hv_set_drvdata(dev, NULL);
                return ret;
@@ -456,7 +446,13 @@ static int netvsc_probe(struct hv_device *dev,
        netif_carrier_on(net);
-out:
+        ret = register_netdev(net);
+        if (ret != 0) {
+                pr_err("Unable to register netdev.\n");
+                rndis_filter_device_remove(dev);
+                free_netdev(net);
+        }
        return ret;
 }
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index acf93798dc67..bc8faaec33f5 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -299,7 +299,7 @@ netdev_tx_t macvlan_start_xmit(struct sk_buff *skb,
        if (vlan->fwd_priv) {
                skb->dev = vlan->lowerdev;
-                ret = dev_hard_start_xmit(skb, skb->dev, NULL, vlan->fwd_priv);
+                ret = dev_queue_xmit_accel(skb, vlan->fwd_priv);
        } else {
                ret = macvlan_queue_xmit(skb, dev);
        }
@@ -338,6 +338,8 @@ static const struct header_ops macvlan_hard_header_ops = {
        .cache_update   = eth_header_cache_update,
 };
+static struct rtnl_link_ops macvlan_link_ops;
 static int macvlan_open(struct net_device *dev)
 {
        struct macvlan_dev *vlan = netdev_priv(dev);
@@ -353,7 +355,8 @@ static int macvlan_open(struct net_device *dev)
                goto hash_add;
        }
-        if (lowerdev->features & NETIF_F_HW_L2FW_DOFFLOAD) {
+        if (lowerdev->features & NETIF_F_HW_L2FW_DOFFLOAD &&
+            dev->rtnl_link_ops == &macvlan_link_ops) {
                vlan->fwd_priv =
                      lowerdev->netdev_ops->ndo_dfwd_add_station(lowerdev, dev);
@@ -362,10 +365,8 @@ static int macvlan_open(struct net_device *dev)
                 */
                if (IS_ERR_OR_NULL(vlan->fwd_priv)) {
                        vlan->fwd_priv = NULL;
-                } else {
+                } else
-                        dev->features &= ~NETIF_F_LLTX;
                        return 0;
-                }
        }
        err = -EBUSY;
@@ -690,8 +691,18 @@ static netdev_features_t macvlan_fix_features(struct net_device *dev,
                                              netdev_features_t features)
 {
        struct macvlan_dev *vlan = netdev_priv(dev);
+        netdev_features_t mask;
+        features |= NETIF_F_ALL_FOR_ALL;
+        features &= (vlan->set_features | ~MACVLAN_FEATURES);
+        mask = features;
+        features = netdev_increment_features(vlan->lowerdev->features,
+                                             features,
+                                             mask);
+        features |= NETIF_F_LLTX;
-        return features & (vlan->set_features | ~MACVLAN_FEATURES);
+        return features;
 }
 static const struct ethtool_ops macvlan_ethtool_ops = {
@@ -1019,9 +1030,8 @@ static int macvlan_device_event(struct notifier_block *unused,
                break;
        case NETDEV_FEAT_CHANGE:
                list_for_each_entry(vlan, &port->vlans, list) {
-                        vlan->dev->features = dev->features & MACVLAN_FEATURES;
                        vlan->dev->gso_max_size = dev->gso_max_size;
-                        netdev_features_change(vlan->dev);
+                        netdev_update_features(vlan->dev);
                }
                break;
        case NETDEV_UNREGISTER:
diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
index 36c6994436b7..98434b84f041 100644
--- a/drivers/net/phy/phy.c
+++ b/drivers/net/phy/phy.c
@@ -565,10 +565,8 @@ int phy_start_interrupts(struct phy_device *phydev)
        int err = 0;
        atomic_set(&phydev->irq_disable, 0);
-        if (request_irq(phydev->irq, phy_interrupt,
+        if (request_irq(phydev->irq, phy_interrupt, 0, "phy_interrupt",
-                                IRQF_SHARED,
+                        phydev) < 0) {
-                                "phy_interrupt",
-                                phydev) < 0) {
                pr_warn("%s: Can't get IRQ %d (PHY)\n",
                        phydev->bus->name, phydev->irq);
                phydev->irq = PHY_POLL;
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 736050d6b451..b75ae5bde673 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -1647,7 +1647,8 @@ static netdev_tx_t team_xmit(struct sk_buff *skb, struct net_device *dev)
        return NETDEV_TX_OK;
 }
-static u16 team_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 team_select_queue(struct net_device *dev, struct sk_buff *skb,
+                             void *accel_priv)
 {
        /*
         * This helper function exists to help dev_pick_tx get the correct
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 7c8343a4f918..ecec8029c5e8 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -348,7 +348,8 @@ unlock:
 * different rxq no. here. If we could not get rxhash, then we would
 * hope the rxq no. may help here.
 */
-static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 tun_select_queue(struct net_device *dev, struct sk_buff *skb,
+                            void *accel_priv)
 {
        struct tun_struct *tun = netdev_priv(dev);
        struct tun_flow_entry *e;
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 85e4a01670f0..47b0f732b0b1 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -276,12 +276,12 @@ config USB_NET_CDC_MBIM
          module will be called cdc_mbim.
 config USB_NET_DM9601
-        tristate "Davicom DM9601 based USB 1.1 10/100 ethernet devices"
+        tristate "Davicom DM96xx based USB 10/100 ethernet devices"
        depends on USB_USBNET
        select CRC32
        help
-          This option adds support for Davicom DM9601 based USB 1.1
+          This option adds support for Davicom DM9601/DM9620/DM9621A
-          10/100 Ethernet adapters.
+          based USB 10/100 Ethernet adapters.
 config USB_NET_SR9700
        tristate "CoreChip-sz SR9700 based USB 1.1 10/100 ethernet devices"
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index c6867f926cff..e80219877730 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -1,5 +1,5 @@
 /*
- * Davicom DM9601 USB 1.1 10/100Mbps ethernet devices
+ * Davicom DM96xx USB 10/100Mbps ethernet devices
 *
 * Peter Korsgaard <jacmet@sunsite.dk>
 *
@@ -364,7 +364,12 @@ static int dm9601_bind(struct usbnet *dev, struct usb_interface *intf)
        dev->net->ethtool_ops = &dm9601_ethtool_ops;
        dev->net->hard_header_len += DM_TX_OVERHEAD;
        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
-        dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD;
+        /* dm9620/21a require room for 4 byte padding, even in dm9601
+         * mode, so we need +1 to be able to receive full size
+         * ethernet frames.
+         */
+        dev->rx_urb_size = dev->net->mtu + ETH_HLEN + DM_RX_OVERHEAD + 1;
        dev->mii.dev = dev->net;
        dev->mii.mdio_read = dm9601_mdio_read;
@@ -468,7 +473,7 @@ static int dm9601_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
                                       gfp_t flags)
 {
-        int len;
+        int len, pad;
        /* format:
           b1: packet length low
@@ -476,12 +481,23 @@ static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
           b3..n: packet data
        */
-        len = skb->len;
+        len = skb->len + DM_TX_OVERHEAD;
-        if (skb_headroom(skb) < DM_TX_OVERHEAD) {
+        /* workaround for dm962x errata with tx fifo getting out of
+         * sync if a USB bulk transfer retry happens right after a
+         * packet with odd / maxpacket length by adding up to 3 bytes
+         * padding.
+         */
+        while ((len & 1) || !(len % dev->maxpacket))
+                len++;
+        len -= DM_TX_OVERHEAD; /* hw header doesn't count as part of length */
+        pad = len - skb->len;
+        if (skb_headroom(skb) < DM_TX_OVERHEAD || skb_tailroom(skb) < pad) {
                struct sk_buff *skb2;
-                skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, 0, flags);
+                skb2 = skb_copy_expand(skb, DM_TX_OVERHEAD, pad, flags);
                dev_kfree_skb_any(skb);
                skb = skb2;
                if (!skb)
@@ -490,10 +506,10 @@ static struct sk_buff *dm9601_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
        __skb_push(skb, DM_TX_OVERHEAD);
-        /* usbnet adds padding if length is a multiple of packet size
+        if (pad) {
-           if so, adjust length value in header */
+                memset(skb->data + skb->len, 0, pad);
-        if ((skb->len % dev->maxpacket) == 0)
+                __skb_put(skb, pad);
-                len++;
+        }
        skb->data[0] = len;
        skb->data[1] = len >> 8;
@@ -543,7 +559,7 @@ static int dm9601_link_reset(struct usbnet *dev)
 }
 static const struct driver_info dm9601_info = {
-        .description    = "Davicom DM9601 USB Ethernet",
+        .description    = "Davicom DM96xx USB 10/100 Ethernet",
        .flags          = FLAG_ETHER | FLAG_LINK_INTR,
        .bind           = dm9601_bind,
        .rx_fixup       = dm9601_rx_fixup,
@@ -594,6 +610,22 @@ static const struct usb_device_id products[] = {
         USB_DEVICE(0x0a46, 0x9620),    /* DM9620 USB to Fast Ethernet Adapter */
         .driver_info = (unsigned long)&dm9601_info,
         },
+        {
+         USB_DEVICE(0x0a46, 0x9621),    /* DM9621A USB to Fast Ethernet Adapter */
+         .driver_info = (unsigned long)&dm9601_info,
+        },
+        {
+         USB_DEVICE(0x0a46, 0x9622),    /* DM9622 USB to Fast Ethernet Adapter */
+         .driver_info = (unsigned long)&dm9601_info,
+        },
+        {
+         USB_DEVICE(0x0a46, 0x0269),    /* DM962OA USB to Fast Ethernet Adapter */
+         .driver_info = (unsigned long)&dm9601_info,
+        },
+        {
+         USB_DEVICE(0x0a46, 0x1269),    /* DM9621A USB to Fast Ethernet Adapter */
+         .driver_info = (unsigned long)&dm9601_info,
+        },
        {},                     // END
 };
@@ -612,5 +644,5 @@ static struct usb_driver dm9601_driver = {
 module_usb_driver(dm9601_driver);
 MODULE_AUTHOR("Peter Korsgaard <jacmet@sunsite.dk>");
-MODULE_DESCRIPTION("Davicom DM9601 USB 1.1 ethernet devices");
+MODULE_DESCRIPTION("Davicom DM96xx USB 10/100 ethernet devices");
 MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 86292e6aaf49..1a482344b3f5 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -185,7 +185,6 @@ enum rx_ctrl_state{
 #define BM_REQUEST_TYPE (0xa1)
 #define B_NOTIFICATION  (0x20)
 #define W_VALUE         (0x0)
-#define W_INDEX         (0x2)
 #define W_LENGTH        (0x2)
 #define B_OVERRUN       (0x1<<6)
@@ -1487,6 +1486,7 @@ static void tiocmget_intr_callback(struct urb *urb)
        struct uart_icount *icount;
        struct hso_serial_state_notification *serial_state_notification;
        struct usb_device *usb;
+        int if_num;
        /* Sanity checks */
        if (!serial)
@@ -1495,15 +1495,24 @@ static void tiocmget_intr_callback(struct urb *urb)
                handle_usb_error(status, __func__, serial->parent);
                return;
        }
+        /* tiocmget is only supported on HSO_PORT_MODEM */
        tiocmget = serial->tiocmget;
        if (!tiocmget)
                return;
+        BUG_ON((serial->parent->port_spec & HSO_PORT_MASK) != HSO_PORT_MODEM);
        usb = serial->parent->usb;
+        if_num = serial->parent->interface->altsetting->desc.bInterfaceNumber;
+        /* wIndex should be the USB interface number of the port to which the
+         * notification applies, which should always be the Modem port.
+         */
        serial_state_notification = &tiocmget->serial_state_notification;
        if (serial_state_notification->bmRequestType != BM_REQUEST_TYPE ||
            serial_state_notification->bNotification != B_NOTIFICATION ||
            le16_to_cpu(serial_state_notification->wValue) != W_VALUE ||
-            le16_to_cpu(serial_state_notification->wIndex) != W_INDEX ||
+            le16_to_cpu(serial_state_notification->wIndex) != if_num ||
            le16_to_cpu(serial_state_notification->wLength) != W_LENGTH) {
                dev_warn(&usb->dev,
                         "hso received invalid serial state notification\n");
diff --git a/drivers/net/usb/mcs7830.c b/drivers/net/usb/mcs7830.c
index 03832d3780aa..f54637828574 100644
--- a/drivers/net/usb/mcs7830.c
+++ b/drivers/net/usb/mcs7830.c
@@ -117,7 +117,6 @@ enum {
 struct mcs7830_data {
        u8 multi_filter[8];
        u8 config;
-        u8 link_counter;
 };
 static const char driver_name[] = "MOSCHIP usb-ethernet driver";
@@ -561,26 +560,16 @@ static void mcs7830_status(struct usbnet *dev, struct urb *urb)
 {
        u8 *buf = urb->transfer_buffer;
        bool link, link_changed;
-        struct mcs7830_data *data = mcs7830_get_data(dev);
        if (urb->actual_length < 16)
                return;
-        link = !(buf[1] & 0x20);
+        link = !(buf[1] == 0x20);
        link_changed = netif_carrier_ok(dev->net) != link;
        if (link_changed) {
-                data->link_counter++;
+                usbnet_link_change(dev, link, 0);
-                /*
+                netdev_dbg(dev->net, "Link Status is: %d\n", link);
-                   track link state 20 times to guard against erroneous
+        }
-                   link state changes reported sometimes by the chip
-                 */
-                if (data->link_counter > 20) {
-                        data->link_counter = 0;
-                        usbnet_link_change(dev, link, 0);
-                        netdev_dbg(dev->net, "Link Status is: %d\n", link);
-                }
-        } else
-                data->link_counter = 0;
 }
 static const struct driver_info moschip_info = {
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 8494bb53ebdc..aba04f561760 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1245,7 +1245,7 @@ static int build_dma_sg(const struct sk_buff *skb, struct urb *urb)
                return -ENOMEM;
        urb->num_sgs = num_sgs;
-        sg_init_table(urb->sg, urb->num_sgs);
+        sg_init_table(urb->sg, urb->num_sgs + 1);
        sg_set_buf(&urb->sg[s++], skb->data, skb_headlen(skb));
        total_len += skb_headlen(skb);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index d208f8604981..5d776447d9c3 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -1797,16 +1797,17 @@ static int virtnet_restore(struct virtio_device *vdev)
        if (err)
                return err;
-        if (netif_running(vi->dev))
+        if (netif_running(vi->dev)) {
+                for (i = 0; i < vi->curr_queue_pairs; i++)
+                        if (!try_fill_recv(&vi->rq[i], GFP_KERNEL))
+                                schedule_delayed_work(&vi->refill, 0);
                for (i = 0; i < vi->max_queue_pairs; i++)
                        virtnet_napi_enable(&vi->rq[i]);
+        }
        netif_device_attach(vi->dev);
-        for (i = 0; i < vi->curr_queue_pairs; i++)
-                if (!try_fill_recv(&vi->rq[i], GFP_KERNEL))
-                        schedule_delayed_work(&vi->refill, 0);
        mutex_lock(&vi->config_lock);
        vi->config_enable = true;
        mutex_unlock(&vi->config_lock);
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 249e01c5600c..ed384fee76ac 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2440,7 +2440,8 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
                /* update header length based on lower device */
                dev->hard_header_len = lowerdev->hard_header_len +
                                       (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
-        }
+        } else if (use_ipv6)
+                vxlan->flags |= VXLAN_F_IPV6;
        if (data[IFLA_VXLAN_TOS])
                vxlan->tos  = nla_get_u8(data[IFLA_VXLAN_TOS]);
diff --git a/drivers/net/wireless/ath/ath9k/ar9002_mac.c b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
index 8d78253c26ce..a366d6b4626f 100644
--- a/drivers/net/wireless/ath/ath9k/ar9002_mac.c
+++ b/drivers/net/wireless/ath/ath9k/ar9002_mac.c
@@ -76,9 +76,16 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                                mask2 |= ATH9K_INT_CST;
                        if (isr2 & AR_ISR_S2_TSFOOR)
                                mask2 |= ATH9K_INT_TSFOOR;
+                        if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                                REG_WRITE(ah, AR_ISR_S2, isr2);
+                                isr &= ~AR_ISR_BCNMISC;
+                        }
                }
-                isr = REG_READ(ah, AR_ISR_RAC);
+                if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)
+                        isr = REG_READ(ah, AR_ISR_RAC);
                if (isr == 0xffffffff) {
                        *masked = 0;
                        return false;
@@ -97,11 +104,23 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                        *masked |= ATH9K_INT_TX;
-                        s0_s = REG_READ(ah, AR_ISR_S0_S);
+                        if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) {
+                                s0_s = REG_READ(ah, AR_ISR_S0_S);
+                                s1_s = REG_READ(ah, AR_ISR_S1_S);
+                        } else {
+                                s0_s = REG_READ(ah, AR_ISR_S0);
+                                REG_WRITE(ah, AR_ISR_S0, s0_s);
+                                s1_s = REG_READ(ah, AR_ISR_S1);
+                                REG_WRITE(ah, AR_ISR_S1, s1_s);
+                                isr &= ~(AR_ISR_TXOK |
+                                         AR_ISR_TXDESC |
+                                         AR_ISR_TXERR |
+                                         AR_ISR_TXEOL);
+                        }
                        ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXOK);
                        ah->intr_txqs |= MS(s0_s, AR_ISR_S0_QCU_TXDESC);
-                        s1_s = REG_READ(ah, AR_ISR_S1_S);
                        ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXERR);
                        ah->intr_txqs |= MS(s1_s, AR_ISR_S1_QCU_TXEOL);
                }
@@ -114,13 +133,15 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                *masked |= mask2;
        }
-        if (AR_SREV_9100(ah))
+        if (!AR_SREV_9100(ah) && (isr & AR_ISR_GENTMR)) {
-                return true;
-        if (isr & AR_ISR_GENTMR) {
                u32 s5_s;
-                s5_s = REG_READ(ah, AR_ISR_S5_S);
+                if (pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED) {
+                        s5_s = REG_READ(ah, AR_ISR_S5_S);
+                } else {
+                        s5_s = REG_READ(ah, AR_ISR_S5);
+                }
                ah->intr_gen_timer_trigger =
                                MS(s5_s, AR_ISR_S5_GENTIMER_TRIG);
@@ -133,8 +154,21 @@ static bool ar9002_hw_get_isr(struct ath_hw *ah, enum ath9k_int *masked)
                if ((s5_s & AR_ISR_S5_TIM_TIMER) &&
                    !(pCap->hw_caps & ATH9K_HW_CAP_AUTOSLEEP))
                        *masked |= ATH9K_INT_TIM_TIMER;
+                if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                        REG_WRITE(ah, AR_ISR_S5, s5_s);
+                        isr &= ~AR_ISR_GENTMR;
+                }
        }
+        if (!(pCap->hw_caps & ATH9K_HW_CAP_RAC_SUPPORTED)) {
+                REG_WRITE(ah, AR_ISR, isr);
+                REG_READ(ah, AR_ISR);
+        }
+        if (AR_SREV_9100(ah))
+                return true;
        if (sync_cause) {
                ath9k_debug_sync_cause(common, sync_cause);
                fatal_int =
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
index 9a2657fdd9cc..608d739d1378 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c
@@ -127,21 +127,26 @@ static void ath9k_htc_bssid_iter(void *data, u8 *mac, struct ieee80211_vif *vif)
        struct ath9k_vif_iter_data *iter_data = data;
        int i;
-        for (i = 0; i < ETH_ALEN; i++)
+        if (iter_data->hw_macaddr != NULL) {
-                iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
+                for (i = 0; i < ETH_ALEN; i++)
+                        iter_data->mask[i] &= ~(iter_data->hw_macaddr[i] ^ mac[i]);
+        } else {
+                iter_data->hw_macaddr = mac;
+        }
 }
-static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
+static void ath9k_htc_set_mac_bssid_mask(struct ath9k_htc_priv *priv,
                                     struct ieee80211_vif *vif)
 {
        struct ath_common *common = ath9k_hw_common(priv->ah);
        struct ath9k_vif_iter_data iter_data;
        /*
-         * Use the hardware MAC address as reference, the hardware uses it
+         * Pick the MAC address of the first interface as the new hardware
-         * together with the BSSID mask when matching addresses.
+         * MAC address. The hardware will use it together with the BSSID mask
+         * when matching addresses.
         */
-        iter_data.hw_macaddr = common->macaddr;
+        iter_data.hw_macaddr = NULL;
        memset(&iter_data.mask, 0xff, ETH_ALEN);
        if (vif)
@@ -153,6 +158,10 @@ static void ath9k_htc_set_bssid_mask(struct ath9k_htc_priv *priv,
                ath9k_htc_bssid_iter, &iter_data);
        memcpy(common->bssidmask, iter_data.mask, ETH_ALEN);
+        if (iter_data.hw_macaddr)
+                memcpy(common->macaddr, iter_data.hw_macaddr, ETH_ALEN);
        ath_hw_setbssidmask(common);
 }
@@ -1063,7 +1072,7 @@ static int ath9k_htc_add_interface(struct ieee80211_hw *hw,
                goto out;
        }
-        ath9k_htc_set_bssid_mask(priv, vif);
+        ath9k_htc_set_mac_bssid_mask(priv, vif);
        priv->vif_slot |= (1 << avp->index);
        priv->nvifs++;
@@ -1128,7 +1137,7 @@ static void ath9k_htc_remove_interface(struct ieee80211_hw *hw,
        ath9k_htc_set_opmode(priv);
-        ath9k_htc_set_bssid_mask(priv, vif);
+        ath9k_htc_set_mac_bssid_mask(priv, vif);
        /*
         * Stop ANI only if there are no associated station interfaces.
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 74f452c7b166..21aa09e0e825 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -965,8 +965,9 @@ void ath9k_calculate_iter_data(struct ieee80211_hw *hw,
        struct ath_common *common = ath9k_hw_common(ah);
        /*
-         * Use the hardware MAC address as reference, the hardware uses it
+         * Pick the MAC address of the first interface as the new hardware
-         * together with the BSSID mask when matching addresses.
+         * MAC address. The hardware will use it together with the BSSID mask
+         * when matching addresses.
         */
        memset(iter_data, 0, sizeof(*iter_data));
        memset(&iter_data->mask, 0xff, ETH_ALEN);
diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
index 86605027c41d..e6272546395a 100644
--- a/drivers/net/wireless/iwlwifi/pcie/drv.c
+++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
@@ -357,21 +357,27 @@ static DEFINE_PCI_DEVICE_TABLE(iwl_hw_card_ids) = {
        {IWL_PCI_DEVICE(0x095B, 0x5310, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5302, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5210, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095B, 0x5012, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5012, iwl7265_2ac_cfg)},
-        {IWL_PCI_DEVICE(0x095B, 0x500A, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x500A, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5410, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5400, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x1010, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5000, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5200, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5002, iwl7265_n_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5202, iwl7265_n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9010, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9110, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9210, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9510, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x9310, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x9410, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5020, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x502A, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5420, iwl7265_2n_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5090, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5190, iwl7265_2ac_cfg)},
+        {IWL_PCI_DEVICE(0x095A, 0x5590, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095B, 0x5290, iwl7265_2ac_cfg)},
        {IWL_PCI_DEVICE(0x095A, 0x5490, iwl7265_2ac_cfg)},
 #endif /* CONFIG_IWLMVM */
diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c
index c72438bb2faf..a1b32ee9594a 100644
--- a/drivers/net/wireless/mac80211_hwsim.c
+++ b/drivers/net/wireless/mac80211_hwsim.c
@@ -2011,7 +2011,7 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
           (hwsim_flags & HWSIM_TX_STAT_ACK)) {
                if (skb->len >= 16) {
                        hdr = (struct ieee80211_hdr *) skb->data;
-                        mac80211_hwsim_monitor_ack(txi->rate_driver_data[0],
+                        mac80211_hwsim_monitor_ack(data2->channel,
                                                   hdr->addr2);
                }
                txi->flags |= IEEE80211_TX_STAT_ACK;
diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c
index 78e8a6666cc6..8bb8988c435c 100644
--- a/drivers/net/wireless/mwifiex/main.c
+++ b/drivers/net/wireless/mwifiex/main.c
@@ -746,7 +746,8 @@ static struct net_device_stats *mwifiex_get_stats(struct net_device *dev)
 }
 static u16
-mwifiex_netdev_select_wmm_queue(struct net_device *dev, struct sk_buff *skb)
+mwifiex_netdev_select_wmm_queue(struct net_device *dev, struct sk_buff *skb,
+                                void *accel_priv)
 {
        skb->priority = cfg80211_classify8021d(skb);
        return mwifiex_1d_to_wmm_queue[skb->priority];
diff --git a/drivers/net/wireless/rtlwifi/pci.c b/drivers/net/wireless/rtlwifi/pci.c
index 0f494444bcd1..5a53195d016b 100644
--- a/drivers/net/wireless/rtlwifi/pci.c
+++ b/drivers/net/wireless/rtlwifi/pci.c
@@ -740,6 +740,8 @@ static void _rtl_pci_rx_interrupt(struct ieee80211_hw *hw)
        };
        int index = rtlpci->rx_ring[rx_queue_idx].idx;
+        if (rtlpci->driver_is_goingto_unload)
+                return;
        /*RX NORMAL PKT */
        while (count--) {
                /*rx descriptor */
@@ -1636,6 +1638,7 @@ static void rtl_pci_stop(struct ieee80211_hw *hw)
         */
        set_hal_stop(rtlhal);
+        rtlpci->driver_is_goingto_unload = true;
        rtlpriv->cfg->ops->disable_interrupt(hw);
        cancel_work_sync(&rtlpriv->works.lps_change_work);
@@ -1653,7 +1656,6 @@ static void rtl_pci_stop(struct ieee80211_hw *hw)
        ppsc->rfchange_inprogress = true;
        spin_unlock_irqrestore(&rtlpriv->locks.rf_ps_lock, flags);
-        rtlpci->driver_is_goingto_unload = true;
        rtlpriv->cfg->ops->hw_disable(hw);
        /* some things are not needed if firmware not available */
        if (!rtlpriv->max_fw_size)
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 08ae01b41c83..c47794b9d42f 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -101,6 +101,13 @@ struct xenvif_rx_meta {
 #define MAX_PENDING_REQS 256
+/* It's possible for an skb to have a maximal number of frags
+ * but still be less than MAX_BUFFER_OFFSET in size. Thus the
+ * worst-case number of copy operations is MAX_SKB_FRAGS per
+ * ring slot.
+ */
+#define MAX_GRANT_COPY_OPS (MAX_SKB_FRAGS * XEN_NETIF_RX_RING_SIZE)
 struct xenvif {
        /* Unique identifier for this interface. */
        domid_t          domid;
@@ -143,13 +150,13 @@ struct xenvif {
         */
        RING_IDX rx_req_cons_peek;
-        /* Given MAX_BUFFER_OFFSET of 4096 the worst case is that each
+        /* This array is allocated seperately as it is large */
-         * head/fragment page uses 2 copy operations because it
+        struct gnttab_copy *grant_copy_op;
-         * straddles two buffers in the frontend.
-         */
-        struct gnttab_copy grant_copy_op[2*XEN_NETIF_RX_RING_SIZE];
-        struct xenvif_rx_meta meta[2*XEN_NETIF_RX_RING_SIZE];
+        /* We create one meta structure per ring request we consume, so
+         * the maximum number is the same as the ring size.
+         */
+        struct xenvif_rx_meta meta[XEN_NETIF_RX_RING_SIZE];
        u8               fe_dev_addr[6];
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index 870f1fa58370..fff8cddfed81 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -34,6 +34,7 @@
 #include <linux/ethtool.h>
 #include <linux/rtnetlink.h>
 #include <linux/if_vlan.h>
+#include <linux/vmalloc.h>
 #include <xen/events.h>
 #include <asm/xen/hypercall.h>
@@ -307,6 +308,15 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
        SET_NETDEV_DEV(dev, parent);
        vif = netdev_priv(dev);
+        vif->grant_copy_op = vmalloc(sizeof(struct gnttab_copy) *
+                                     MAX_GRANT_COPY_OPS);
+        if (vif->grant_copy_op == NULL) {
+                pr_warn("Could not allocate grant copy space for %s\n", name);
+                free_netdev(dev);
+                return ERR_PTR(-ENOMEM);
+        }
        vif->domid  = domid;
        vif->handle = handle;
        vif->can_sg = 1;
@@ -487,6 +497,7 @@ void xenvif_free(struct xenvif *vif)
        unregister_netdev(vif->dev);
+        vfree(vif->grant_copy_op);
        free_netdev(vif->dev);
        module_put(THIS_MODULE);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index 27bbe58dcbe7..78425554a537 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -608,7 +608,7 @@ void xenvif_rx_action(struct xenvif *vif)
        if (!npo.copy_prod)
                return;
-        BUG_ON(npo.copy_prod > ARRAY_SIZE(vif->grant_copy_op));
+        BUG_ON(npo.copy_prod > MAX_GRANT_COPY_OPS);
        gnttab_batch_copy(vif->grant_copy_op, npo.copy_prod);
        while ((skb = __skb_dequeue(&rxq)) != NULL) {
@@ -1209,8 +1209,10 @@ static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
                        goto out;
                if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct tcphdr, check)))
+                                          offsetof(struct tcphdr, check))) {
+                        err = -EPROTO;
                        goto out;
+                }
                if (recalculate_partial_csum)
                        tcp_hdr(skb)->check =
@@ -1227,8 +1229,10 @@ static int checksum_setup_ip(struct xenvif *vif, struct sk_buff *skb,
                        goto out;
                if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct udphdr, check)))
+                                          offsetof(struct udphdr, check))) {
+                        err = -EPROTO;
                        goto out;
+                }
                if (recalculate_partial_csum)
                        udp_hdr(skb)->check =
@@ -1350,8 +1354,10 @@ static int checksum_setup_ipv6(struct xenvif *vif, struct sk_buff *skb,
                        goto out;
                if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct tcphdr, check)))
+                                          offsetof(struct tcphdr, check))) {
+                        err = -EPROTO;
                        goto out;
+                }
                if (recalculate_partial_csum)
                        tcp_hdr(skb)->check =
@@ -1368,8 +1374,10 @@ static int checksum_setup_ipv6(struct xenvif *vif, struct sk_buff *skb,
                        goto out;
                if (!skb_partial_csum_set(skb, off,
-                                          offsetof(struct udphdr, check)))
+                                          offsetof(struct udphdr, check))) {
+                        err = -EPROTO;
                        goto out;
+                }
                if (recalculate_partial_csum)
                        udp_hdr(skb)->check =
diff --git a/drivers/of/Kconfig b/drivers/of/Kconfig
index de6f8990246f..c6973f101a3e 100644
--- a/drivers/of/Kconfig
+++ b/drivers/of/Kconfig
@@ -20,7 +20,7 @@ config OF_SELFTEST
        depends on OF_IRQ
        help
          This option builds in test cases for the device tree infrastructure
-          that are executed one at boot time, and the results dumped to the
+          that are executed once at boot time, and the results dumped to the
          console.
          If unsure, say N here, but this option is safe to enable.
diff --git a/drivers/of/address.c b/drivers/of/address.c
index 4b9317bdb81c..d3dd41c840f1 100644
--- a/drivers/of/address.c
+++ b/drivers/of/address.c
@@ -69,14 +69,6 @@ static u64 of_bus_default_map(__be32 *addr, const __be32 *range,
                 (unsigned long long)cp, (unsigned long long)s,
                 (unsigned long long)da);
-        /*
-         * If the number of address cells is larger than 2 we assume the
-         * mapping doesn't specify a physical address. Rather, the address
-         * specifies an identifier that must match exactly.
-         */
-        if (na > 2 && memcmp(range, addr, na * 4) != 0)
-                return OF_BAD_ADDR;
        if (da < cp || da >= (cp + s))
                return OF_BAD_ADDR;
        return da - cp;
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 2fa024b97c43..758b4f8b30b7 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -922,8 +922,16 @@ void __init unflatten_device_tree(void)
 */
 void __init unflatten_and_copy_device_tree(void)
 {
-        int size = __be32_to_cpu(initial_boot_params->totalsize);
+        int size;
-        void *dt = early_init_dt_alloc_memory_arch(size,
+        void *dt;
+        if (!initial_boot_params) {
+                pr_warn("No valid device tree found, continuing without\n");
+                return;
+        }
+        size = __be32_to_cpu(initial_boot_params->totalsize);
+        dt = early_init_dt_alloc_memory_arch(size,
                __alignof__(struct boot_param_header));
        if (dt) {
diff --git a/drivers/of/irq.c b/drivers/of/irq.c
index 786b0b47fae4..27212402c532 100644
--- a/drivers/of/irq.c
+++ b/drivers/of/irq.c
@@ -165,7 +165,6 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq)
                if (of_get_property(ipar, "interrupt-controller", NULL) !=
                                NULL) {
                        pr_debug(" -> got it !\n");
-                        of_node_put(old);
                        return 0;
                }
@@ -250,8 +249,7 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq)
                 * Successfully parsed an interrrupt-map translation; copy new
                 * interrupt specifier into the out_irq structure
                 */
-                of_node_put(out_irq->np);
+                out_irq->np = newpar;
-                out_irq->np = of_node_get(newpar);
                match_array = imap - newaddrsize - newintsize;
                for (i = 0; i < newintsize; i++)
@@ -268,7 +266,6 @@ int of_irq_parse_raw(const __be32 *addr, struct of_phandle_args *out_irq)
        }
 fail:
        of_node_put(ipar);
-        of_node_put(out_irq->np);
        of_node_put(newpar);
        return -EINVAL;
diff --git a/drivers/parport/parport_mfc3.c b/drivers/parport/parport_mfc3.c
index 7578d79b3688..2f650f68af14 100644
--- a/drivers/parport/parport_mfc3.c
+++ b/drivers/parport/parport_mfc3.c
@@ -300,7 +300,7 @@ static int __init parport_mfc3_init(void)
                if (!request_mem_region(piabase, sizeof(struct pia), "PIA"))
                        continue;
-                pp = (struct pia *)ZTWO_VADDR(piabase);
+                pp = ZTWO_VADDR(piabase);
                pp->crb = 0;
                pp->pddrb = 255; /* all data pins output */
                pp->crb = PIA_DDR|32|8;
diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
index 963761526229..76ee7750bc5e 100644
--- a/drivers/parport/parport_pc.c
+++ b/drivers/parport/parport_pc.c
@@ -2600,8 +2600,6 @@ enum parport_pc_pci_cards {
        syba_2p_epp,
        syba_1p_ecp,
        titan_010l,
-        titan_1284p1,
-        titan_1284p2,
        avlab_1p,
        avlab_2p,
        oxsemi_952,
@@ -2660,8 +2658,6 @@ static struct parport_pc_pci {
        /* syba_2p_epp AP138B */        { 2, { { 0, 0x078 }, { 0, 0x178 }, } },
        /* syba_1p_ecp W83787 */        { 1, { { 0, 0x078 }, } },
        /* titan_010l */                { 1, { { 3, -1 }, } },
-        /* titan_1284p1 */              { 1, { { 0, 1 }, } },
-        /* titan_1284p2 */              { 2, { { 0, 1 }, { 2, 3 }, } },
        /* avlab_1p             */      { 1, { { 0, 1}, } },
        /* avlab_2p             */      { 2, { { 0, 1}, { 2, 3 },} },
        /* The Oxford Semi cards are unusual: 954 doesn't support ECP,
@@ -2677,8 +2673,8 @@ static struct parport_pc_pci {
        /* netmos_9705 */               { 1, { { 0, -1 }, } },
        /* netmos_9715 */               { 2, { { 0, 1 }, { 2, 3 },} },
        /* netmos_9755 */               { 2, { { 0, 1 }, { 2, 3 },} },
-        /* netmos_9805 */               { 1, { { 0, -1 }, } },
+        /* netmos_9805 */               { 1, { { 0, 1 }, } },
-        /* netmos_9815 */               { 2, { { 0, -1 }, { 2, -1 }, } },
+        /* netmos_9815 */               { 2, { { 0, 1 }, { 2, 3 }, } },
        /* netmos_9901 */               { 1, { { 0, -1 }, } },
        /* netmos_9865 */               { 1, { { 0, -1 }, } },
        /* quatech_sppxp100 */          { 1, { { 0, 1 }, } },
@@ -2722,8 +2718,6 @@ static const struct pci_device_id parport_pc_pci_tbl[] = {
          PCI_ANY_ID, PCI_ANY_ID, 0, 0, syba_1p_ecp },
        { PCI_VENDOR_ID_TITAN, PCI_DEVICE_ID_TITAN_010L,
          PCI_ANY_ID, PCI_ANY_ID, 0, 0, titan_010l },
-        { 0x9710, 0x9805, 0x1000, 0x0010, 0, 0, titan_1284p1 },
-        { 0x9710, 0x9815, 0x1000, 0x0020, 0, 0, titan_1284p2 },
        /* PCI_VENDOR_ID_AVLAB/Intek21 has another bunch of cards ...*/
        /* AFAVLAB_TK9902 */
        { 0x14db, 0x2120, PCI_ANY_ID, PCI_ANY_ID, 0, 0, avlab_1p},
@@ -2827,16 +2821,12 @@ static int parport_pc_pci_probe(struct pci_dev *dev,
                if (irq == IRQ_NONE) {
                        printk(KERN_DEBUG
        "PCI parallel port detected: %04x:%04x, I/O at %#lx(%#lx)\n",
-                                parport_pc_pci_tbl[i + last_sio].vendor,
+                                id->vendor, id->device, io_lo, io_hi);
-                                parport_pc_pci_tbl[i + last_sio].device,
-                                io_lo, io_hi);
                        irq = PARPORT_IRQ_NONE;
                } else {
                        printk(KERN_DEBUG
        "PCI parallel port detected: %04x:%04x, I/O at %#lx(%#lx), IRQ %d\n",
-                                parport_pc_pci_tbl[i + last_sio].vendor,
+                                id->vendor, id->device, io_lo, io_hi, irq);
-                                parport_pc_pci_tbl[i + last_sio].device,
-                                io_lo, io_hi, irq);
                }
                data->ports[count] =
                        parport_pc_probe_port(io_lo, io_hi, irq,
@@ -2866,8 +2856,6 @@ static void parport_pc_pci_remove(struct pci_dev *dev)
        struct pci_parport_data *data = pci_get_drvdata(dev);
        int i;
-        pci_set_drvdata(dev, NULL);
        if (data) {
                for (i = data->num - 1; i >= 0; i--)
                        parport_pc_unregister_port(data->ports[i]);
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 1cf605f67673..e86439283a5d 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -279,7 +279,9 @@ static acpi_status register_slot(acpi_handle handle, u32 lvl, void *data,
        status = acpi_evaluate_integer(handle, "_ADR", NULL, &adr);
        if (ACPI_FAILURE(status)) {
-                acpi_handle_warn(handle, "can't evaluate _ADR (%#x)\n", status);
+                if (status != AE_NOT_FOUND)
+                        acpi_handle_warn(handle,
+                                "can't evaluate _ADR (%#x)\n", status);
                return AE_OK;
        }
@@ -643,6 +645,24 @@ static void disable_slot(struct acpiphp_slot *slot)
        slot->flags &= (~SLOT_ENABLED);
 }
+static bool acpiphp_no_hotplug(acpi_handle handle)
+{
+        struct acpi_device *adev = NULL;
+        acpi_bus_get_device(handle, &adev);
+        return adev && adev->flags.no_hotplug;
+}
+static bool slot_no_hotplug(struct acpiphp_slot *slot)
+{
+        struct acpiphp_func *func;
+        list_for_each_entry(func, &slot->funcs, sibling)
+                if (acpiphp_no_hotplug(func_to_handle(func)))
+                        return true;
+        return false;
+}
 /**
 * get_slot_status - get ACPI slot status
@@ -701,7 +721,8 @@ static void trim_stale_devices(struct pci_dev *dev)
                unsigned long long sta;
                status = acpi_evaluate_integer(handle, "_STA", NULL, &sta);
-                alive = ACPI_SUCCESS(status) && sta == ACPI_STA_ALL;
+                alive = (ACPI_SUCCESS(status) && sta == ACPI_STA_ALL)
+                        || acpiphp_no_hotplug(handle);
        }
        if (!alive) {
                u32 v;
@@ -741,8 +762,9 @@ static void acpiphp_check_bridge(struct acpiphp_bridge *bridge)
                struct pci_dev *dev, *tmp;
                mutex_lock(&slot->crit_sect);
-                /* wake up all functions */
+                if (slot_no_hotplug(slot)) {
-                if (get_slot_status(slot) == ACPI_STA_ALL) {
+                        ; /* do nothing */
+                } else if (get_slot_status(slot) == ACPI_STA_ALL) {
                        /* remove stale devices if any */
                        list_for_each_entry_safe(dev, tmp, &bus->devices,
                                                 bus_list)
diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c
index 577074efbe62..f7ebdba14bde 100644
--- a/drivers/pci/pci-acpi.c
+++ b/drivers/pci/pci-acpi.c
@@ -330,29 +330,32 @@ static int acpi_pci_find_device(struct device *dev, acpi_handle *handle)
 static void pci_acpi_setup(struct device *dev)
 {
        struct pci_dev *pci_dev = to_pci_dev(dev);
-        acpi_handle handle = ACPI_HANDLE(dev);
+        struct acpi_device *adev = ACPI_COMPANION(dev);
-        struct acpi_device *adev;
-        if (acpi_bus_get_device(handle, &adev) || !adev->wakeup.flags.valid)
+        if (!adev)
+                return;
+        pci_acpi_add_pm_notifier(adev, pci_dev);
+        if (!adev->wakeup.flags.valid)
                return;
        device_set_wakeup_capable(dev, true);
        acpi_pci_sleep_wake(pci_dev, false);
-        pci_acpi_add_pm_notifier(adev, pci_dev);
        if (adev->wakeup.flags.run_wake)
                device_set_run_wake(dev, true);
 }
 static void pci_acpi_cleanup(struct device *dev)
 {
-        acpi_handle handle = ACPI_HANDLE(dev);
+        struct acpi_device *adev = ACPI_COMPANION(dev);
-        struct acpi_device *adev;
+        if (!adev)
+                return;
-        if (!acpi_bus_get_device(handle, &adev) && adev->wakeup.flags.valid) {
+        pci_acpi_remove_pm_notifier(adev);
+        if (adev->wakeup.flags.valid) {
                device_set_wakeup_capable(dev, false);
                device_set_run_wake(dev, false);
-                pci_acpi_remove_pm_notifier(adev);
        }
 }
diff --git a/drivers/pcmcia/bfin_cf_pcmcia.c b/drivers/pcmcia/bfin_cf_pcmcia.c
index ed3b522601b3..971991bab975 100644
--- a/drivers/pcmcia/bfin_cf_pcmcia.c
+++ b/drivers/pcmcia/bfin_cf_pcmcia.c
@@ -303,7 +303,7 @@ static int bfin_cf_remove(struct platform_device *pdev)
 static struct platform_driver bfin_cf_driver = {
        .driver = {
-                   .name = (char *)driver_name,
+                   .name = driver_name,
                   .owner = THIS_MODULE,
                   },
        .probe = bfin_cf_probe,
diff --git a/drivers/pcmcia/electra_cf.c b/drivers/pcmcia/electra_cf.c
index 1b206eac5f93..5ea64d0f61ab 100644
--- a/drivers/pcmcia/electra_cf.c
+++ b/drivers/pcmcia/electra_cf.c
@@ -359,7 +359,7 @@ MODULE_DEVICE_TABLE(of, electra_cf_match);
 static struct platform_driver electra_cf_driver = {
        .driver = {
-                .name = (char *)driver_name,
+                .name = driver_name,
                .owner = THIS_MODULE,
                .of_match_table = electra_cf_match,
        },
diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig
index 330ef2d06567..d0611b84d7f7 100644
--- a/drivers/phy/Kconfig
+++ b/drivers/phy/Kconfig
@@ -21,6 +21,12 @@ config PHY_EXYNOS_MIPI_VIDEO
          Support for MIPI CSI-2 and MIPI DSI DPHY found on Samsung S5P
          and EXYNOS SoCs.
+config PHY_MVEBU_SATA
+        def_bool y
+        depends on ARCH_KIRKWOOD || ARCH_DOVE
+        depends on OF
+        select GENERIC_PHY
 config OMAP_USB2
        tristate "OMAP USB2 PHY Driver"
        depends on ARCH_OMAP2PLUS
diff --git a/drivers/phy/Makefile b/drivers/phy/Makefile
index d0caae9cfb83..4e4adc96f753 100644
--- a/drivers/phy/Makefile
+++ b/drivers/phy/Makefile
@@ -5,5 +5,6 @@
 obj-$(CONFIG_GENERIC_PHY)               += phy-core.o
 obj-$(CONFIG_PHY_EXYNOS_DP_VIDEO)       += phy-exynos-dp-video.o
 obj-$(CONFIG_PHY_EXYNOS_MIPI_VIDEO)     += phy-exynos-mipi-video.o
+obj-$(CONFIG_PHY_MVEBU_SATA)            += phy-mvebu-sata.o
 obj-$(CONFIG_OMAP_USB2)                 += phy-omap-usb2.o
 obj-$(CONFIG_TWL4030_USB)               += phy-twl4030-usb.o
diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c
index 58e0e9739028..645c867c1257 100644
--- a/drivers/phy/phy-core.c
+++ b/drivers/phy/phy-core.c
@@ -94,19 +94,31 @@ static struct phy_provider *of_phy_provider_lookup(struct device_node *node)
 int phy_pm_runtime_get(struct phy *phy)
 {
+        int ret;
        if (!pm_runtime_enabled(&phy->dev))
                return -ENOTSUPP;
-        return pm_runtime_get(&phy->dev);
+        ret = pm_runtime_get(&phy->dev);
+        if (ret < 0 && ret != -EINPROGRESS)
+                pm_runtime_put_noidle(&phy->dev);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(phy_pm_runtime_get);
 int phy_pm_runtime_get_sync(struct phy *phy)
 {
+        int ret;
        if (!pm_runtime_enabled(&phy->dev))
                return -ENOTSUPP;
-        return pm_runtime_get_sync(&phy->dev);
+        ret = pm_runtime_get_sync(&phy->dev);
+        if (ret < 0)
+                pm_runtime_put_sync(&phy->dev);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(phy_pm_runtime_get_sync);
@@ -155,13 +167,14 @@ int phy_init(struct phy *phy)
                return ret;
        mutex_lock(&phy->mutex);
-        if (phy->init_count++ == 0 && phy->ops->init) {
+        if (phy->init_count == 0 && phy->ops->init) {
                ret = phy->ops->init(phy);
                if (ret < 0) {
                        dev_err(&phy->dev, "phy init failed --> %d\n", ret);
                        goto out;
                }
        }
+        ++phy->init_count;
 out:
        mutex_unlock(&phy->mutex);
@@ -179,13 +192,14 @@ int phy_exit(struct phy *phy)
                return ret;
        mutex_lock(&phy->mutex);
-        if (--phy->init_count == 0 && phy->ops->exit) {
+        if (phy->init_count == 1 && phy->ops->exit) {
                ret = phy->ops->exit(phy);
                if (ret < 0) {
                        dev_err(&phy->dev, "phy exit failed --> %d\n", ret);
                        goto out;
                }
        }
+        --phy->init_count;
 out:
        mutex_unlock(&phy->mutex);
@@ -196,23 +210,27 @@ EXPORT_SYMBOL_GPL(phy_exit);
 int phy_power_on(struct phy *phy)
 {
-        int ret = -ENOTSUPP;
+        int ret;
        ret = phy_pm_runtime_get_sync(phy);
        if (ret < 0 && ret != -ENOTSUPP)
                return ret;
        mutex_lock(&phy->mutex);
-        if (phy->power_count++ == 0 && phy->ops->power_on) {
+        if (phy->power_count == 0 && phy->ops->power_on) {
                ret = phy->ops->power_on(phy);
                if (ret < 0) {
                        dev_err(&phy->dev, "phy poweron failed --> %d\n", ret);
                        goto out;
                }
        }
+        ++phy->power_count;
+        mutex_unlock(&phy->mutex);
+        return 0;
 out:
        mutex_unlock(&phy->mutex);
+        phy_pm_runtime_put_sync(phy);
        return ret;
 }
@@ -220,22 +238,22 @@ EXPORT_SYMBOL_GPL(phy_power_on);
 int phy_power_off(struct phy *phy)
 {
-        int ret = -ENOTSUPP;
+        int ret;
        mutex_lock(&phy->mutex);
-        if (--phy->power_count == 0 && phy->ops->power_off) {
+        if (phy->power_count == 1 && phy->ops->power_off) {
                ret =  phy->ops->power_off(phy);
                if (ret < 0) {
                        dev_err(&phy->dev, "phy poweroff failed --> %d\n", ret);
-                        goto out;
+                        mutex_unlock(&phy->mutex);
+                        return ret;
                }
        }
+        --phy->power_count;
-out:
        mutex_unlock(&phy->mutex);
        phy_pm_runtime_put(phy);
-        return ret;
+        return 0;
 }
 EXPORT_SYMBOL_GPL(phy_power_off);
@@ -360,7 +378,7 @@ EXPORT_SYMBOL_GPL(of_phy_simple_xlate);
 struct phy *phy_get(struct device *dev, const char *string)
 {
        int index = 0;
-        struct phy *phy = NULL;
+        struct phy *phy;
        if (string == NULL) {
                dev_WARN(dev, "missing string\n");
diff --git a/drivers/phy/phy-mvebu-sata.c b/drivers/phy/phy-mvebu-sata.c
new file mode 100644
index 000000000000..d43786f62437
--- /dev/null
+++ b/drivers/phy/phy-mvebu-sata.c
@@ -0,0 +1,137 @@
+/*
+ *      phy-mvebu-sata.c: SATA Phy driver for the Marvell mvebu SoCs.
+ *
+ *      Copyright (C) 2013 Andrew Lunn <andrew@lunn.ch>
+ *
+ *      This program is free software; you can redistribute it and/or
+ *      modify it under the terms of the GNU General Public License
+ *      as published by the Free Software Foundation; either version
+ *      2 of the License, or (at your option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/clk.h>
+#include <linux/phy/phy.h>
+#include <linux/io.h>
+#include <linux/platform_device.h>
+struct priv {
+        struct clk      *clk;
+        void __iomem    *base;
+};
+#define SATA_PHY_MODE_2 0x0330
+#define  MODE_2_FORCE_PU_TX     BIT(0)
+#define  MODE_2_FORCE_PU_RX     BIT(1)
+#define  MODE_2_PU_PLL          BIT(2)
+#define  MODE_2_PU_IVREF        BIT(3)
+#define SATA_IF_CTRL    0x0050
+#define  CTRL_PHY_SHUTDOWN      BIT(9)
+static int phy_mvebu_sata_power_on(struct phy *phy)
+{
+        struct priv *priv = phy_get_drvdata(phy);
+        u32 reg;
+        clk_prepare_enable(priv->clk);
+        /* Enable PLL and IVREF */
+        reg = readl(priv->base + SATA_PHY_MODE_2);
+        reg |= (MODE_2_FORCE_PU_TX | MODE_2_FORCE_PU_RX |
+                MODE_2_PU_PLL | MODE_2_PU_IVREF);
+        writel(reg , priv->base + SATA_PHY_MODE_2);
+        /* Enable PHY */
+        reg = readl(priv->base + SATA_IF_CTRL);
+        reg &= ~CTRL_PHY_SHUTDOWN;
+        writel(reg, priv->base + SATA_IF_CTRL);
+        clk_disable_unprepare(priv->clk);
+        return 0;
+}
+static int phy_mvebu_sata_power_off(struct phy *phy)
+{
+        struct priv *priv = phy_get_drvdata(phy);
+        u32 reg;
+        clk_prepare_enable(priv->clk);
+        /* Disable PLL and IVREF */
+        reg = readl(priv->base + SATA_PHY_MODE_2);
+        reg &= ~(MODE_2_FORCE_PU_TX | MODE_2_FORCE_PU_RX |
+                 MODE_2_PU_PLL | MODE_2_PU_IVREF);
+        writel(reg, priv->base + SATA_PHY_MODE_2);
+        /* Disable PHY */
+        reg = readl(priv->base + SATA_IF_CTRL);
+        reg |= CTRL_PHY_SHUTDOWN;
+        writel(reg, priv->base + SATA_IF_CTRL);
+        clk_disable_unprepare(priv->clk);
+        return 0;
+}
+static struct phy_ops phy_mvebu_sata_ops = {
+        .power_on       = phy_mvebu_sata_power_on,
+        .power_off      = phy_mvebu_sata_power_off,
+        .owner          = THIS_MODULE,
+};
+static int phy_mvebu_sata_probe(struct platform_device *pdev)
+{
+        struct phy_provider *phy_provider;
+        struct resource *res;
+        struct priv *priv;
+        struct phy *phy;
+        priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        priv->base = devm_ioremap_resource(&pdev->dev, res);
+        if (IS_ERR(priv->base))
+                return PTR_ERR(priv->base);
+        priv->clk = devm_clk_get(&pdev->dev, "sata");
+        if (IS_ERR(priv->clk))
+                return PTR_ERR(priv->clk);
+        phy_provider = devm_of_phy_provider_register(&pdev->dev,
+                                                     of_phy_simple_xlate);
+        if (IS_ERR(phy_provider))
+                return PTR_ERR(phy_provider);
+        phy = devm_phy_create(&pdev->dev, &phy_mvebu_sata_ops, NULL);
+        if (IS_ERR(phy))
+                return PTR_ERR(phy);
+        phy_set_drvdata(phy, priv);
+        /* The boot loader may of left it on. Turn it off. */
+        phy_mvebu_sata_power_off(phy);
+        return 0;
+}
+static const struct of_device_id phy_mvebu_sata_of_match[] = {
+        { .compatible = "marvell,mvebu-sata-phy" },
+        { },
+};
+MODULE_DEVICE_TABLE(of, phy_mvebu_sata_of_match);
+static struct platform_driver phy_mvebu_sata_driver = {
+        .probe  = phy_mvebu_sata_probe,
+        .driver = {
+                .name   = "phy-mvebu-sata",
+                .owner  = THIS_MODULE,
+                .of_match_table = phy_mvebu_sata_of_match,
+        }
+};
+module_platform_driver(phy_mvebu_sata_driver);
+MODULE_AUTHOR("Andrew Lunn <andrew@lunn.ch>");
+MODULE_DESCRIPTION("Marvell MVEBU SATA PHY driver");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/power/Kconfig b/drivers/power/Kconfig
index 5e2054afe840..85ad58c6da17 100644
--- a/drivers/power/Kconfig
+++ b/drivers/power/Kconfig
@@ -196,6 +196,7 @@ config BATTERY_MAX17040
 config BATTERY_MAX17042
        tristate "Maxim MAX17042/17047/17050/8997/8966 Fuel Gauge"
        depends on I2C
+        select REGMAP_I2C
        help
          MAX17042 is fuel-gauge systems for lithium-ion (Li+) batteries
          in handheld and portable equipment. The MAX17042 is configured
diff --git a/drivers/power/power_supply_core.c b/drivers/power/power_supply_core.c
index 00e667296360..557af943b2f5 100644
--- a/drivers/power/power_supply_core.c
+++ b/drivers/power/power_supply_core.c
@@ -511,6 +511,10 @@ int power_supply_register(struct device *parent, struct power_supply *psy)
        dev_set_drvdata(dev, psy);
        psy->dev = dev;
+        rc = dev_set_name(dev, "%s", psy->name);
+        if (rc)
+                goto dev_set_name_failed;
        INIT_WORK(&psy->changed_work, power_supply_changed_work);
        rc = power_supply_check_supplies(psy);
@@ -524,10 +528,6 @@ int power_supply_register(struct device *parent, struct power_supply *psy)
        if (rc)
                goto wakeup_init_failed;
-        rc = kobject_set_name(&dev->kobj, "%s", psy->name);
-        if (rc)
-                goto kobject_set_name_failed;
        rc = device_add(dev);
        if (rc)
                goto device_add_failed;
@@ -553,11 +553,11 @@ create_triggers_failed:
 register_cooler_failed:
        psy_unregister_thermal(psy);
 register_thermal_failed:
-wakeup_init_failed:
        device_del(dev);
-kobject_set_name_failed:
 device_add_failed:
+wakeup_init_failed:
 check_supplies_failed:
+dev_set_name_failed:
        put_device(dev);
 success:
        return rc;
diff --git a/drivers/powercap/intel_rapl.c b/drivers/powercap/intel_rapl.c
index 2a786c504460..3c6768378a94 100644
--- a/drivers/powercap/intel_rapl.c
+++ b/drivers/powercap/intel_rapl.c
@@ -833,6 +833,11 @@ static int rapl_write_data_raw(struct rapl_domain *rd,
        return 0;
 }
+static const struct x86_cpu_id energy_unit_quirk_ids[] = {
+        { X86_VENDOR_INTEL, 6, 0x37},/* VLV */
+        {}
+};
 static int rapl_check_unit(struct rapl_package *rp, int cpu)
 {
        u64 msr_val;
@@ -853,8 +858,11 @@ static int rapl_check_unit(struct rapl_package *rp, int cpu)
         * time unit: 1/time_unit_divisor Seconds
         */
        value = (msr_val & ENERGY_UNIT_MASK) >> ENERGY_UNIT_OFFSET;
-        rp->energy_unit_divisor = 1 << value;
+        /* some CPUs have different way to calculate energy unit */
+        if (x86_match_cpu(energy_unit_quirk_ids))
+                rp->energy_unit_divisor = 1000000 / (1 << value);
+        else
+                rp->energy_unit_divisor = 1 << value;
        value = (msr_val & POWER_UNIT_MASK) >> POWER_UNIT_OFFSET;
        rp->power_unit_divisor = 1 << value;
@@ -941,6 +949,7 @@ static void package_power_limit_irq_restore(int package_id)
 static const struct x86_cpu_id rapl_ids[] = {
        { X86_VENDOR_INTEL, 6, 0x2a},/* SNB */
        { X86_VENDOR_INTEL, 6, 0x2d},/* SNB EP */
+        { X86_VENDOR_INTEL, 6, 0x37},/* VLV */
        { X86_VENDOR_INTEL, 6, 0x3a},/* IVB */
        { X86_VENDOR_INTEL, 6, 0x45},/* HSW */
        /* TODO: Add more CPU IDs after testing */
diff --git a/drivers/rtc/rtc-cmos.c b/drivers/rtc/rtc-cmos.c
index f14876256a4a..a2325bc5e497 100644
--- a/drivers/rtc/rtc-cmos.c
+++ b/drivers/rtc/rtc-cmos.c
@@ -34,11 +34,11 @@
 #include <linux/interrupt.h>
 #include <linux/spinlock.h>
 #include <linux/platform_device.h>
-#include <linux/mod_devicetable.h>
 #include <linux/log2.h>
 #include <linux/pm.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
+#include <linux/dmi.h>
 /* this is for "generic access to PC-style RTC" using CMOS_READ/CMOS_WRITE */
 #include <asm-generic/rtc.h>
@@ -377,6 +377,51 @@ static int cmos_set_alarm(struct device *dev, struct rtc_wkalrm *t)
        return 0;
 }
+/*
+ * Do not disable RTC alarm on shutdown - workaround for b0rked BIOSes.
+ */
+static bool alarm_disable_quirk;
+static int __init set_alarm_disable_quirk(const struct dmi_system_id *id)
+{
+        alarm_disable_quirk = true;
+        pr_info("rtc-cmos: BIOS has alarm-disable quirk. ");
+        pr_info("RTC alarms disabled\n");
+        return 0;
+}
+static const struct dmi_system_id rtc_quirks[] __initconst = {
+        /* https://bugzilla.novell.com/show_bug.cgi?id=805740 */
+        {
+                .callback = set_alarm_disable_quirk,
+                .ident    = "IBM Truman",
+                .matches  = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "4852570"),
+                },
+        },
+        /* https://bugzilla.novell.com/show_bug.cgi?id=812592 */
+        {
+                .callback = set_alarm_disable_quirk,
+                .ident    = "Gigabyte GA-990XA-UD3",
+                .matches  = {
+                        DMI_MATCH(DMI_SYS_VENDOR,
+                                        "Gigabyte Technology Co., Ltd."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "GA-990XA-UD3"),
+                },
+        },
+        /* http://permalink.gmane.org/gmane.linux.kernel/1604474 */
+        {
+                .callback = set_alarm_disable_quirk,
+                .ident    = "Toshiba Satellite L300",
+                .matches  = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Satellite L300"),
+                },
+        },
+        {}
+};
 static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled)
 {
        struct cmos_rtc *cmos = dev_get_drvdata(dev);
@@ -385,6 +430,9 @@ static int cmos_alarm_irq_enable(struct device *dev, unsigned int enabled)
        if (!is_valid_irq(cmos->irq))
                return -EINVAL;
+        if (alarm_disable_quirk)
+                return 0;
        spin_lock_irqsave(&rtc_lock, flags);
        if (enabled)
@@ -1157,6 +1205,8 @@ static int __init cmos_init(void)
                        platform_driver_registered = true;
        }
+        dmi_check_system(rtc_quirks);
        if (retval == 0)
                return 0;
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index f302efa937ef..1eef0f586950 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -3386,7 +3386,7 @@ int dasd_generic_set_offline(struct ccw_device *cdev)
        if (test_bit(DASD_FLAG_SAFE_OFFLINE_RUNNING, &device->flags)) {
                /*
-                 * safe offline allready running
+                 * safe offline already running
                 * could only be called by normal offline so safe_offline flag
                 * needs to be removed to run normal offline and kill all I/O
                 */
diff --git a/drivers/s390/char/sclp.h b/drivers/s390/char/sclp.h
index 6fbe09686d18..fea76aed9eea 100644
--- a/drivers/s390/char/sclp.h
+++ b/drivers/s390/char/sclp.h
@@ -183,7 +183,6 @@ extern unsigned long sclp_console_full;
 extern u8 sclp_fac84;
 extern unsigned long long sclp_rzm;
 extern unsigned long long sclp_rnmax;
-extern __initdata int sclp_early_read_info_sccb_valid;
 /* useful inlines */
diff --git a/drivers/s390/char/sclp_cmd.c b/drivers/s390/char/sclp_cmd.c
index eaa21d542c5c..cb3c4e05a385 100644
--- a/drivers/s390/char/sclp_cmd.c
+++ b/drivers/s390/char/sclp_cmd.c
@@ -455,8 +455,6 @@ static int __init sclp_detect_standby_memory(void)
        if (OLDMEM_BASE) /* No standby memory in kdump mode */
                return 0;
-        if (!sclp_early_read_info_sccb_valid)
-                return 0;
        if ((sclp_facilities & 0xe00000000000ULL) != 0xe00000000000ULL)
                return 0;
        rc = -ENOMEM;
diff --git a/drivers/s390/char/sclp_early.c b/drivers/s390/char/sclp_early.c
index 1465e9563101..82f2c389b4d1 100644
--- a/drivers/s390/char/sclp_early.c
+++ b/drivers/s390/char/sclp_early.c
@@ -35,11 +35,12 @@ struct read_info_sccb {
        u8      _reserved5[4096 - 112]; /* 112-4095 */
 } __packed __aligned(PAGE_SIZE);
-static __initdata struct read_info_sccb early_read_info_sccb;
+static char sccb_early[PAGE_SIZE] __aligned(PAGE_SIZE) __initdata;
-static __initdata char sccb_early[PAGE_SIZE] __aligned(PAGE_SIZE);
+static unsigned int sclp_con_has_vt220 __initdata;
+static unsigned int sclp_con_has_linemode __initdata;
 static unsigned long sclp_hsa_size;
+static struct sclp_ipl_info sclp_ipl_info;
-__initdata int sclp_early_read_info_sccb_valid;
 u64 sclp_facilities;
 u8 sclp_fac84;
 unsigned long long sclp_rzm;
@@ -63,15 +64,12 @@ out:
        return rc;
 }
-static void __init sclp_read_info_early(void)
+static int __init sclp_read_info_early(struct read_info_sccb *sccb)
 {
-        int rc;
+        int rc, i;
-        int i;
-        struct read_info_sccb *sccb;
        sclp_cmdw_t commands[] = {SCLP_CMDW_READ_SCP_INFO_FORCED,
                                  SCLP_CMDW_READ_SCP_INFO};
-        sccb = &early_read_info_sccb;
        for (i = 0; i < ARRAY_SIZE(commands); i++) {
                do {
                        memset(sccb, 0, sizeof(*sccb));
@@ -83,24 +81,19 @@ static void __init sclp_read_info_early(void)
                if (rc)
                        break;
-                if (sccb->header.response_code == 0x10) {
+                if (sccb->header.response_code == 0x10)
-                        sclp_early_read_info_sccb_valid = 1;
+                        return 0;
-                        break;
-                }
                if (sccb->header.response_code != 0x1f0)
                        break;
        }
+        return -EIO;
 }
-static void __init sclp_facilities_detect(void)
+static void __init sclp_facilities_detect(struct read_info_sccb *sccb)
 {
-        struct read_info_sccb *sccb;
+        if (sclp_read_info_early(sccb))
-        sclp_read_info_early();
-        if (!sclp_early_read_info_sccb_valid)
                return;
-        sccb = &early_read_info_sccb;
        sclp_facilities = sccb->facilities;
        sclp_fac84 = sccb->fac84;
        if (sccb->fac85 & 0x02)
@@ -108,30 +101,22 @@ static void __init sclp_facilities_detect(void)
        sclp_rnmax = sccb->rnmax ? sccb->rnmax : sccb->rnmax2;
        sclp_rzm = sccb->rnsize ? sccb->rnsize : sccb->rnsize2;
        sclp_rzm <<= 20;
+        /* Save IPL information */
+        sclp_ipl_info.is_valid = 1;
+        if (sccb->flags & 0x2)
+                sclp_ipl_info.has_dump = 1;
+        memcpy(&sclp_ipl_info.loadparm, &sccb->loadparm, LOADPARM_LEN);
 }
 bool __init sclp_has_linemode(void)
 {
-        struct init_sccb *sccb = (void *) &sccb_early;
+        return !!sclp_con_has_linemode;
-        if (sccb->header.response_code != 0x20)
-                return 0;
-        if (!(sccb->sclp_send_mask & (EVTYP_OPCMD_MASK | EVTYP_PMSGCMD_MASK)))
-                return 0;
-        if (!(sccb->sclp_receive_mask & (EVTYP_MSG_MASK | EVTYP_PMSGCMD_MASK)))
-                return 0;
-        return 1;
 }
 bool __init sclp_has_vt220(void)
 {
-        struct init_sccb *sccb = (void *) &sccb_early;
+        return !!sclp_con_has_vt220;
-        if (sccb->header.response_code != 0x20)
-                return 0;
-        if (sccb->sclp_send_mask & EVTYP_VT220MSG_MASK)
-                return 1;
-        return 0;
 }
 unsigned long long sclp_get_rnmax(void)
@@ -146,19 +131,12 @@ unsigned long long sclp_get_rzm(void)
 /*
 * This function will be called after sclp_facilities_detect(), which gets
- * called from early.c code. Therefore the sccb should have valid contents.
+ * called from early.c code. The sclp_facilities_detect() function retrieves
+ * and saves the IPL information.
 */
 void __init sclp_get_ipl_info(struct sclp_ipl_info *info)
 {
-        struct read_info_sccb *sccb;
+        *info = sclp_ipl_info;
-        if (!sclp_early_read_info_sccb_valid)
-                return;
-        sccb = &early_read_info_sccb;
-        info->is_valid = 1;
-        if (sccb->flags & 0x2)
-                info->has_dump = 1;
-        memcpy(&info->loadparm, &sccb->loadparm, LOADPARM_LEN);
 }
 static int __init sclp_cmd_early(sclp_cmdw_t cmd, void *sccb)
@@ -189,11 +167,10 @@ static void __init sccb_init_eq_size(struct sdias_sccb *sccb)
        sccb->evbuf.dbs = 1;
 }
-static int __init sclp_set_event_mask(unsigned long receive_mask,
+static int __init sclp_set_event_mask(struct init_sccb *sccb,
+                                      unsigned long receive_mask,
                                      unsigned long send_mask)
 {
-        struct init_sccb *sccb = (void *) &sccb_early;
        memset(sccb, 0, sizeof(*sccb));
        sccb->header.length = sizeof(*sccb);
        sccb->mask_length = sizeof(sccb_mask_t);
@@ -202,10 +179,8 @@ static int __init sclp_set_event_mask(unsigned long receive_mask,
        return sclp_cmd_early(SCLP_CMDW_WRITE_EVENT_MASK, sccb);
 }
-static long __init sclp_hsa_size_init(void)
+static long __init sclp_hsa_size_init(struct sdias_sccb *sccb)
 {
-        struct sdias_sccb *sccb = (void *) &sccb_early;
        sccb_init_eq_size(sccb);
        if (sclp_cmd_early(SCLP_CMDW_WRITE_EVENT_DATA, sccb))
                return -EIO;
@@ -214,10 +189,8 @@ static long __init sclp_hsa_size_init(void)
        return 0;
 }
-static long __init sclp_hsa_copy_wait(void)
+static long __init sclp_hsa_copy_wait(struct sccb_header *sccb)
 {
-        struct sccb_header *sccb = (void *) &sccb_early;
        memset(sccb, 0, PAGE_SIZE);
        sccb->length = PAGE_SIZE;
        if (sclp_cmd_early(SCLP_CMDW_READ_EVENT_DATA, sccb))
@@ -230,34 +203,62 @@ unsigned long sclp_get_hsa_size(void)
        return sclp_hsa_size;
 }
-static void __init sclp_hsa_size_detect(void)
+static void __init sclp_hsa_size_detect(void *sccb)
 {
        long size;
        /* First try synchronous interface (LPAR) */
-        if (sclp_set_event_mask(0, 0x40000010))
+        if (sclp_set_event_mask(sccb, 0, 0x40000010))
                return;
-        size = sclp_hsa_size_init();
+        size = sclp_hsa_size_init(sccb);
        if (size < 0)
                return;
        if (size != 0)
                goto out;
        /* Then try asynchronous interface (z/VM) */
-        if (sclp_set_event_mask(0x00000010, 0x40000010))
+        if (sclp_set_event_mask(sccb, 0x00000010, 0x40000010))
                return;
-        size = sclp_hsa_size_init();
+        size = sclp_hsa_size_init(sccb);
        if (size < 0)
                return;
-        size = sclp_hsa_copy_wait();
+        size = sclp_hsa_copy_wait(sccb);
        if (size < 0)
                return;
 out:
        sclp_hsa_size = size;
 }
+static unsigned int __init sclp_con_check_linemode(struct init_sccb *sccb)
+{
+        if (!(sccb->sclp_send_mask & (EVTYP_OPCMD_MASK | EVTYP_PMSGCMD_MASK)))
+                return 0;
+        if (!(sccb->sclp_receive_mask & (EVTYP_MSG_MASK | EVTYP_PMSGCMD_MASK)))
+                return 0;
+        return 1;
+}
+static void __init sclp_console_detect(struct init_sccb *sccb)
+{
+        if (sccb->header.response_code != 0x20)
+                return;
+        if (sccb->sclp_send_mask & EVTYP_VT220MSG_MASK)
+                sclp_con_has_vt220 = 1;
+        if (sclp_con_check_linemode(sccb))
+                sclp_con_has_linemode = 1;
+}
 void __init sclp_early_detect(void)
 {
-        sclp_facilities_detect();
+        void *sccb = &sccb_early;
-        sclp_hsa_size_detect();
-        sclp_set_event_mask(0, 0);
+        sclp_facilities_detect(sccb);
+        sclp_hsa_size_detect(sccb);
+        /* Turn off SCLP event notifications.  Also save remote masks in the
+         * sccb.  These are sufficient to detect sclp console capabilities.
+         */
+        sclp_set_event_mask(sccb, 0, 0);
+        sclp_console_detect(sccb);
 }
diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
index 3f4ca4e09a4c..e91b89dc6d1f 100644
--- a/drivers/s390/char/tty3270.c
+++ b/drivers/s390/char/tty3270.c
@@ -125,10 +125,7 @@ static void tty3270_resize_work(struct work_struct *work);
 */
 static void tty3270_set_timer(struct tty3270 *tp, int expires)
 {
-        if (expires == 0)
+        mod_timer(&tp->timer, jiffies + expires);
-                del_timer(&tp->timer);
-        else
-                mod_timer(&tp->timer, jiffies + expires);
 }
 /*
@@ -744,7 +741,6 @@ tty3270_free_view(struct tty3270 *tp)
 {
        int pages;
-        del_timer_sync(&tp->timer);
        kbd_free(tp->kbd);
        raw3270_request_free(tp->kreset);
        raw3270_request_free(tp->read);
@@ -877,6 +873,7 @@ tty3270_free(struct raw3270_view *view)
 {
        struct tty3270 *tp = container_of(view, struct tty3270, view);
+        del_timer_sync(&tp->timer);
        tty3270_free_screen(tp->screen, tp->view.rows);
        tty3270_free_view(tp);
 }
@@ -942,7 +939,7 @@ static int tty3270_install(struct tty_driver *driver, struct tty_struct *tty)
                return rc;
        }
-        tp->screen = tty3270_alloc_screen(tp->view.cols, tp->view.rows);
+        tp->screen = tty3270_alloc_screen(tp->view.rows, tp->view.cols);
        if (IS_ERR(tp->screen)) {
                rc = PTR_ERR(tp->screen);
                raw3270_put_view(&tp->view);
diff --git a/drivers/s390/cio/blacklist.c b/drivers/s390/cio/blacklist.c
index a9fe3de2dec1..b3f791b2c1f8 100644
--- a/drivers/s390/cio/blacklist.c
+++ b/drivers/s390/cio/blacklist.c
@@ -260,16 +260,16 @@ static int blacklist_parse_proc_parameters(char *buf)
        parm = strsep(&buf, " ");
-        if (strcmp("free", parm) == 0)
+        if (strcmp("free", parm) == 0) {
                rc = blacklist_parse_parameters(buf, free, 0);
-        else if (strcmp("add", parm) == 0)
+                css_schedule_eval_all_unreg(0);
+        } else if (strcmp("add", parm) == 0)
                rc = blacklist_parse_parameters(buf, add, 0);
        else if (strcmp("purge", parm) == 0)
                return ccw_purge_blacklisted();
        else
                return -EINVAL;
-        css_schedule_reprobe();
        return rc;
 }
diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index 959135a01847..fd3367a1dc7a 100644
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -128,14 +128,14 @@ static ssize_t ccwgroup_online_store(struct device *dev,
                                     const char *buf, size_t count)
 {
        struct ccwgroup_device *gdev = to_ccwgroupdev(dev);
-        struct ccwgroup_driver *gdrv = to_ccwgroupdrv(dev->driver);
        unsigned long value;
        int ret;
-        if (!dev->driver)
+        device_lock(dev);
-                return -EINVAL;
+        if (!dev->driver) {
-        if (!try_module_get(gdrv->driver.owner))
+                ret = -EINVAL;
-                return -EINVAL;
+                goto out;
+        }
        ret = kstrtoul(buf, 0, &value);
        if (ret)
@@ -148,7 +148,7 @@ static ssize_t ccwgroup_online_store(struct device *dev,
        else
                ret = -EINVAL;
 out:
-        module_put(gdrv->driver.owner);
+        device_unlock(dev);
        return (ret == 0) ? count : ret;
 }
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 13299f902676..f6b9188c5af5 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -55,6 +55,7 @@ int chsc_error_from_response(int response)
        case 0x0004:
                return -EOPNOTSUPP;
        case 0x000b:
+        case 0x0107:            /* "Channel busy" for the op 0x003d */
                return -EBUSY;
        case 0x0100:
        case 0x0102:
@@ -237,26 +238,6 @@ void chsc_chp_offline(struct chp_id chpid)
        for_each_subchannel_staged(s390_subchannel_remove_chpid, NULL, &link);
 }
-static int s390_process_res_acc_new_sch(struct subchannel_id schid, void *data)
-{
-        struct schib schib;
-        /*
-         * We don't know the device yet, but since a path
-         * may be available now to the device we'll have
-         * to do recognition again.
-         * Since we don't have any idea about which chpid
-         * that beast may be on we'll have to do a stsch
-         * on all devices, grr...
-         */
-        if (stsch_err(schid, &schib))
-                /* We're through */
-                return -ENXIO;
-        /* Put it on the slow path. */
-        css_schedule_eval(schid);
-        return 0;
-}
 static int __s390_process_res_acc(struct subchannel *sch, void *data)
 {
        spin_lock_irq(sch->lock);
@@ -287,8 +268,8 @@ static void s390_process_res_acc(struct chp_link *link)
         * The more information we have (info), the less scanning
         * will we have to do.
         */
-        for_each_subchannel_staged(__s390_process_res_acc,
+        for_each_subchannel_staged(__s390_process_res_acc, NULL, link);
-                                   s390_process_res_acc_new_sch, link);
+        css_schedule_reprobe();
 }
 static int
@@ -663,19 +644,6 @@ static int s390_subchannel_vary_chpid_on(struct subchannel *sch, void *data)
        return 0;
 }
-static int
-__s390_vary_chpid_on(struct subchannel_id schid, void *data)
-{
-        struct schib schib;
-        if (stsch_err(schid, &schib))
-                /* We're through */
-                return -ENXIO;
-        /* Put it on the slow path. */
-        css_schedule_eval(schid);
-        return 0;
-}
 /**
 * chsc_chp_vary - propagate channel-path vary operation to subchannels
 * @chpid: channl-path ID
@@ -694,7 +662,8 @@ int chsc_chp_vary(struct chp_id chpid, int on)
                /* Try to update the channel path description. */
                chp_update_desc(chp);
                for_each_subchannel_staged(s390_subchannel_vary_chpid_on,
-                                           __s390_vary_chpid_on, &chpid);
+                                           NULL, &chpid);
+                css_schedule_reprobe();
        } else
                for_each_subchannel_staged(s390_subchannel_vary_chpid_off,
                                           NULL, &chpid);
@@ -1234,3 +1203,35 @@ out:
        return ret;
 }
 EXPORT_SYMBOL_GPL(chsc_scm_info);
+/**
+ * chsc_pnso_brinfo() - Perform Network-Subchannel Operation, Bridge Info.
+ * @schid:              id of the subchannel on which PNSO is performed
+ * @brinfo_area:        request and response block for the operation
+ * @resume_token:       resume token for multiblock response
+ * @cnc:                Boolean change-notification control
+ *
+ * brinfo_area must be allocated by the caller with get_zeroed_page(GFP_KERNEL)
+ *
+ * Returns 0 on success.
+ */
+int chsc_pnso_brinfo(struct subchannel_id schid,
+                struct chsc_pnso_area *brinfo_area,
+                struct chsc_brinfo_resume_token resume_token,
+                int cnc)
+{
+        memset(brinfo_area, 0, sizeof(*brinfo_area));
+        brinfo_area->request.length = 0x0030;
+        brinfo_area->request.code = 0x003d; /* network-subchannel operation */
+        brinfo_area->m     = schid.m;
+        brinfo_area->ssid  = schid.ssid;
+        brinfo_area->sch   = schid.sch_no;
+        brinfo_area->cssid = schid.cssid;
+        brinfo_area->oc    = 0; /* Store-network-bridging-information list */
+        brinfo_area->resume_token = resume_token;
+        brinfo_area->n     = (cnc != 0);
+        if (chsc(brinfo_area))
+                return -EIO;
+        return chsc_error_from_response(brinfo_area->response.code);
+}
+EXPORT_SYMBOL_GPL(chsc_pnso_brinfo);
diff --git a/drivers/s390/cio/chsc.h b/drivers/s390/cio/chsc.h
index 23d072e70eb2..7e53a9c8b0b9 100644
--- a/drivers/s390/cio/chsc.h
+++ b/drivers/s390/cio/chsc.h
@@ -61,7 +61,9 @@ struct css_chsc_char {
        u32 : 20;
        u32 scssc : 1;  /* bit 107 */
        u32 scsscf : 1; /* bit 108 */
-        u32 : 19;
+        u32:7;
+        u32 pnso:1; /* bit 116 */
+        u32:11;
 }__attribute__((packed));
 extern struct css_chsc_char css_chsc_characteristics;
@@ -188,6 +190,53 @@ struct chsc_scm_info {
 int chsc_scm_info(struct chsc_scm_info *scm_area, u64 token);
+struct chsc_brinfo_resume_token {
+        u64 t1;
+        u64 t2;
+} __packed;
+struct chsc_brinfo_naihdr {
+        struct chsc_brinfo_resume_token resume_token;
+        u32:32;
+        u32 instance;
+        u32:24;
+        u8 naids;
+        u32 reserved[3];
+} __packed;
+struct chsc_pnso_area {
+        struct chsc_header request;
+        u8:2;
+        u8 m:1;
+        u8:5;
+        u8:2;
+        u8 ssid:2;
+        u8 fmt:4;
+        u16 sch;
+        u8:8;
+        u8 cssid;
+        u16:16;
+        u8 oc;
+        u32:24;
+        struct chsc_brinfo_resume_token resume_token;
+        u32 n:1;
+        u32:31;
+        u32 reserved[3];
+        struct chsc_header response;
+        u32:32;
+        struct chsc_brinfo_naihdr naihdr;
+        union {
+                struct qdio_brinfo_entry_l3_ipv6 l3_ipv6[0];
+                struct qdio_brinfo_entry_l3_ipv4 l3_ipv4[0];
+                struct qdio_brinfo_entry_l2      l2[0];
+        } entries;
+} __packed;
+int chsc_pnso_brinfo(struct subchannel_id schid,
+                struct chsc_pnso_area *brinfo_area,
+                struct chsc_brinfo_resume_token resume_token,
+                int cnc);
 #ifdef CONFIG_SCM_BUS
 int scm_update_information(void);
 int scm_process_availability_information(void);
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 8c2cb87bccc5..0268e5fd59b5 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -69,7 +69,8 @@ static int call_fn_known_sch(struct device *dev, void *data)
        struct cb_data *cb = data;
        int rc = 0;
-        idset_sch_del(cb->set, sch->schid);
+        if (cb->set)
+                idset_sch_del(cb->set, sch->schid);
        if (cb->fn_known_sch)
                rc = cb->fn_known_sch(sch, cb->data);
        return rc;
@@ -115,6 +116,13 @@ int for_each_subchannel_staged(int (*fn_known)(struct subchannel *, void *),
        cb.fn_known_sch = fn_known;
        cb.fn_unknown_sch = fn_unknown;
+        if (fn_known && !fn_unknown) {
+                /* Skip idset allocation in case of known-only loop. */
+                cb.set = NULL;
+                return bus_for_each_dev(&css_bus_type, NULL, &cb,
+                                        call_fn_known_sch);
+        }
        cb.set = idset_sch_new();
        if (!cb.set)
                /* fall back to brute force scanning in case of oom */
@@ -553,6 +561,9 @@ static int slow_eval_unknown_fn(struct subchannel_id schid, void *data)
                default:
                        rc = 0;
                }
+                /* Allow scheduling here since the containing loop might
+                 * take a while.  */
+                cond_resched();
        }
        return rc;
 }
@@ -572,7 +583,7 @@ static void css_slow_path_func(struct work_struct *unused)
        spin_unlock_irqrestore(&slow_subchannel_lock, flags);
 }
-static DECLARE_WORK(slow_path_work, css_slow_path_func);
+static DECLARE_DELAYED_WORK(slow_path_work, css_slow_path_func);
 struct workqueue_struct *cio_work_q;
 void css_schedule_eval(struct subchannel_id schid)
@@ -582,7 +593,7 @@ void css_schedule_eval(struct subchannel_id schid)
        spin_lock_irqsave(&slow_subchannel_lock, flags);
        idset_sch_add(slow_subchannel_set, schid);
        atomic_set(&css_eval_scheduled, 1);
-        queue_work(cio_work_q, &slow_path_work);
+        queue_delayed_work(cio_work_q, &slow_path_work, 0);
        spin_unlock_irqrestore(&slow_subchannel_lock, flags);
 }
@@ -593,7 +604,7 @@ void css_schedule_eval_all(void)
        spin_lock_irqsave(&slow_subchannel_lock, flags);
        idset_fill(slow_subchannel_set);
        atomic_set(&css_eval_scheduled, 1);
-        queue_work(cio_work_q, &slow_path_work);
+        queue_delayed_work(cio_work_q, &slow_path_work, 0);
        spin_unlock_irqrestore(&slow_subchannel_lock, flags);
 }
@@ -606,7 +617,7 @@ static int __unset_registered(struct device *dev, void *data)
        return 0;
 }
-static void css_schedule_eval_all_unreg(void)
+void css_schedule_eval_all_unreg(unsigned long delay)
 {
        unsigned long flags;
        struct idset *unreg_set;
@@ -624,7 +635,7 @@ static void css_schedule_eval_all_unreg(void)
        spin_lock_irqsave(&slow_subchannel_lock, flags);
        idset_add_set(slow_subchannel_set, unreg_set);
        atomic_set(&css_eval_scheduled, 1);
-        queue_work(cio_work_q, &slow_path_work);
+        queue_delayed_work(cio_work_q, &slow_path_work, delay);
        spin_unlock_irqrestore(&slow_subchannel_lock, flags);
        idset_free(unreg_set);
 }
@@ -637,7 +648,8 @@ void css_wait_for_slow_path(void)
 /* Schedule reprobing of all unregistered subchannels. */
 void css_schedule_reprobe(void)
 {
-        css_schedule_eval_all_unreg();
+        /* Schedule with a delay to allow merging of subsequent calls. */
+        css_schedule_eval_all_unreg(1 * HZ);
 }
 EXPORT_SYMBOL_GPL(css_schedule_reprobe);
diff --git a/drivers/s390/cio/css.h b/drivers/s390/cio/css.h
index 29351321bad6..2c9107e20251 100644
--- a/drivers/s390/cio/css.h
+++ b/drivers/s390/cio/css.h
@@ -133,6 +133,7 @@ extern struct channel_subsystem *channel_subsystems[];
 /* Helper functions to build lists for the slow path. */
 void css_schedule_eval(struct subchannel_id schid);
 void css_schedule_eval_all(void);
+void css_schedule_eval_all_unreg(unsigned long delay);
 int css_complete_work(void);
 int sch_is_pseudo_sch(struct subchannel *);
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index e4a7ab2bb629..e9d783563cbb 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -333,9 +333,9 @@ int ccw_device_set_offline(struct ccw_device *cdev)
                if (ret != 0)
                        return ret;
        }
-        cdev->online = 0;
        spin_lock_irq(cdev->ccwlock);
        sch = to_subchannel(cdev->dev.parent);
+        cdev->online = 0;
        /* Wait until a final state or DISCONNECTED is reached */
        while (!dev_fsm_final_state(cdev) &&
               cdev->private->state != DEV_STATE_DISCONNECTED) {
@@ -446,7 +446,10 @@ int ccw_device_set_online(struct ccw_device *cdev)
                ret = cdev->drv->set_online(cdev);
        if (ret)
                goto rollback;
+        spin_lock_irq(cdev->ccwlock);
        cdev->online = 1;
+        spin_unlock_irq(cdev->ccwlock);
        return 0;
 rollback:
@@ -546,17 +549,12 @@ static ssize_t online_store (struct device *dev, struct device_attribute *attr,
        if (!dev_fsm_final_state(cdev) &&
            cdev->private->state != DEV_STATE_DISCONNECTED) {
                ret = -EAGAIN;
-                goto out_onoff;
+                goto out;
        }
        /* Prevent conflict between pending work and on-/offline processing.*/
        if (work_pending(&cdev->private->todo_work)) {
                ret = -EAGAIN;
-                goto out_onoff;
+                goto out;
-        }
-        if (cdev->drv && !try_module_get(cdev->drv->driver.owner)) {
-                ret = -EINVAL;
-                goto out_onoff;
        }
        if (!strncmp(buf, "force\n", count)) {
                force = 1;
@@ -568,6 +566,8 @@ static ssize_t online_store (struct device *dev, struct device_attribute *attr,
        }
        if (ret)
                goto out;
+        device_lock(dev);
        switch (i) {
        case 0:
                ret = online_store_handle_offline(cdev);
@@ -578,10 +578,9 @@ static ssize_t online_store (struct device *dev, struct device_attribute *attr,
        default:
                ret = -EINVAL;
        }
+        device_unlock(dev);
 out:
-        if (cdev->drv)
-                module_put(cdev->drv->driver.owner);
-out_onoff:
        atomic_set(&cdev->private->onoff, 0);
        return (ret < 0) ? ret : count;
 }
@@ -1745,8 +1744,7 @@ ccw_device_probe (struct device *dev)
        return 0;
 }
-static int
+static int ccw_device_remove(struct device *dev)
-ccw_device_remove (struct device *dev)
 {
        struct ccw_device *cdev = to_ccwdev(dev);
        struct ccw_driver *cdrv = cdev->drv;
@@ -1754,9 +1752,10 @@ ccw_device_remove (struct device *dev)
        if (cdrv->remove)
                cdrv->remove(cdev);
+        spin_lock_irq(cdev->ccwlock);
        if (cdev->online) {
                cdev->online = 0;
-                spin_lock_irq(cdev->ccwlock);
                ret = ccw_device_offline(cdev);
                spin_unlock_irq(cdev->ccwlock);
                if (ret == 0)
@@ -1769,10 +1768,12 @@ ccw_device_remove (struct device *dev)
                                      cdev->private->dev_id.devno);
                /* Give up reference obtained in ccw_device_set_online(). */
                put_device(&cdev->dev);
+                spin_lock_irq(cdev->ccwlock);
        }
        ccw_device_set_timeout(cdev, 0);
        cdev->drv = NULL;
        cdev->private->int_class = IRQIO_CIO;
+        spin_unlock_irq(cdev->ccwlock);
        return 0;
 }
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 3e602e8affa7..c883a085c059 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -1752,6 +1752,97 @@ int qdio_stop_irq(struct ccw_device *cdev, int nr)
 }
 EXPORT_SYMBOL(qdio_stop_irq);
+/**
+ * qdio_pnso_brinfo() - perform network subchannel op #0 - bridge info.
+ * @schid:              Subchannel ID.
+ * @cnc:                Boolean Change-Notification Control
+ * @response:           Response code will be stored at this address
+ * @cb:                 Callback function will be executed for each element
+ *                      of the address list
+ * @priv:               Pointer passed from the caller to qdio_pnso_brinfo()
+ * @type:               Type of the address entry passed to the callback
+ * @entry:              Entry containg the address of the specified type
+ * @priv:               Pointer to pass to the callback function.
+ *
+ * Performs "Store-network-bridging-information list" operation and calls
+ * the callback function for every entry in the list. If "change-
+ * notification-control" is set, further changes in the address list
+ * will be reported via the IPA command.
+ */
+int qdio_pnso_brinfo(struct subchannel_id schid,
+                int cnc, u16 *response,
+                void (*cb)(void *priv, enum qdio_brinfo_entry_type type,
+                                void *entry),
+                void *priv)
+{
+        struct chsc_pnso_area *rr;
+        int rc;
+        u32 prev_instance = 0;
+        int isfirstblock = 1;
+        int i, size, elems;
+        rr = (struct chsc_pnso_area *)get_zeroed_page(GFP_KERNEL);
+        if (rr == NULL)
+                return -ENOMEM;
+        do {
+                /* on the first iteration, naihdr.resume_token will be zero */
+                rc = chsc_pnso_brinfo(schid, rr, rr->naihdr.resume_token, cnc);
+                if (rc != 0 && rc != -EBUSY)
+                        goto out;
+                if (rr->response.code != 1) {
+                        rc = -EIO;
+                        continue;
+                } else
+                        rc = 0;
+                if (cb == NULL)
+                        continue;
+                size = rr->naihdr.naids;
+                elems = (rr->response.length -
+                                sizeof(struct chsc_header) -
+                                sizeof(struct chsc_brinfo_naihdr)) /
+                                size;
+                if (!isfirstblock && (rr->naihdr.instance != prev_instance)) {
+                        /* Inform the caller that they need to scrap */
+                        /* the data that was already reported via cb */
+                                rc = -EAGAIN;
+                                break;
+                }
+                isfirstblock = 0;
+                prev_instance = rr->naihdr.instance;
+                for (i = 0; i < elems; i++)
+                        switch (size) {
+                        case sizeof(struct qdio_brinfo_entry_l3_ipv6):
+                                (*cb)(priv, l3_ipv6_addr,
+                                                &rr->entries.l3_ipv6[i]);
+                                break;
+                        case sizeof(struct qdio_brinfo_entry_l3_ipv4):
+                                (*cb)(priv, l3_ipv4_addr,
+                                                &rr->entries.l3_ipv4[i]);
+                                break;
+                        case sizeof(struct qdio_brinfo_entry_l2):
+                                (*cb)(priv, l2_addr_lnid,
+                                                &rr->entries.l2[i]);
+                                break;
+                        default:
+                                WARN_ON_ONCE(1);
+                                rc = -EIO;
+                                goto out;
+                        }
+        } while (rr->response.code == 0x0107 ||  /* channel busy */
+                  (rr->response.code == 1 && /* list stored */
+                   /* resume token is non-zero => list incomplete */
+                   (rr->naihdr.resume_token.t1 || rr->naihdr.resume_token.t2)));
+        (*response) = rr->response.code;
+out:
+        free_page((unsigned long)rr);
+        return rc;
+}
+EXPORT_SYMBOL_GPL(qdio_pnso_brinfo);
 static int __init init_QDIO(void)
 {
        int rc;
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 02300dcfac91..ab3baa7f9508 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -591,7 +591,13 @@ static int ap_init_queue(ap_qid_t qid)
                if (rc != -ENODEV && rc != -EBUSY)
                        break;
                if (i < AP_MAX_RESET - 1) {
-                        udelay(5);
+                        /* Time we are waiting until we give up (0.7sec * 90).
+                         * Since the actual request (in progress) will not
+                         * interrupted immediately for the reset command,
+                         * we have to be patient. In worst case we have to
+                         * wait 60sec + reset time (some msec).
+                         */
+                        schedule_timeout(AP_RESET_TIMEOUT);
                        status = ap_test_queue(qid, &dummy, &dummy);
                }
        }
@@ -992,6 +998,28 @@ static ssize_t ap_domain_show(struct bus_type *bus, char *buf)
 static BUS_ATTR(ap_domain, 0444, ap_domain_show, NULL);
+static ssize_t ap_control_domain_mask_show(struct bus_type *bus, char *buf)
+{
+        if (ap_configuration != NULL) { /* QCI not supported */
+                if (test_facility(76)) { /* format 1 - 256 bit domain field */
+                        return snprintf(buf, PAGE_SIZE,
+                                "0x%08x%08x%08x%08x%08x%08x%08x%08x\n",
+                        ap_configuration->adm[0], ap_configuration->adm[1],
+                        ap_configuration->adm[2], ap_configuration->adm[3],
+                        ap_configuration->adm[4], ap_configuration->adm[5],
+                        ap_configuration->adm[6], ap_configuration->adm[7]);
+                } else { /* format 0 - 16 bit domain field */
+                        return snprintf(buf, PAGE_SIZE, "%08x%08x\n",
+                        ap_configuration->adm[0], ap_configuration->adm[1]);
+                  }
+        } else {
+                return snprintf(buf, PAGE_SIZE, "not supported\n");
+          }
+}
+static BUS_ATTR(ap_control_domain_mask, 0444,
+                ap_control_domain_mask_show, NULL);
 static ssize_t ap_config_time_show(struct bus_type *bus, char *buf)
 {
        return snprintf(buf, PAGE_SIZE, "%d\n", ap_config_time);
@@ -1077,6 +1105,7 @@ static BUS_ATTR(poll_timeout, 0644, poll_timeout_show, poll_timeout_store);
 static struct bus_attribute *const ap_bus_attrs[] = {
        &bus_attr_ap_domain,
+        &bus_attr_ap_control_domain_mask,
        &bus_attr_config_time,
        &bus_attr_poll_thread,
        &bus_attr_ap_interrupts,
diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h
index 685f6cc022f9..6405ae24a7a6 100644
--- a/drivers/s390/crypto/ap_bus.h
+++ b/drivers/s390/crypto/ap_bus.h
@@ -33,7 +33,7 @@
 #define AP_DEVICES 64           /* Number of AP devices. */
 #define AP_DOMAINS 16           /* Number of AP domains. */
 #define AP_MAX_RESET 90         /* Maximum number of resets. */
-#define AP_RESET_TIMEOUT (HZ/2) /* Time in ticks for reset timeouts. */
+#define AP_RESET_TIMEOUT (HZ*0.7)       /* Time in ticks for reset timeouts. */
 #define AP_CONFIG_TIME 30       /* Time in seconds between AP bus rescans. */
 #define AP_POLL_TIME 1          /* Time in ticks between receive polls. */
@@ -125,6 +125,8 @@ static inline int ap_test_bit(unsigned int *ptr, unsigned int nr)
 #define AP_FUNC_CRT4K 2
 #define AP_FUNC_COPRO 3
 #define AP_FUNC_ACCEL 4
+#define AP_FUNC_EP11  5
+#define AP_FUNC_APXA  6
 /*
 * AP reset flag states
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 31cfaa556072..4b824b15194f 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -44,6 +44,8 @@
 #include "zcrypt_debug.h"
 #include "zcrypt_api.h"
+#include "zcrypt_msgtype6.h"
 /*
 * Module description.
 */
@@ -554,9 +556,9 @@ static long zcrypt_send_cprb(struct ica_xcRB *xcRB)
        spin_lock_bh(&zcrypt_device_lock);
        list_for_each_entry(zdev, &zcrypt_device_list, list) {
                if (!zdev->online || !zdev->ops->send_cprb ||
-                    (xcRB->user_defined != AUTOSELECT &&
+                   (zdev->ops->variant == MSGTYPE06_VARIANT_EP11) ||
-                        AP_QID_DEVICE(zdev->ap_dev->qid) != xcRB->user_defined)
+                   (xcRB->user_defined != AUTOSELECT &&
-                    )
+                    AP_QID_DEVICE(zdev->ap_dev->qid) != xcRB->user_defined))
                        continue;
                zcrypt_device_get(zdev);
                get_device(&zdev->ap_dev->device);
@@ -581,6 +583,90 @@ static long zcrypt_send_cprb(struct ica_xcRB *xcRB)
        return -ENODEV;
 }
+struct ep11_target_dev_list {
+        unsigned short          targets_num;
+        struct ep11_target_dev  *targets;
+};
+static bool is_desired_ep11dev(unsigned int dev_qid,
+                               struct ep11_target_dev_list dev_list)
+{
+        int n;
+        for (n = 0; n < dev_list.targets_num; n++, dev_list.targets++) {
+                if ((AP_QID_DEVICE(dev_qid) == dev_list.targets->ap_id) &&
+                    (AP_QID_QUEUE(dev_qid) == dev_list.targets->dom_id)) {
+                        return true;
+                }
+        }
+        return false;
+}
+static long zcrypt_send_ep11_cprb(struct ep11_urb *xcrb)
+{
+        struct zcrypt_device *zdev;
+        bool autoselect = false;
+        int rc;
+        struct ep11_target_dev_list ep11_dev_list = {
+                .targets_num    =  0x00,
+                .targets        =  NULL,
+        };
+        ep11_dev_list.targets_num = (unsigned short) xcrb->targets_num;
+        /* empty list indicates autoselect (all available targets) */
+        if (ep11_dev_list.targets_num == 0)
+                autoselect = true;
+        else {
+                ep11_dev_list.targets = kcalloc((unsigned short)
+                                                xcrb->targets_num,
+                                                sizeof(struct ep11_target_dev),
+                                                GFP_KERNEL);
+                if (!ep11_dev_list.targets)
+                        return -ENOMEM;
+                if (copy_from_user(ep11_dev_list.targets,
+                                   (struct ep11_target_dev *)xcrb->targets,
+                                   xcrb->targets_num *
+                                   sizeof(struct ep11_target_dev)))
+                        return -EFAULT;
+        }
+        spin_lock_bh(&zcrypt_device_lock);
+        list_for_each_entry(zdev, &zcrypt_device_list, list) {
+                /* check if device is eligible */
+                if (!zdev->online ||
+                    zdev->ops->variant != MSGTYPE06_VARIANT_EP11)
+                        continue;
+                /* check if device is selected as valid target */
+                if (!is_desired_ep11dev(zdev->ap_dev->qid, ep11_dev_list) &&
+                    !autoselect)
+                        continue;
+                zcrypt_device_get(zdev);
+                get_device(&zdev->ap_dev->device);
+                zdev->request_count++;
+                __zcrypt_decrease_preference(zdev);
+                if (try_module_get(zdev->ap_dev->drv->driver.owner)) {
+                        spin_unlock_bh(&zcrypt_device_lock);
+                        rc = zdev->ops->send_ep11_cprb(zdev, xcrb);
+                        spin_lock_bh(&zcrypt_device_lock);
+                        module_put(zdev->ap_dev->drv->driver.owner);
+                } else {
+                        rc = -EAGAIN;
+                  }
+                zdev->request_count--;
+                __zcrypt_increase_preference(zdev);
+                put_device(&zdev->ap_dev->device);
+                zcrypt_device_put(zdev);
+                spin_unlock_bh(&zcrypt_device_lock);
+                return rc;
+        }
+        spin_unlock_bh(&zcrypt_device_lock);
+        return -ENODEV;
+}
 static long zcrypt_rng(char *buffer)
 {
        struct zcrypt_device *zdev;
@@ -784,6 +870,23 @@ static long zcrypt_unlocked_ioctl(struct file *filp, unsigned int cmd,
                        return -EFAULT;
                return rc;
        }
+        case ZSENDEP11CPRB: {
+                struct ep11_urb __user *uxcrb = (void __user *)arg;
+                struct ep11_urb xcrb;
+                if (copy_from_user(&xcrb, uxcrb, sizeof(xcrb)))
+                        return -EFAULT;
+                do {
+                        rc = zcrypt_send_ep11_cprb(&xcrb);
+                } while (rc == -EAGAIN);
+                /* on failure: retry once again after a requested rescan */
+                if ((rc == -ENODEV) && (zcrypt_process_rescan()))
+                        do {
+                                rc = zcrypt_send_ep11_cprb(&xcrb);
+                        } while (rc == -EAGAIN);
+                if (copy_to_user(uxcrb, &xcrb, sizeof(xcrb)))
+                        return -EFAULT;
+                return rc;
+        }
        case Z90STAT_STATUS_MASK: {
                char status[AP_DEVICES];
                zcrypt_status_mask(status);
diff --git a/drivers/s390/crypto/zcrypt_api.h b/drivers/s390/crypto/zcrypt_api.h
index 89632919c993..b3d496bfaa7e 100644
--- a/drivers/s390/crypto/zcrypt_api.h
+++ b/drivers/s390/crypto/zcrypt_api.h
@@ -74,6 +74,7 @@ struct ica_z90_status {
 #define ZCRYPT_CEX2A            6
 #define ZCRYPT_CEX3C            7
 #define ZCRYPT_CEX3A            8
+#define ZCRYPT_CEX4            10
 /**
 * Large random numbers are pulled in 4096 byte chunks from the crypto cards
@@ -89,6 +90,7 @@ struct zcrypt_ops {
        long (*rsa_modexpo_crt)(struct zcrypt_device *,
                                struct ica_rsa_modexpo_crt *);
        long (*send_cprb)(struct zcrypt_device *, struct ica_xcRB *);
+        long (*send_ep11_cprb)(struct zcrypt_device *, struct ep11_urb *);
        long (*rng)(struct zcrypt_device *, char *);
        struct list_head list;          /* zcrypt ops list. */
        struct module *owner;
diff --git a/drivers/s390/crypto/zcrypt_cex4.c b/drivers/s390/crypto/zcrypt_cex4.c
index ce1226398ac9..569f8b1d86c0 100644
--- a/drivers/s390/crypto/zcrypt_cex4.c
+++ b/drivers/s390/crypto/zcrypt_cex4.c
@@ -30,7 +30,12 @@
 #define CEX4A_MAX_MESSAGE_SIZE  MSGTYPE50_CRB3_MAX_MSG_SIZE
 #define CEX4C_MAX_MESSAGE_SIZE  MSGTYPE06_MAX_MSG_SIZE
-#define CEX4_CLEANUP_TIME       (15*HZ)
+/* Waiting time for requests to be processed.
+ * Currently there are some types of request which are not deterministic.
+ * But the maximum time limit managed by the stomper code is set to 60sec.
+ * Hence we have to wait at least that time period.
+ */
+#define CEX4_CLEANUP_TIME       (61*HZ)
 static struct ap_device_id zcrypt_cex4_ids[] = {
        { AP_DEVICE(AP_DEVICE_TYPE_CEX4)  },
@@ -101,6 +106,19 @@ static int zcrypt_cex4_probe(struct ap_device *ap_dev)
                        zdev->speed_rating = CEX4C_SPEED_RATING;
                        zdev->ops = zcrypt_msgtype_request(MSGTYPE06_NAME,
                                                           MSGTYPE06_VARIANT_DEFAULT);
+                } else if (ap_test_bit(&ap_dev->functions, AP_FUNC_EP11)) {
+                        zdev = zcrypt_device_alloc(CEX4C_MAX_MESSAGE_SIZE);
+                        if (!zdev)
+                                return -ENOMEM;
+                        zdev->type_string = "CEX4P";
+                        zdev->user_space_type = ZCRYPT_CEX4;
+                        zdev->min_mod_size = CEX4C_MIN_MOD_SIZE;
+                        zdev->max_mod_size = CEX4C_MAX_MOD_SIZE;
+                        zdev->max_exp_bit_length = CEX4C_MAX_MOD_SIZE;
+                        zdev->short_crt = 0;
+                        zdev->speed_rating = CEX4C_SPEED_RATING;
+                        zdev->ops = zcrypt_msgtype_request(MSGTYPE06_NAME,
+                                                        MSGTYPE06_VARIANT_EP11);
                }
                break;
        }
diff --git a/drivers/s390/crypto/zcrypt_error.h b/drivers/s390/crypto/zcrypt_error.h
index 0079b6617211..7b23f43c7b08 100644
--- a/drivers/s390/crypto/zcrypt_error.h
+++ b/drivers/s390/crypto/zcrypt_error.h
@@ -106,15 +106,15 @@ static inline int convert_error(struct zcrypt_device *zdev,
        //   REP88_ERROR_MESSAGE_TYPE           // '20' CEX2A
                /*
                 * To sent a message of the wrong type is a bug in the
-                 * device driver. Warn about it, disable the device
+                 * device driver. Send error msg, disable the device
                 * and then repeat the request.
                 */
-                WARN_ON(1);
                atomic_set(&zcrypt_rescan_req, 1);
                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
-                               zdev->ap_dev->qid,
+                        zdev->ap_dev->qid, zdev->online, ehdr->reply_code);
-                               zdev->online, ehdr->reply_code);
                return -EAGAIN;
        case REP82_ERROR_TRANSPORT_FAIL:
        case REP82_ERROR_MACHINE_FAILURE:
@@ -122,15 +122,17 @@ static inline int convert_error(struct zcrypt_device *zdev,
                /* If a card fails disable it and repeat the request. */
                atomic_set(&zcrypt_rescan_req, 1);
                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
-                               zdev->ap_dev->qid,
+                        zdev->ap_dev->qid, zdev->online, ehdr->reply_code);
-                               zdev->online, ehdr->reply_code);
                return -EAGAIN;
        default:
                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
-                               zdev->ap_dev->qid,
+                        zdev->ap_dev->qid, zdev->online, ehdr->reply_code);
-                               zdev->online, ehdr->reply_code);
                return -EAGAIN; /* repeat the request on a different device. */
        }
 }
diff --git a/drivers/s390/crypto/zcrypt_msgtype50.c b/drivers/s390/crypto/zcrypt_msgtype50.c
index 7c522f338bda..334e282f255b 100644
--- a/drivers/s390/crypto/zcrypt_msgtype50.c
+++ b/drivers/s390/crypto/zcrypt_msgtype50.c
@@ -25,6 +25,9 @@
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
+#define KMSG_COMPONENT "zcrypt"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/init.h>
@@ -332,6 +335,11 @@ static int convert_type80(struct zcrypt_device *zdev,
        if (t80h->len < sizeof(*t80h) + outputdatalength) {
                /* The result is too short, the CEX2A card may not do that.. */
                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid, zdev->online, t80h->code);
                return -EAGAIN; /* repeat the request on a different device. */
        }
        if (zdev->user_space_type == ZCRYPT_CEX2A)
@@ -359,6 +367,10 @@ static int convert_response(struct zcrypt_device *zdev,
                                      outputdata, outputdatalength);
        default: /* Unknown response type, this should NEVER EVER happen */
                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
                return -EAGAIN; /* repeat the request on a different device. */
        }
 }
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.c b/drivers/s390/crypto/zcrypt_msgtype6.c
index 7d97fa5a26d0..dc542e0a3055 100644
--- a/drivers/s390/crypto/zcrypt_msgtype6.c
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -25,6 +25,9 @@
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
+#define KMSG_COMPONENT "zcrypt"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/err.h>
@@ -50,6 +53,7 @@ struct response_type {
 };
 #define PCIXCC_RESPONSE_TYPE_ICA  0
 #define PCIXCC_RESPONSE_TYPE_XCRB 1
+#define PCIXCC_RESPONSE_TYPE_EP11 2
 MODULE_AUTHOR("IBM Corporation");
 MODULE_DESCRIPTION("Cryptographic Coprocessor (message type 6), " \
@@ -358,6 +362,91 @@ static int XCRB_msg_to_type6CPRB_msgX(struct zcrypt_device *zdev,
        return 0;
 }
+static int xcrb_msg_to_type6_ep11cprb_msgx(struct zcrypt_device *zdev,
+                                       struct ap_message *ap_msg,
+                                       struct ep11_urb *xcRB)
+{
+        unsigned int lfmt;
+        static struct type6_hdr static_type6_ep11_hdr = {
+                .type           =  0x06,
+                .rqid           = {0x00, 0x01},
+                .function_code  = {0x00, 0x00},
+                .agent_id[0]    =  0x58,        /* {'X'} */
+                .agent_id[1]    =  0x43,        /* {'C'} */
+                .offset1        =  0x00000058,
+        };
+        struct {
+                struct type6_hdr hdr;
+                struct ep11_cprb cprbx;
+                unsigned char   pld_tag;        /* fixed value 0x30 */
+                unsigned char   pld_lenfmt;     /* payload length format */
+        } __packed * msg = ap_msg->message;
+        struct pld_hdr {
+                unsigned char   func_tag;       /* fixed value 0x4 */
+                unsigned char   func_len;       /* fixed value 0x4 */
+                unsigned int    func_val;       /* function ID     */
+                unsigned char   dom_tag;        /* fixed value 0x4 */
+                unsigned char   dom_len;        /* fixed value 0x4 */
+                unsigned int    dom_val;        /* domain id       */
+        } __packed * payload_hdr;
+        /* length checks */
+        ap_msg->length = sizeof(struct type6_hdr) + xcRB->req_len;
+        if (CEIL4(xcRB->req_len) > MSGTYPE06_MAX_MSG_SIZE -
+                                   (sizeof(struct type6_hdr)))
+                return -EINVAL;
+        if (CEIL4(xcRB->resp_len) > MSGTYPE06_MAX_MSG_SIZE -
+                                    (sizeof(struct type86_fmt2_msg)))
+                return -EINVAL;
+        /* prepare type6 header */
+        msg->hdr = static_type6_ep11_hdr;
+        msg->hdr.ToCardLen1   = xcRB->req_len;
+        msg->hdr.FromCardLen1 = xcRB->resp_len;
+        /* Import CPRB data from the ioctl input parameter */
+        if (copy_from_user(&(msg->cprbx.cprb_len),
+                           (char *)xcRB->req, xcRB->req_len)) {
+                return -EFAULT;
+        }
+        /*
+         The target domain field within the cprb body/payload block will be
+         replaced by the usage domain for non-management commands only.
+         Therefore we check the first bit of the 'flags' parameter for
+         management command indication.
+           0 - non management command
+           1 - management command
+        */
+        if (!((msg->cprbx.flags & 0x80) == 0x80)) {
+                msg->cprbx.target_id = (unsigned int)
+                                        AP_QID_QUEUE(zdev->ap_dev->qid);
+                if ((msg->pld_lenfmt & 0x80) == 0x80) { /*ext.len.fmt 2 or 3*/
+                        switch (msg->pld_lenfmt & 0x03) {
+                        case 1:
+                                lfmt = 2;
+                                break;
+                        case 2:
+                                lfmt = 3;
+                                break;
+                        default:
+                                return -EINVAL;
+                        }
+                } else {
+                        lfmt = 1; /* length format #1 */
+                  }
+                payload_hdr = (struct pld_hdr *)((&(msg->pld_lenfmt))+lfmt);
+                payload_hdr->dom_val = (unsigned int)
+                                        AP_QID_QUEUE(zdev->ap_dev->qid);
+        }
+        return 0;
+}
 /**
 * Copy results from a type 86 ICA reply message back to user space.
 *
@@ -377,6 +466,12 @@ struct type86x_reply {
        char text[0];
 } __packed;
+struct type86_ep11_reply {
+        struct type86_hdr hdr;
+        struct type86_fmt2_ext fmt2;
+        struct ep11_cprb cprbx;
+} __packed;
 static int convert_type86_ica(struct zcrypt_device *zdev,
                          struct ap_message *reply,
                          char __user *outputdata,
@@ -440,6 +535,11 @@ static int convert_type86_ica(struct zcrypt_device *zdev,
                if (service_rc == 8 && service_rs == 72)
                        return -EINVAL;
                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid, zdev->online,
+                               msg->hdr.reply_code);
                return -EAGAIN; /* repeat the request on a different device. */
        }
        data = msg->text;
@@ -503,6 +603,33 @@ static int convert_type86_xcrb(struct zcrypt_device *zdev,
        return 0;
 }
+/**
+ * Copy results from a type 86 EP11 XCRB reply message back to user space.
+ *
+ * @zdev: crypto device pointer
+ * @reply: reply AP message.
+ * @xcRB: pointer to EP11 user request block
+ *
+ * Returns 0 on success or -EINVAL, -EFAULT, -EAGAIN in case of an error.
+ */
+static int convert_type86_ep11_xcrb(struct zcrypt_device *zdev,
+                                    struct ap_message *reply,
+                                    struct ep11_urb *xcRB)
+{
+        struct type86_fmt2_msg *msg = reply->message;
+        char *data = reply->message;
+        if (xcRB->resp_len < msg->fmt2.count1)
+                return -EINVAL;
+        /* Copy response CPRB to user */
+        if (copy_to_user((char *)xcRB->resp,
+                         data + msg->fmt2.offset1, msg->fmt2.count1))
+                return -EFAULT;
+        xcRB->resp_len = msg->fmt2.count1;
+        return 0;
+}
 static int convert_type86_rng(struct zcrypt_device *zdev,
                          struct ap_message *reply,
                          char *buffer)
@@ -551,6 +678,10 @@ static int convert_response_ica(struct zcrypt_device *zdev,
                 * response */
        default: /* Unknown response type, this should NEVER EVER happen */
                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
                return -EAGAIN; /* repeat the request on a different device. */
        }
 }
@@ -579,10 +710,40 @@ static int convert_response_xcrb(struct zcrypt_device *zdev,
        default: /* Unknown response type, this should NEVER EVER happen */
                xcRB->status = 0x0008044DL; /* HDD_InvalidParm */
                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
                return -EAGAIN; /* repeat the request on a different device. */
        }
 }
+static int convert_response_ep11_xcrb(struct zcrypt_device *zdev,
+        struct ap_message *reply, struct ep11_urb *xcRB)
+{
+        struct type86_ep11_reply *msg = reply->message;
+        /* Response type byte is the second byte in the response. */
+        switch (((unsigned char *)reply->message)[1]) {
+        case TYPE82_RSP_CODE:
+        case TYPE87_RSP_CODE:
+                return convert_error(zdev, reply);
+        case TYPE86_RSP_CODE:
+                if (msg->hdr.reply_code)
+                        return convert_error(zdev, reply);
+                if (msg->cprbx.cprb_ver_id == 0x04)
+                        return convert_type86_ep11_xcrb(zdev, reply, xcRB);
+        /* Fall through, no break, incorrect cprb version is an unknown resp.*/
+        default: /* Unknown response type, this should NEVER EVER happen */
+                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
+                return -EAGAIN; /* repeat the request on a different device. */
+        }
+}
 static int convert_response_rng(struct zcrypt_device *zdev,
                                 struct ap_message *reply,
                                 char *data)
@@ -602,6 +763,10 @@ static int convert_response_rng(struct zcrypt_device *zdev,
                 * response */
        default: /* Unknown response type, this should NEVER EVER happen */
                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
                return -EAGAIN; /* repeat the request on a different device. */
        }
 }
@@ -657,6 +822,51 @@ out:
        complete(&(resp_type->work));
 }
+/**
+ * This function is called from the AP bus code after a crypto request
+ * "msg" has finished with the reply message "reply".
+ * It is called from tasklet context.
+ * @ap_dev: pointer to the AP device
+ * @msg: pointer to the AP message
+ * @reply: pointer to the AP reply message
+ */
+static void zcrypt_msgtype6_receive_ep11(struct ap_device *ap_dev,
+                                         struct ap_message *msg,
+                                         struct ap_message *reply)
+{
+        static struct error_hdr error_reply = {
+                .type = TYPE82_RSP_CODE,
+                .reply_code = REP82_ERROR_MACHINE_FAILURE,
+        };
+        struct response_type *resp_type =
+                (struct response_type *)msg->private;
+        struct type86_ep11_reply *t86r;
+        int length;
+        /* Copy the reply message to the request message buffer. */
+        if (IS_ERR(reply)) {
+                memcpy(msg->message, &error_reply, sizeof(error_reply));
+                goto out;
+        }
+        t86r = reply->message;
+        if (t86r->hdr.type == TYPE86_RSP_CODE &&
+            t86r->cprbx.cprb_ver_id == 0x04) {
+                switch (resp_type->type) {
+                case PCIXCC_RESPONSE_TYPE_EP11:
+                        length = t86r->fmt2.offset1 + t86r->fmt2.count1;
+                        length = min(MSGTYPE06_MAX_MSG_SIZE, length);
+                        memcpy(msg->message, reply->message, length);
+                        break;
+                default:
+                        memcpy(msg->message, &error_reply, sizeof(error_reply));
+                }
+        } else {
+                memcpy(msg->message, reply->message, sizeof(error_reply));
+          }
+out:
+        complete(&(resp_type->work));
+}
 static atomic_t zcrypt_step = ATOMIC_INIT(0);
 /**
@@ -782,6 +992,46 @@ out_free:
 }
 /**
+ * The request distributor calls this function if it picked the CEX4P
+ * device to handle a send_ep11_cprb request.
+ * @zdev: pointer to zcrypt_device structure that identifies the
+ *        CEX4P device to the request distributor
+ * @xcRB: pointer to the ep11 user request block
+ */
+static long zcrypt_msgtype6_send_ep11_cprb(struct zcrypt_device *zdev,
+                                                struct ep11_urb *xcrb)
+{
+        struct ap_message ap_msg;
+        struct response_type resp_type = {
+                .type = PCIXCC_RESPONSE_TYPE_EP11,
+        };
+        int rc;
+        ap_init_message(&ap_msg);
+        ap_msg.message = kmalloc(MSGTYPE06_MAX_MSG_SIZE, GFP_KERNEL);
+        if (!ap_msg.message)
+                return -ENOMEM;
+        ap_msg.receive = zcrypt_msgtype6_receive_ep11;
+        ap_msg.psmid = (((unsigned long long) current->pid) << 32) +
+                                atomic_inc_return(&zcrypt_step);
+        ap_msg.private = &resp_type;
+        rc = xcrb_msg_to_type6_ep11cprb_msgx(zdev, &ap_msg, xcrb);
+        if (rc)
+                goto out_free;
+        init_completion(&resp_type.work);
+        ap_queue_message(zdev->ap_dev, &ap_msg);
+        rc = wait_for_completion_interruptible(&resp_type.work);
+        if (rc == 0)
+                rc = convert_response_ep11_xcrb(zdev, &ap_msg, xcrb);
+        else /* Signal pending. */
+                ap_cancel_message(zdev->ap_dev, &ap_msg);
+out_free:
+        kzfree(ap_msg.message);
+        return rc;
+}
+/**
 * The request distributor calls this function if it picked the PCIXCC/CEX2C
 * device to generate random data.
 * @zdev: pointer to zcrypt_device structure that identifies the
@@ -839,10 +1089,19 @@ static struct zcrypt_ops zcrypt_msgtype6_ops = {
        .rng = zcrypt_msgtype6_rng,
 };
+static struct zcrypt_ops zcrypt_msgtype6_ep11_ops = {
+        .owner = THIS_MODULE,
+        .variant = MSGTYPE06_VARIANT_EP11,
+        .rsa_modexpo = NULL,
+        .rsa_modexpo_crt = NULL,
+        .send_ep11_cprb = zcrypt_msgtype6_send_ep11_cprb,
+};
 int __init zcrypt_msgtype6_init(void)
 {
        zcrypt_msgtype_register(&zcrypt_msgtype6_norng_ops);
        zcrypt_msgtype_register(&zcrypt_msgtype6_ops);
+        zcrypt_msgtype_register(&zcrypt_msgtype6_ep11_ops);
        return 0;
 }
@@ -850,6 +1109,7 @@ void __exit zcrypt_msgtype6_exit(void)
 {
        zcrypt_msgtype_unregister(&zcrypt_msgtype6_norng_ops);
        zcrypt_msgtype_unregister(&zcrypt_msgtype6_ops);
+        zcrypt_msgtype_unregister(&zcrypt_msgtype6_ep11_ops);
 }
 module_init(zcrypt_msgtype6_init);
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.h b/drivers/s390/crypto/zcrypt_msgtype6.h
index 1e500d3c0735..207247570623 100644
--- a/drivers/s390/crypto/zcrypt_msgtype6.h
+++ b/drivers/s390/crypto/zcrypt_msgtype6.h
@@ -32,6 +32,7 @@
 #define MSGTYPE06_NAME                  "zcrypt_msgtype6"
 #define MSGTYPE06_VARIANT_DEFAULT       0
 #define MSGTYPE06_VARIANT_NORNG         1
+#define MSGTYPE06_VARIANT_EP11          2
 #define MSGTYPE06_MAX_MSG_SIZE          (12*1024)
@@ -99,6 +100,7 @@ struct type86_hdr {
 } __packed;
 #define TYPE86_RSP_CODE 0x86
+#define TYPE87_RSP_CODE 0x87
 #define TYPE86_FMT2     0x02
 struct type86_fmt2_ext {
diff --git a/drivers/s390/crypto/zcrypt_pcica.c b/drivers/s390/crypto/zcrypt_pcica.c
index f2b71d8df01f..7a743f4c646c 100644
--- a/drivers/s390/crypto/zcrypt_pcica.c
+++ b/drivers/s390/crypto/zcrypt_pcica.c
@@ -24,6 +24,9 @@
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
+#define KMSG_COMPONENT "zcrypt"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/init.h>
@@ -199,6 +202,10 @@ static int convert_type84(struct zcrypt_device *zdev,
        if (t84h->len < sizeof(*t84h) + outputdatalength) {
                /* The result is too short, the PCICA card may not do that.. */
                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid, zdev->online, t84h->code);
                return -EAGAIN; /* repeat the request on a different device. */
        }
        BUG_ON(t84h->len > PCICA_MAX_RESPONSE_SIZE);
@@ -223,6 +230,10 @@ static int convert_response(struct zcrypt_device *zdev,
                                      outputdata, outputdatalength);
        default: /* Unknown response type, this should NEVER EVER happen */
                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
                return -EAGAIN; /* repeat the request on a different device. */
        }
 }
diff --git a/drivers/s390/crypto/zcrypt_pcicc.c b/drivers/s390/crypto/zcrypt_pcicc.c
index 0d90a4334055..4d14c04b746e 100644
--- a/drivers/s390/crypto/zcrypt_pcicc.c
+++ b/drivers/s390/crypto/zcrypt_pcicc.c
@@ -24,6 +24,9 @@
 * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
 */
+#define KMSG_COMPONENT "zcrypt"
+#define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/gfp.h>
@@ -372,6 +375,11 @@ static int convert_type86(struct zcrypt_device *zdev,
                if (service_rc == 8 && service_rs == 72)
                        return -EINVAL;
                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%drc%d",
+                               zdev->ap_dev->qid, zdev->online,
+                               msg->hdr.reply_code);
                return -EAGAIN; /* repeat the request on a different device. */
        }
        data = msg->text;
@@ -425,6 +433,10 @@ static int convert_response(struct zcrypt_device *zdev,
                /* no break, incorrect cprb version is an unknown response */
        default: /* Unknown response type, this should NEVER EVER happen */
                zdev->online = 0;
+                pr_err("Cryptographic device %x failed and was set offline\n",
+                       zdev->ap_dev->qid);
+                ZCRYPT_DBF_DEV(DBF_ERR, zdev, "dev%04xo%dfail",
+                               zdev->ap_dev->qid, zdev->online);
                return -EAGAIN; /* repeat the request on a different device. */
        }
 }
diff --git a/drivers/scsi/a2091.c b/drivers/scsi/a2091.c
index 30fa38a0ad39..9176bfbd5745 100644
--- a/drivers/scsi/a2091.c
+++ b/drivers/scsi/a2091.c
@@ -201,7 +201,7 @@ static int a2091_probe(struct zorro_dev *z, const struct zorro_device_id *ent)
        instance->irq = IRQ_AMIGA_PORTS;
        instance->unique_id = z->slotaddr;
-        regs = (struct a2091_scsiregs *)ZTWO_VADDR(z->resource.start);
+        regs = ZTWO_VADDR(z->resource.start);
        regs->DAWR = DAWR_A2091;
        wdregs.SASR = &regs->SASR;
diff --git a/drivers/scsi/a3000.c b/drivers/scsi/a3000.c
index c0f4f4290dd6..dd5b64726ddc 100644
--- a/drivers/scsi/a3000.c
+++ b/drivers/scsi/a3000.c
@@ -220,7 +220,7 @@ static int __init amiga_a3000_scsi_probe(struct platform_device *pdev)
        instance->irq = IRQ_AMIGA_PORTS;
-        regs = (struct a3000_scsiregs *)ZTWO_VADDR(res->start);
+        regs = ZTWO_VADDR(res->start);
        regs->DAWR = DAWR_A3000;
        wdregs.SASR = &regs->SASR;
diff --git a/drivers/scsi/a4000t.c b/drivers/scsi/a4000t.c
index 70c521f79f7c..f5a2ab41543b 100644
--- a/drivers/scsi/a4000t.c
+++ b/drivers/scsi/a4000t.c
@@ -56,7 +56,7 @@ static int __init amiga_a4000t_scsi_probe(struct platform_device *pdev)
        scsi_addr = res->start + A4000T_SCSI_OFFSET;
        /* Fill in the required pieces of hostdata */
-        hostdata->base = (void __iomem *)ZTWO_VADDR(scsi_addr);
+        hostdata->base = ZTWO_VADDR(scsi_addr);
        hostdata->clock = 50;
        hostdata->chip710 = 1;
        hostdata->dmode_extra = DMODE_FC2;
diff --git a/drivers/scsi/gvp11.c b/drivers/scsi/gvp11.c
index 2203ac281103..3b6f83ffddc4 100644
--- a/drivers/scsi/gvp11.c
+++ b/drivers/scsi/gvp11.c
@@ -310,7 +310,7 @@ static int gvp11_probe(struct zorro_dev *z, const struct zorro_device_id *ent)
        if (!request_mem_region(address, 256, "wd33c93"))
                return -EBUSY;
-        regs = (struct gvp11_scsiregs *)(ZTWO_VADDR(address));
+        regs = ZTWO_VADDR(address);
        error = check_wd33c93(regs);
        if (error)
diff --git a/drivers/scsi/zorro7xx.c b/drivers/scsi/zorro7xx.c
index cbf3476c68cd..aff31991aea9 100644
--- a/drivers/scsi/zorro7xx.c
+++ b/drivers/scsi/zorro7xx.c
@@ -104,7 +104,7 @@ static int zorro7xx_init_one(struct zorro_dev *z,
        if (ioaddr > 0x01000000)
                hostdata->base = ioremap(ioaddr, zorro_resource_len(z));
        else
-                hostdata->base = (void __iomem *)ZTWO_VADDR(ioaddr);
+                hostdata->base = ZTWO_VADDR(ioaddr);
        hostdata->clock = 50;
        hostdata->chip710 = 1;
diff --git a/drivers/staging/bcm/Bcmnet.c b/drivers/staging/bcm/Bcmnet.c
index 53fee2f9a498..8dfdd2732bdc 100644
--- a/drivers/staging/bcm/Bcmnet.c
+++ b/drivers/staging/bcm/Bcmnet.c
@@ -39,7 +39,8 @@ static INT bcm_close(struct net_device *dev)
        return 0;
 }
-static u16 bcm_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 bcm_select_queue(struct net_device *dev, struct sk_buff *skb,
+                            void *accel_priv)
 {
        return ClassifyPacket(netdev_priv(dev), skb);
 }
diff --git a/drivers/staging/netlogic/xlr_net.c b/drivers/staging/netlogic/xlr_net.c
index 235d2b1ec593..eedffed17e39 100644
--- a/drivers/staging/netlogic/xlr_net.c
+++ b/drivers/staging/netlogic/xlr_net.c
@@ -306,7 +306,8 @@ static netdev_tx_t xlr_net_start_xmit(struct sk_buff *skb,
        return NETDEV_TX_OK;
 }
-static u16 xlr_net_select_queue(struct net_device *ndev, struct sk_buff *skb)
+static u16 xlr_net_select_queue(struct net_device *ndev, struct sk_buff *skb,
+                                void *accel_priv)
 {
        return (u16)smp_processor_id();
 }
diff --git a/drivers/staging/rtl8188eu/os_dep/os_intfs.c b/drivers/staging/rtl8188eu/os_dep/os_intfs.c
index 17659bb04bef..dd69e344e409 100644
--- a/drivers/staging/rtl8188eu/os_dep/os_intfs.c
+++ b/drivers/staging/rtl8188eu/os_dep/os_intfs.c
@@ -652,7 +652,8 @@ static unsigned int rtw_classify8021d(struct sk_buff *skb)
        return dscp >> 5;
 }
-static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb)
+static u16 rtw_select_queue(struct net_device *dev, struct sk_buff *skb,
+                            void *accel_priv)
 {
        struct adapter  *padapter = rtw_netdev_priv(dev);
        struct mlme_priv *pmlmepriv = &padapter->mlmepriv;
diff --git a/drivers/thermal/intel_powerclamp.c b/drivers/thermal/intel_powerclamp.c
index 8f181b3f842b..d833c8f5b465 100644
--- a/drivers/thermal/intel_powerclamp.c
+++ b/drivers/thermal/intel_powerclamp.c
@@ -438,14 +438,12 @@ static int clamp_thread(void *arg)
                         */
                        local_touch_nmi();
                        stop_critical_timings();
-                        __monitor((void *)&current_thread_info()->flags, 0, 0);
+                        mwait_idle_with_hints(eax, ecx);
-                        cpu_relax(); /* allow HT sibling to run */
-                        __mwait(eax, ecx);
                        start_critical_timings();
                        atomic_inc(&idle_wakeup_counter);
                }
                tick_nohz_idle_exit();
-                preempt_enable_no_resched();
+                preempt_enable();
        }
        del_timer_sync(&wakeup_timer);
        clear_bit(cpunr, cpu_clamping_mask);
diff --git a/drivers/uio/uio.c b/drivers/uio/uio.c
index f7beb6eb40c7..a673e5b6a2e0 100644
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -847,7 +847,7 @@ int __uio_register_device(struct module *owner,
        info->uio_dev = idev;
        if (info->irq && (info->irq != UIO_IRQ_CUSTOM)) {
-                ret = devm_request_irq(parent, info->irq, uio_interrupt,
+                ret = devm_request_irq(idev->dev, info->irq, uio_interrupt,
                                  info->irq_flags, info->name, idev);
                if (ret)
                        goto err_request_irq;
diff --git a/drivers/uio/uio_mf624.c b/drivers/uio/uio_mf624.c
index f764adbfe036..d1f95a1567bb 100644
--- a/drivers/uio/uio_mf624.c
+++ b/drivers/uio/uio_mf624.c
@@ -228,7 +228,7 @@ static void mf624_pci_remove(struct pci_dev *dev)
        kfree(info);
 }
-static DEFINE_PCI_DEVICE_TABLE(mf624_pci_id) = {
+static const struct pci_device_id mf624_pci_id[] = {
        { PCI_DEVICE(PCI_VENDOR_ID_HUMUSOFT, PCI_DEVICE_ID_MF624) },
        { 0, }
 };
diff --git a/drivers/video/amifb.c b/drivers/video/amifb.c
index 0dac36ce09d6..518f790ef88a 100644
--- a/drivers/video/amifb.c
+++ b/drivers/video/amifb.c
@@ -3710,7 +3710,7 @@ default_chipset:
        if (!videomemory) {
                dev_warn(&pdev->dev,
                         "Unable to map videomem cached writethrough\n");
-                info->screen_base = (char *)ZTWO_VADDR(info->fix.smem_start);
+                info->screen_base = ZTWO_VADDR(info->fix.smem_start);
        } else
                info->screen_base = (char *)videomemory;
diff --git a/drivers/video/cirrusfb.c b/drivers/video/cirrusfb.c
index 5aab9b9dc210..d992aa5eb3f0 100644
--- a/drivers/video/cirrusfb.c
+++ b/drivers/video/cirrusfb.c
@@ -2256,7 +2256,7 @@ static int cirrusfb_zorro_register(struct zorro_dev *z,
        info->fix.mmio_start = regbase;
        cinfo->regbase = regbase > 16 * MB_ ? ioremap(regbase, 64 * 1024)
-                                            : (caddr_t)ZTWO_VADDR(regbase);
+                                            : ZTWO_VADDR(regbase);
        if (!cinfo->regbase) {
                dev_err(info->device, "Cannot map registers\n");
                error = -EIO;
@@ -2266,7 +2266,7 @@ static int cirrusfb_zorro_register(struct zorro_dev *z,
        info->fix.smem_start = rambase;
        info->screen_size = ramsize;
        info->screen_base = rambase > 16 * MB_ ? ioremap(rambase, ramsize)
-                                               : (caddr_t)ZTWO_VADDR(rambase);
+                                               : ZTWO_VADDR(rambase);
        if (!info->screen_base) {
                dev_err(info->device, "Cannot map video RAM\n");
                error = -EIO;
diff --git a/drivers/video/macfb.c b/drivers/video/macfb.c
index 5bd2eb8d4f39..cda7587cbc86 100644
--- a/drivers/video/macfb.c
+++ b/drivers/video/macfb.c
@@ -34,7 +34,6 @@
 #include <linux/fb.h>
 #include <asm/setup.h>
-#include <asm/bootinfo.h>
 #include <asm/macintosh.h>
 #include <asm/io.h>
diff --git a/drivers/video/valkyriefb.c b/drivers/video/valkyriefb.c
index e287ebc47817..97cb9bd1d1dd 100644
--- a/drivers/video/valkyriefb.c
+++ b/drivers/video/valkyriefb.c
@@ -56,7 +56,6 @@
 #include <linux/cuda.h>
 #include <asm/io.h>
 #ifdef CONFIG_MAC
-#include <asm/bootinfo.h>
 #include <asm/macintosh.h>
 #else
 #include <asm/prom.h>
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index c444654fc33f..5c4a95b516cf 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -285,7 +285,7 @@ static void update_balloon_size(struct virtio_balloon *vb)
 {
        __le32 actual = cpu_to_le32(vb->num_pages);
-        virtio_cwrite(vb->vdev, struct virtio_balloon_config, num_pages,
+        virtio_cwrite(vb->vdev, struct virtio_balloon_config, actual,
                      &actual);
 }
diff --git a/drivers/w1/masters/mxc_w1.c b/drivers/w1/masters/mxc_w1.c
index 15c7251b0556..1e5d94c5afc9 100644
--- a/drivers/w1/masters/mxc_w1.c
+++ b/drivers/w1/masters/mxc_w1.c
@@ -46,7 +46,6 @@
 struct mxc_w1_device {
        void __iomem *regs;
-        unsigned int clkdiv;
        struct clk *clk;
        struct w1_bus_master bus_master;
 };
@@ -106,8 +105,10 @@ static u8 mxc_w1_ds2_touch_bit(void *data, u8 bit)
 static int mxc_w1_probe(struct platform_device *pdev)
 {
        struct mxc_w1_device *mdev;
+        unsigned long clkrate;
        struct resource *res;
-        int err = 0;
+        unsigned int clkdiv;
+        int err;
        mdev = devm_kzalloc(&pdev->dev, sizeof(struct mxc_w1_device),
                            GFP_KERNEL);
@@ -118,27 +119,39 @@ static int mxc_w1_probe(struct platform_device *pdev)
        if (IS_ERR(mdev->clk))
                return PTR_ERR(mdev->clk);
-        mdev->clkdiv = (clk_get_rate(mdev->clk) / 1000000) - 1;
+        clkrate = clk_get_rate(mdev->clk);
+        if (clkrate < 10000000)
+                dev_warn(&pdev->dev,
+                         "Low clock frequency causes improper function\n");
+        clkdiv = DIV_ROUND_CLOSEST(clkrate, 1000000);
+        clkrate /= clkdiv;
+        if ((clkrate < 980000) || (clkrate > 1020000))
+                dev_warn(&pdev->dev,
+                         "Incorrect time base frequency %lu Hz\n", clkrate);
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        mdev->regs = devm_ioremap_resource(&pdev->dev, res);
        if (IS_ERR(mdev->regs))
                return PTR_ERR(mdev->regs);
-        clk_prepare_enable(mdev->clk);
+        err = clk_prepare_enable(mdev->clk);
-        __raw_writeb(mdev->clkdiv, mdev->regs + MXC_W1_TIME_DIVIDER);
+        if (err)
+                return err;
+        __raw_writeb(clkdiv - 1, mdev->regs + MXC_W1_TIME_DIVIDER);
        mdev->bus_master.data = mdev;
        mdev->bus_master.reset_bus = mxc_w1_ds2_reset_bus;
        mdev->bus_master.touch_bit = mxc_w1_ds2_touch_bit;
-        err = w1_add_master_device(&mdev->bus_master);
+        platform_set_drvdata(pdev, mdev);
+        err = w1_add_master_device(&mdev->bus_master);
        if (err)
-                return err;
+                clk_disable_unprepare(mdev->clk);
-        platform_set_drvdata(pdev, mdev);
+        return err;
-        return 0;
 }
 /*
diff --git a/drivers/zorro/Makefile b/drivers/zorro/Makefile
index f62172603215..7dc5332ff984 100644
--- a/drivers/zorro/Makefile
+++ b/drivers/zorro/Makefile
@@ -2,8 +2,9 @@
 # Makefile for the Zorro bus specific drivers.
 #
-obj-$(CONFIG_ZORRO)     += zorro.o zorro-driver.o zorro-sysfs.o names.o
+obj-$(CONFIG_ZORRO)     += zorro.o zorro-driver.o zorro-sysfs.o
 obj-$(CONFIG_PROC_FS)   += proc.o
+obj-$(CONFIG_ZORRO_NAMES) +=  names.o
 hostprogs-y             := gen-devlist
diff --git a/drivers/zorro/names.c b/drivers/zorro/names.c
index e8517c3d8e82..6f3fd9903ac3 100644
--- a/drivers/zorro/names.c
+++ b/drivers/zorro/names.c
@@ -15,8 +15,6 @@
 #include <linux/zorro.h>
-#ifdef CONFIG_ZORRO_NAMES
 struct zorro_prod_info {
        __u16 prod;
        unsigned short seen;
@@ -69,7 +67,6 @@ void __init zorro_name_device(struct zorro_dev *dev)
        } while (--i);
        /* Couldn't find either the manufacturer nor the product */
-        sprintf(name, "Zorro device %08x", dev->id);
        return;
        match_manuf: {
@@ -98,11 +95,3 @@ void __init zorro_name_device(struct zorro_dev *dev)
                }
        }
 }
-#else
-void __init zorro_name_device(struct zorro_dev *dev)
-{
-}
-#endif
diff --git a/drivers/zorro/proc.c b/drivers/zorro/proc.c
index ea1ce822a8e0..6ac2579da0eb 100644
--- a/drivers/zorro/proc.c
+++ b/drivers/zorro/proc.c
@@ -14,6 +14,8 @@
 #include <linux/seq_file.h>
 #include <linux/init.h>
 #include <linux/export.h>
+#include <asm/byteorder.h>
 #include <asm/uaccess.h>
 #include <asm/amigahw.h>
 #include <asm/setup.h>
@@ -41,10 +43,10 @@ proc_bus_zorro_read(struct file *file, char __user *buf, size_t nbytes, loff_t *
        /* Construct a ConfigDev */
        memset(&cd, 0, sizeof(cd));
        cd.cd_Rom = z->rom;
-        cd.cd_SlotAddr = z->slotaddr;
+        cd.cd_SlotAddr = cpu_to_be16(z->slotaddr);
-        cd.cd_SlotSize = z->slotsize;
+        cd.cd_SlotSize = cpu_to_be16(z->slotsize);
-        cd.cd_BoardAddr = (void *)zorro_resource_start(z);
+        cd.cd_BoardAddr = cpu_to_be32(zorro_resource_start(z));
-        cd.cd_BoardSize = zorro_resource_len(z);
+        cd.cd_BoardSize = cpu_to_be32(zorro_resource_len(z));
        if (copy_to_user(buf, (void *)&cd + pos, nbytes))
                return -EFAULT;
diff --git a/drivers/zorro/zorro-driver.c b/drivers/zorro/zorro-driver.c
index ac1db7f1bcab..eacae1434b73 100644
--- a/drivers/zorro/zorro-driver.c
+++ b/drivers/zorro/zorro-driver.c
@@ -161,11 +161,12 @@ static int zorro_uevent(struct device *dev, struct kobj_uevent_env *env)
 }
 struct bus_type zorro_bus_type = {
-        .name   = "zorro",
+        .name     = "zorro",
-        .match  = zorro_bus_match,
+        .dev_name = "zorro",
-        .uevent = zorro_uevent,
+        .match    = zorro_bus_match,
-        .probe  = zorro_device_probe,
+        .uevent   = zorro_uevent,
-        .remove = zorro_device_remove,
+        .probe    = zorro_device_probe,
+        .remove   = zorro_device_remove,
 };
 EXPORT_SYMBOL(zorro_bus_type);
diff --git a/drivers/zorro/zorro-sysfs.c b/drivers/zorro/zorro-sysfs.c
index 26f7184ef9e1..36b210f9b6b2 100644
--- a/drivers/zorro/zorro-sysfs.c
+++ b/drivers/zorro/zorro-sysfs.c
@@ -16,6 +16,8 @@
 #include <linux/stat.h>
 #include <linux/string.h>
+#include <asm/byteorder.h>
 #include "zorro.h"
@@ -33,10 +35,20 @@ static DEVICE_ATTR(name, S_IRUGO, show_##name, NULL);
 zorro_config_attr(id, id, "0x%08x\n");
 zorro_config_attr(type, rom.er_Type, "0x%02x\n");
-zorro_config_attr(serial, rom.er_SerialNumber, "0x%08x\n");
 zorro_config_attr(slotaddr, slotaddr, "0x%04x\n");
 zorro_config_attr(slotsize, slotsize, "0x%04x\n");
+static ssize_t
+show_serial(struct device *dev, struct device_attribute *attr, char *buf)
+{
+        struct zorro_dev *z;
+        z = to_zorro_dev(dev);
+        return sprintf(buf, "0x%08x\n", be32_to_cpu(z->rom.er_SerialNumber));
+}
+static DEVICE_ATTR(serial, S_IRUGO, show_serial, NULL);
 static ssize_t zorro_show_resource(struct device *dev, struct device_attribute *attr, char *buf)
 {
        struct zorro_dev *z = to_zorro_dev(dev);
@@ -60,10 +72,10 @@ static ssize_t zorro_read_config(struct file *filp, struct kobject *kobj,
        /* Construct a ConfigDev */
        memset(&cd, 0, sizeof(cd));
        cd.cd_Rom = z->rom;
-        cd.cd_SlotAddr = z->slotaddr;
+        cd.cd_SlotAddr = cpu_to_be16(z->slotaddr);
-        cd.cd_SlotSize = z->slotsize;
+        cd.cd_SlotSize = cpu_to_be16(z->slotsize);
-        cd.cd_BoardAddr = (void *)zorro_resource_start(z);
+        cd.cd_BoardAddr = cpu_to_be32(zorro_resource_start(z));
-        cd.cd_BoardSize = zorro_resource_len(z);
+        cd.cd_BoardSize = cpu_to_be32(zorro_resource_len(z));
        return memory_read_from_buffer(buf, count, &off, &cd, sizeof(cd));
 }
diff --git a/drivers/zorro/zorro.c b/drivers/zorro/zorro.c
index 858c9714b2f3..707c1a5a0317 100644
--- a/drivers/zorro/zorro.c
+++ b/drivers/zorro/zorro.c
@@ -18,6 +18,7 @@
 #include <linux/platform_device.h>
 #include <linux/slab.h>
+#include <asm/byteorder.h>
 #include <asm/setup.h>
 #include <asm/amigahw.h>
@@ -29,7 +30,8 @@
     */
 unsigned int zorro_num_autocon;
-struct zorro_dev zorro_autocon[ZORRO_NUM_AUTO];
+struct zorro_dev_init zorro_autocon_init[ZORRO_NUM_AUTO] __initdata;
+struct zorro_dev *zorro_autocon;
    /*
@@ -38,6 +40,7 @@ struct zorro_dev zorro_autocon[ZORRO_NUM_AUTO];
 struct zorro_bus {
        struct device dev;
+        struct zorro_dev devices[0];
 };
@@ -125,18 +128,22 @@ static struct resource __init *zorro_find_parent_resource(
 static int __init amiga_zorro_probe(struct platform_device *pdev)
 {
        struct zorro_bus *bus;
+        struct zorro_dev_init *zi;
        struct zorro_dev *z;
        struct resource *r;
        unsigned int i;
        int error;
        /* Initialize the Zorro bus */
-        bus = kzalloc(sizeof(*bus), GFP_KERNEL);
+        bus = kzalloc(sizeof(*bus) +
+                      zorro_num_autocon * sizeof(bus->devices[0]),
+                      GFP_KERNEL);
        if (!bus)
                return -ENOMEM;
+        zorro_autocon = bus->devices;
        bus->dev.parent = &pdev->dev;
-        dev_set_name(&bus->dev, "zorro");
+        dev_set_name(&bus->dev, zorro_bus_type.name);
        error = device_register(&bus->dev);
        if (error) {
                pr_err("Zorro: Error registering zorro_bus\n");
@@ -151,15 +158,23 @@ static int __init amiga_zorro_probe(struct platform_device *pdev)
        /* First identify all devices ... */
        for (i = 0; i < zorro_num_autocon; i++) {
+                zi = &zorro_autocon_init[i];
                z = &zorro_autocon[i];
-                z->id = (z->rom.er_Manufacturer<<16) | (z->rom.er_Product<<8);
+                z->rom = zi->rom;
+                z->id = (be16_to_cpu(z->rom.er_Manufacturer) << 16) |
+                        (z->rom.er_Product << 8);
                if (z->id == ZORRO_PROD_GVP_EPC_BASE) {
                        /* GVP quirk */
-                        unsigned long magic = zorro_resource_start(z)+0x8000;
+                        unsigned long magic = zi->boardaddr + 0x8000;
                        z->id |= *(u16 *)ZTWO_VADDR(magic) & GVP_PRODMASK;
                }
+                z->slotaddr = zi->slotaddr;
+                z->slotsize = zi->slotsize;
                sprintf(z->name, "Zorro device %08x", z->id);
                zorro_name_device(z);
+                z->resource.start = zi->boardaddr;
+                z->resource.end = zi->boardaddr + zi->boardsize - 1;
                z->resource.name = z->name;
                r = zorro_find_parent_resource(pdev, z);
                error = request_resource(r, &z->resource);
@@ -167,9 +182,9 @@ static int __init amiga_zorro_probe(struct platform_device *pdev)
                        dev_err(&bus->dev,
                                "Address space collision on device %s %pR\n",
                                z->name, &z->resource);
-                dev_set_name(&z->dev, "%02x", i);
                z->dev.parent = &bus->dev;
                z->dev.bus = &zorro_bus_type;
+                z->dev.id = i;
        }
        /* ... then register them */
diff --git a/drivers/zorro/zorro.h b/drivers/zorro/zorro.h
index b682d5ccd63f..34119fb4e560 100644
--- a/drivers/zorro/zorro.h
+++ b/drivers/zorro/zorro.h
@@ -1,4 +1,9 @@
+#ifdef CONFIG_ZORRO_NAMES
 extern void zorro_name_device(struct zorro_dev *z);
+#else
+static inline void zorro_name_device(struct zorro_dev *dev) { }
+#endif
 extern int zorro_create_sysfs_dev_files(struct zorro_dev *z);
diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index aa3397620342..2c29db6a247e 100644
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -477,9 +477,10 @@ extern int CIFSGetExtAttr(const unsigned int xid, struct cifs_tcon *tcon,
                        const int netfid, __u64 *pExtAttrBits, __u64 *pMask);
 extern void cifs_autodisable_serverino(struct cifs_sb_info *cifs_sb);
 extern bool CIFSCouldBeMFSymlink(const struct cifs_fattr *fattr);
-extern int CIFSCheckMFSymlink(struct cifs_fattr *fattr,
+extern int CIFSCheckMFSymlink(unsigned int xid, struct cifs_tcon *tcon,
-                const unsigned char *path,
+                              struct cifs_sb_info *cifs_sb,
-                struct cifs_sb_info *cifs_sb, unsigned int xid);
+                              struct cifs_fattr *fattr,
+                              const unsigned char *path);
 extern int mdfour(unsigned char *, unsigned char *, int);
 extern int E_md4hash(const unsigned char *passwd, unsigned char *p16,
                        const struct nls_table *codepage);
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 124aa0230c1b..d707edb6b852 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -4010,7 +4010,7 @@ QFileInfoRetry:
        rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
                         (struct smb_hdr *) pSMBr, &bytes_returned, 0);
        if (rc) {
-                cifs_dbg(FYI, "Send error in QPathInfo = %d\n", rc);
+                cifs_dbg(FYI, "Send error in QFileInfo = %d", rc);
        } else {                /* decode response */
                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
@@ -4179,7 +4179,7 @@ UnixQFileInfoRetry:
        rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
                         (struct smb_hdr *) pSMBr, &bytes_returned, 0);
        if (rc) {
-                cifs_dbg(FYI, "Send error in QPathInfo = %d\n", rc);
+                cifs_dbg(FYI, "Send error in UnixQFileInfo = %d", rc);
        } else {                /* decode response */
                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
@@ -4263,7 +4263,7 @@ UnixQPathInfoRetry:
        rc = SendReceive(xid, tcon->ses, (struct smb_hdr *) pSMB,
                         (struct smb_hdr *) pSMBr, &bytes_returned, 0);
        if (rc) {
-                cifs_dbg(FYI, "Send error in QPathInfo = %d\n", rc);
+                cifs_dbg(FYI, "Send error in UnixQPathInfo = %d", rc);
        } else {                /* decode response */
                rc = validate_t2((struct smb_t2_rsp *)pSMBr);
diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
index 11ff5f116b20..a514e0a65f69 100644
--- a/fs/cifs/dir.c
+++ b/fs/cifs/dir.c
@@ -193,7 +193,7 @@ check_name(struct dentry *direntry)
 static int
 cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid,
               struct tcon_link *tlink, unsigned oflags, umode_t mode,
-               __u32 *oplock, struct cifs_fid *fid, int *created)
+               __u32 *oplock, struct cifs_fid *fid)
 {
        int rc = -ENOENT;
        int create_options = CREATE_NOT_DIR;
@@ -349,7 +349,6 @@ cifs_do_create(struct inode *inode, struct dentry *direntry, unsigned int xid,
                                .device = 0,
                };
-                *created |= FILE_CREATED;
                if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_SET_UID) {
                        args.uid = current_fsuid();
                        if (inode->i_mode & S_ISGID)
@@ -480,13 +479,16 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
        cifs_add_pending_open(&fid, tlink, &open);
        rc = cifs_do_create(inode, direntry, xid, tlink, oflags, mode,
-                            &oplock, &fid, opened);
+                            &oplock, &fid);
        if (rc) {
                cifs_del_pending_open(&open);
                goto out;
        }
+        if ((oflags & (O_CREAT | O_EXCL)) == (O_CREAT | O_EXCL))
+                *opened |= FILE_CREATED;
        rc = finish_open(file, direntry, generic_file_open, opened);
        if (rc) {
                if (server->ops->close)
@@ -529,7 +531,6 @@ int cifs_create(struct inode *inode, struct dentry *direntry, umode_t mode,
        struct TCP_Server_Info *server;
        struct cifs_fid fid;
        __u32 oplock;
-        int created = FILE_CREATED;
        cifs_dbg(FYI, "cifs_create parent inode = 0x%p name is: %s and dentry = 0x%p\n",
                 inode, direntry->d_name.name, direntry);
@@ -546,7 +547,7 @@ int cifs_create(struct inode *inode, struct dentry *direntry, umode_t mode,
                server->ops->new_lease_key(&fid);
        rc = cifs_do_create(inode, direntry, xid, tlink, oflags, mode,
-                            &oplock, &fid, &created);
+                            &oplock, &fid);
        if (!rc && server->ops->close)
                server->ops->close(xid, tcon, &fid);
diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c
index 36f9ebb93ceb..49719b8228e5 100644
--- a/fs/cifs/inode.c
+++ b/fs/cifs/inode.c
@@ -383,7 +383,8 @@ int cifs_get_inode_info_unix(struct inode **pinode,
        /* check for Minshall+French symlinks */
        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MF_SYMLINKS) {
-                int tmprc = CIFSCheckMFSymlink(&fattr, full_path, cifs_sb, xid);
+                int tmprc = CIFSCheckMFSymlink(xid, tcon, cifs_sb, &fattr,
+                                               full_path);
                if (tmprc)
                        cifs_dbg(FYI, "CIFSCheckMFSymlink: %d\n", tmprc);
        }
@@ -799,7 +800,8 @@ cifs_get_inode_info(struct inode **inode, const char *full_path,
        /* check for Minshall+French symlinks */
        if (cifs_sb->mnt_cifs_flags & CIFS_MOUNT_MF_SYMLINKS) {
-                tmprc = CIFSCheckMFSymlink(&fattr, full_path, cifs_sb, xid);
+                tmprc = CIFSCheckMFSymlink(xid, tcon, cifs_sb, &fattr,
+                                           full_path);
                if (tmprc)
                        cifs_dbg(FYI, "CIFSCheckMFSymlink: %d\n", tmprc);
        }
diff --git a/fs/cifs/link.c b/fs/cifs/link.c
index cc0234710ddb..92aee08483a5 100644
--- a/fs/cifs/link.c
+++ b/fs/cifs/link.c
@@ -354,34 +354,30 @@ open_query_close_cifs_symlink(const unsigned char *path, char *pbuf,
 int
-CIFSCheckMFSymlink(struct cifs_fattr *fattr,
+CIFSCheckMFSymlink(unsigned int xid, struct cifs_tcon *tcon,
-                   const unsigned char *path,
+                   struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr,
-                   struct cifs_sb_info *cifs_sb, unsigned int xid)
+                   const unsigned char *path)
 {
-        int rc = 0;
+        int rc;
        u8 *buf = NULL;
        unsigned int link_len = 0;
        unsigned int bytes_read = 0;
-        struct cifs_tcon *ptcon;
        if (!CIFSCouldBeMFSymlink(fattr))
                /* it's not a symlink */
                return 0;
        buf = kmalloc(CIFS_MF_SYMLINK_FILE_SIZE, GFP_KERNEL);
-        if (!buf) {
+        if (!buf)
-                rc = -ENOMEM;
+                return -ENOMEM;
-                goto out;
-        }
-        ptcon = tlink_tcon(cifs_sb_tlink(cifs_sb));
+        if (tcon->ses->server->ops->query_mf_symlink)
-        if ((ptcon->ses) && (ptcon->ses->server->ops->query_mf_symlink))
+                rc = tcon->ses->server->ops->query_mf_symlink(path, buf,
-                rc = ptcon->ses->server->ops->query_mf_symlink(path, buf,
+                                                &bytes_read, cifs_sb, xid);
-                                                 &bytes_read, cifs_sb, xid);
        else
-                goto out;
+                rc = -ENOSYS;
-        if (rc != 0)
+        if (rc)
                goto out;
        if (bytes_read == 0) /* not a symlink */
diff --git a/fs/dcache.c b/fs/dcache.c
index 6055d61811d3..cb4a10690868 100644
--- a/fs/dcache.c
+++ b/fs/dcache.c
@@ -3061,8 +3061,13 @@ char *d_path(const struct path *path, char *buf, int buflen)
         * thus don't need to be hashed.  They also don't need a name until a
         * user wants to identify the object in /proc/pid/fd/.  The little hack
         * below allows us to generate a name for these objects on demand:
+         *
+         * Some pseudo inodes are mountable.  When they are mounted
+         * path->dentry == path->mnt->mnt_root.  In that case don't call d_dname
+         * and instead have d_path return the mounted path.
         */
-        if (path->dentry->d_op && path->dentry->d_op->d_dname)
+        if (path->dentry->d_op && path->dentry->d_op->d_dname &&
+            (!IS_ROOT(path->dentry) || path->dentry != path->mnt->mnt_root))
                return path->dentry->d_op->d_dname(path->dentry, buf, buflen);
        rcu_read_lock();
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 8b5e2584c840..af903128891c 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1907,10 +1907,6 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                        }
                }
        }
-        if (op == EPOLL_CTL_DEL && is_file_epoll(tf.file)) {
-                tep = tf.file->private_data;
-                mutex_lock_nested(&tep->mtx, 1);
-        }
        /*
         * Try to lookup the file inside our RB tree, Since we grabbed "mtx"
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 288534920fe5..20d6697bd638 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -1493,6 +1493,7 @@ static ssize_t ext2_quota_write(struct super_block *sb, int type,
                                sb->s_blocksize - offset : towrite;
                tmp_bh.b_state = 0;
+                tmp_bh.b_size = sb->s_blocksize;
                err = ext2_get_block(inode, blk, &tmp_bh, 1);
                if (err < 0)
                        goto out;
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index e6185031c1cc..ece55565b9cd 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -268,6 +268,16 @@ struct ext4_io_submit {
 /* Translate # of blks to # of clusters */
 #define EXT4_NUM_B2C(sbi, blks) (((blks) + (sbi)->s_cluster_ratio - 1) >> \
                                 (sbi)->s_cluster_bits)
+/* Mask out the low bits to get the starting block of the cluster */
+#define EXT4_PBLK_CMASK(s, pblk) ((pblk) &                              \
+                                  ~((ext4_fsblk_t) (s)->s_cluster_ratio - 1))
+#define EXT4_LBLK_CMASK(s, lblk) ((lblk) &                              \
+                                  ~((ext4_lblk_t) (s)->s_cluster_ratio - 1))
+/* Get the cluster offset */
+#define EXT4_PBLK_COFF(s, pblk) ((pblk) &                               \
+                                 ((ext4_fsblk_t) (s)->s_cluster_ratio - 1))
+#define EXT4_LBLK_COFF(s, lblk) ((lblk) &                               \
+                                 ((ext4_lblk_t) (s)->s_cluster_ratio - 1))
 /*
 * Structure of a blocks group descriptor
diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c
index 17ac112ab101..3fe29de832c8 100644
--- a/fs/ext4/ext4_jbd2.c
+++ b/fs/ext4/ext4_jbd2.c
@@ -259,6 +259,15 @@ int __ext4_handle_dirty_metadata(const char *where, unsigned int line,
                if (WARN_ON_ONCE(err)) {
                        ext4_journal_abort_handle(where, line, __func__, bh,
                                                  handle, err);
+                        ext4_error_inode(inode, where, line,
+                                         bh->b_blocknr,
+                                         "journal_dirty_metadata failed: "
+                                         "handle type %u started at line %u, "
+                                         "credits %u/%u, errcode %d",
+                                         handle->h_type,
+                                         handle->h_line_no,
+                                         handle->h_requested_credits,
+                                         handle->h_buffer_credits, err);
                }
        } else {
                if (inode)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 35f65cf4f318..3384dc4bed40 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -360,8 +360,10 @@ static int ext4_valid_extent(struct inode *inode, struct ext4_extent *ext)
 {
        ext4_fsblk_t block = ext4_ext_pblock(ext);
        int len = ext4_ext_get_actual_len(ext);
+        ext4_lblk_t lblock = le32_to_cpu(ext->ee_block);
+        ext4_lblk_t last = lblock + len - 1;
-        if (len == 0)
+        if (lblock > last)
                return 0;
        return ext4_data_block_valid(EXT4_SB(inode->i_sb), block, len);
 }
@@ -387,11 +389,26 @@ static int ext4_valid_extent_entries(struct inode *inode,
        if (depth == 0) {
                /* leaf entries */
                struct ext4_extent *ext = EXT_FIRST_EXTENT(eh);
+                struct ext4_super_block *es = EXT4_SB(inode->i_sb)->s_es;
+                ext4_fsblk_t pblock = 0;
+                ext4_lblk_t lblock = 0;
+                ext4_lblk_t prev = 0;
+                int len = 0;
                while (entries) {
                        if (!ext4_valid_extent(inode, ext))
                                return 0;
+                        /* Check for overlapping extents */
+                        lblock = le32_to_cpu(ext->ee_block);
+                        len = ext4_ext_get_actual_len(ext);
+                        if ((lblock <= prev) && prev) {
+                                pblock = ext4_ext_pblock(ext);
+                                es->s_last_error_block = cpu_to_le64(pblock);
+                                return 0;
+                        }
                        ext++;
                        entries--;
+                        prev = lblock + len - 1;
                }
        } else {
                struct ext4_extent_idx *ext_idx = EXT_FIRST_INDEX(eh);
@@ -1834,8 +1851,7 @@ static unsigned int ext4_ext_check_overlap(struct ext4_sb_info *sbi,
        depth = ext_depth(inode);
        if (!path[depth].p_ext)
                goto out;
-        b2 = le32_to_cpu(path[depth].p_ext->ee_block);
+        b2 = EXT4_LBLK_CMASK(sbi, le32_to_cpu(path[depth].p_ext->ee_block));
-        b2 &= ~(sbi->s_cluster_ratio - 1);
        /*
         * get the next allocated block if the extent in the path
@@ -1845,7 +1861,7 @@ static unsigned int ext4_ext_check_overlap(struct ext4_sb_info *sbi,
                b2 = ext4_ext_next_allocated_block(path);
                if (b2 == EXT_MAX_BLOCKS)
                        goto out;
-                b2 &= ~(sbi->s_cluster_ratio - 1);
+                b2 = EXT4_LBLK_CMASK(sbi, b2);
        }
        /* check for wrap through zero on extent logical start block*/
@@ -2504,7 +2520,7 @@ static int ext4_remove_blocks(handle_t *handle, struct inode *inode,
                 * extent, we have to mark the cluster as used (store negative
                 * cluster number in partial_cluster).
                 */
-                unaligned = pblk & (sbi->s_cluster_ratio - 1);
+                unaligned = EXT4_PBLK_COFF(sbi, pblk);
                if (unaligned && (ee_len == num) &&
                    (*partial_cluster != -((long long)EXT4_B2C(sbi, pblk))))
                        *partial_cluster = EXT4_B2C(sbi, pblk);
@@ -2598,7 +2614,7 @@ ext4_ext_rm_leaf(handle_t *handle, struct inode *inode,
                         * accidentally freeing it later on
                         */
                        pblk = ext4_ext_pblock(ex);
-                        if (pblk & (sbi->s_cluster_ratio - 1))
+                        if (EXT4_PBLK_COFF(sbi, pblk))
                                *partial_cluster =
                                        -((long long)EXT4_B2C(sbi, pblk));
                        ex--;
@@ -3753,7 +3769,7 @@ int ext4_find_delalloc_cluster(struct inode *inode, ext4_lblk_t lblk)
 {
        struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
        ext4_lblk_t lblk_start, lblk_end;
-        lblk_start = lblk & (~(sbi->s_cluster_ratio - 1));
+        lblk_start = EXT4_LBLK_CMASK(sbi, lblk);
        lblk_end = lblk_start + sbi->s_cluster_ratio - 1;
        return ext4_find_delalloc_range(inode, lblk_start, lblk_end);
@@ -3812,9 +3828,9 @@ get_reserved_cluster_alloc(struct inode *inode, ext4_lblk_t lblk_start,
        trace_ext4_get_reserved_cluster_alloc(inode, lblk_start, num_blks);
        /* Check towards left side */
-        c_offset = lblk_start & (sbi->s_cluster_ratio - 1);
+        c_offset = EXT4_LBLK_COFF(sbi, lblk_start);
        if (c_offset) {
-                lblk_from = lblk_start & (~(sbi->s_cluster_ratio - 1));
+                lblk_from = EXT4_LBLK_CMASK(sbi, lblk_start);
                lblk_to = lblk_from + c_offset - 1;
                if (ext4_find_delalloc_range(inode, lblk_from, lblk_to))
@@ -3822,7 +3838,7 @@ get_reserved_cluster_alloc(struct inode *inode, ext4_lblk_t lblk_start,
        }
        /* Now check towards right. */
-        c_offset = (lblk_start + num_blks) & (sbi->s_cluster_ratio - 1);
+        c_offset = EXT4_LBLK_COFF(sbi, lblk_start + num_blks);
        if (allocated_clusters && c_offset) {
                lblk_from = lblk_start + num_blks;
                lblk_to = lblk_from + (sbi->s_cluster_ratio - c_offset) - 1;
@@ -4030,7 +4046,7 @@ static int get_implied_cluster_alloc(struct super_block *sb,
                                     struct ext4_ext_path *path)
 {
        struct ext4_sb_info *sbi = EXT4_SB(sb);
-        ext4_lblk_t c_offset = map->m_lblk & (sbi->s_cluster_ratio-1);
+        ext4_lblk_t c_offset = EXT4_LBLK_COFF(sbi, map->m_lblk);
        ext4_lblk_t ex_cluster_start, ex_cluster_end;
        ext4_lblk_t rr_cluster_start;
        ext4_lblk_t ee_block = le32_to_cpu(ex->ee_block);
@@ -4048,8 +4064,7 @@ static int get_implied_cluster_alloc(struct super_block *sb,
            (rr_cluster_start == ex_cluster_start)) {
                if (rr_cluster_start == ex_cluster_end)
                        ee_start += ee_len - 1;
-                map->m_pblk = (ee_start & ~(sbi->s_cluster_ratio - 1)) +
+                map->m_pblk = EXT4_PBLK_CMASK(sbi, ee_start) + c_offset;
-                        c_offset;
                map->m_len = min(map->m_len,
                                 (unsigned) sbi->s_cluster_ratio - c_offset);
                /*
@@ -4203,7 +4218,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
         */
        map->m_flags &= ~EXT4_MAP_FROM_CLUSTER;
        newex.ee_block = cpu_to_le32(map->m_lblk);
-        cluster_offset = map->m_lblk & (sbi->s_cluster_ratio-1);
+        cluster_offset = EXT4_LBLK_COFF(sbi, map->m_lblk);
        /*
         * If we are doing bigalloc, check to see if the extent returned
@@ -4271,7 +4286,7 @@ int ext4_ext_map_blocks(handle_t *handle, struct inode *inode,
         * needed so that future calls to get_implied_cluster_alloc()
         * work correctly.
         */
-        offset = map->m_lblk & (sbi->s_cluster_ratio - 1);
+        offset = EXT4_LBLK_COFF(sbi, map->m_lblk);
        ar.len = EXT4_NUM_B2C(sbi, offset+allocated);
        ar.goal -= offset;
        ar.logical -= offset;
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 075763474118..61d49ff22c81 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -1206,7 +1206,6 @@ static int ext4_journalled_write_end(struct file *file,
 */
 static int ext4_da_reserve_metadata(struct inode *inode, ext4_lblk_t lblock)
 {
-        int retries = 0;
        struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
        struct ext4_inode_info *ei = EXT4_I(inode);
        unsigned int md_needed;
@@ -1218,7 +1217,6 @@ static int ext4_da_reserve_metadata(struct inode *inode, ext4_lblk_t lblock)
         * in order to allocate nrblocks
         * worse case is one extent per block
         */
-repeat:
        spin_lock(&ei->i_block_reservation_lock);
        /*
         * ext4_calc_metadata_amount() has side effects, which we have
@@ -1238,10 +1236,6 @@ repeat:
                ei->i_da_metadata_calc_len = save_len;
                ei->i_da_metadata_calc_last_lblock = save_last_lblock;
                spin_unlock(&ei->i_block_reservation_lock);
-                if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
-                        cond_resched();
-                        goto repeat;
-                }
                return -ENOSPC;
        }
        ei->i_reserved_meta_blocks += md_needed;
@@ -1255,7 +1249,6 @@ repeat:
 */
 static int ext4_da_reserve_space(struct inode *inode, ext4_lblk_t lblock)
 {
-        int retries = 0;
        struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
        struct ext4_inode_info *ei = EXT4_I(inode);
        unsigned int md_needed;
@@ -1277,7 +1270,6 @@ static int ext4_da_reserve_space(struct inode *inode, ext4_lblk_t lblock)
         * in order to allocate nrblocks
         * worse case is one extent per block
         */
-repeat:
        spin_lock(&ei->i_block_reservation_lock);
        /*
         * ext4_calc_metadata_amount() has side effects, which we have
@@ -1297,10 +1289,6 @@ repeat:
                ei->i_da_metadata_calc_len = save_len;
                ei->i_da_metadata_calc_last_lblock = save_last_lblock;
                spin_unlock(&ei->i_block_reservation_lock);
-                if (ext4_should_retry_alloc(inode->i_sb, &retries)) {
-                        cond_resched();
-                        goto repeat;
-                }
                dquot_release_reservation_block(inode, EXT4_C2B(sbi, 1));
                return -ENOSPC;
        }
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 4d113efa024c..04a5c7504be9 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3442,6 +3442,9 @@ static void ext4_mb_pa_callback(struct rcu_head *head)
 {
        struct ext4_prealloc_space *pa;
        pa = container_of(head, struct ext4_prealloc_space, u.pa_rcu);
+        BUG_ON(atomic_read(&pa->pa_count));
+        BUG_ON(pa->pa_deleted == 0);
        kmem_cache_free(ext4_pspace_cachep, pa);
 }
@@ -3455,11 +3458,13 @@ static void ext4_mb_put_pa(struct ext4_allocation_context *ac,
        ext4_group_t grp;
        ext4_fsblk_t grp_blk;
-        if (!atomic_dec_and_test(&pa->pa_count) || pa->pa_free != 0)
-                return;
        /* in this short window concurrent discard can set pa_deleted */
        spin_lock(&pa->pa_lock);
+        if (!atomic_dec_and_test(&pa->pa_count) || pa->pa_free != 0) {
+                spin_unlock(&pa->pa_lock);
+                return;
+        }
        if (pa->pa_deleted == 1) {
                spin_unlock(&pa->pa_lock);
                return;
@@ -4121,7 +4126,7 @@ ext4_mb_initialize_context(struct ext4_allocation_context *ac,
        ext4_get_group_no_and_offset(sb, goal, &group, &block);
        /* set up allocation goals */
-        ac->ac_b_ex.fe_logical = ar->logical & ~(sbi->s_cluster_ratio - 1);
+        ac->ac_b_ex.fe_logical = EXT4_LBLK_CMASK(sbi, ar->logical);
        ac->ac_status = AC_STATUS_CONTINUE;
        ac->ac_sb = sb;
        ac->ac_inode = ar->inode;
@@ -4663,7 +4668,7 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
         * blocks at the beginning or the end unless we are explicitly
         * requested to avoid doing so.
         */
-        overflow = block & (sbi->s_cluster_ratio - 1);
+        overflow = EXT4_PBLK_COFF(sbi, block);
        if (overflow) {
                if (flags & EXT4_FREE_BLOCKS_NOFREE_FIRST_CLUSTER) {
                        overflow = sbi->s_cluster_ratio - overflow;
@@ -4677,7 +4682,7 @@ void ext4_free_blocks(handle_t *handle, struct inode *inode,
                        count += overflow;
                }
        }
-        overflow = count & (sbi->s_cluster_ratio - 1);
+        overflow = EXT4_LBLK_COFF(sbi, count);
        if (overflow) {
                if (flags & EXT4_FREE_BLOCKS_NOFREE_LAST_CLUSTER) {
                        if (count > overflow)
diff --git a/fs/ext4/super.c b/fs/ext4/super.c
index c977f4e4e63b..1f7784de05b6 100644
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -792,7 +792,7 @@ static void ext4_put_super(struct super_block *sb)
        }
        ext4_es_unregister_shrinker(sbi);
-        del_timer(&sbi->s_err_report);
+        del_timer_sync(&sbi->s_err_report);
        ext4_release_system_zone(sb);
        ext4_mb_release(sb);
        ext4_ext_release(sb);
@@ -3316,11 +3316,19 @@ int ext4_calculate_overhead(struct super_block *sb)
 }
-static ext4_fsblk_t ext4_calculate_resv_clusters(struct ext4_sb_info *sbi)
+static ext4_fsblk_t ext4_calculate_resv_clusters(struct super_block *sb)
 {
        ext4_fsblk_t resv_clusters;
        /*
+         * There's no need to reserve anything when we aren't using extents.
+         * The space estimates are exact, there are no unwritten extents,
+         * hole punching doesn't need new metadata... This is needed especially
+         * to keep ext2/3 backward compatibility.
+         */
+        if (!EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_EXTENTS))
+                return 0;
+        /*
         * By default we reserve 2% or 4096 clusters, whichever is smaller.
         * This should cover the situations where we can not afford to run
         * out of space like for example punch hole, or converting
@@ -3328,7 +3336,8 @@ static ext4_fsblk_t ext4_calculate_resv_clusters(struct ext4_sb_info *sbi)
         * allocation would require 1, or 2 blocks, higher numbers are
         * very rare.
         */
-        resv_clusters = ext4_blocks_count(sbi->s_es) >> sbi->s_cluster_bits;
+        resv_clusters = ext4_blocks_count(EXT4_SB(sb)->s_es) >>
+                        EXT4_SB(sb)->s_cluster_bits;
        do_div(resv_clusters, 50);
        resv_clusters = min_t(ext4_fsblk_t, resv_clusters, 4096);
@@ -4071,10 +4080,10 @@ no_journal:
                         "available");
        }
-        err = ext4_reserve_clusters(sbi, ext4_calculate_resv_clusters(sbi));
+        err = ext4_reserve_clusters(sbi, ext4_calculate_resv_clusters(sb));
        if (err) {
                ext4_msg(sb, KERN_ERR, "failed to reserve %llu clusters for "
-                         "reserved pool", ext4_calculate_resv_clusters(sbi));
+                         "reserved pool", ext4_calculate_resv_clusters(sb));
                goto failed_mount4a;
        }
@@ -4184,7 +4193,7 @@ failed_mount_wq:
        }
 failed_mount3:
        ext4_es_unregister_shrinker(sbi);
-        del_timer(&sbi->s_err_report);
+        del_timer_sync(&sbi->s_err_report);
        if (sbi->s_flex_groups)
                ext4_kvfree(sbi->s_flex_groups);
        percpu_counter_destroy(&sbi->s_freeclusters_counter);
diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 1f4a10ece2f1..e0259a163f98 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -516,13 +516,16 @@ writeback_single_inode(struct inode *inode, struct bdi_writeback *wb,
        }
        WARN_ON(inode->i_state & I_SYNC);
        /*
-         * Skip inode if it is clean. We don't want to mess with writeback
+         * Skip inode if it is clean and we have no outstanding writeback in
-         * lists in this function since flusher thread may be doing for example
+         * WB_SYNC_ALL mode. We don't want to mess with writeback lists in this
-         * sync in parallel and if we move the inode, it could get skipped. So
+         * function since flusher thread may be doing for example sync in
-         * here we make sure inode is on some writeback list and leave it there
+         * parallel and if we move the inode, it could get skipped. So here we
-         * unless we have completely cleaned the inode.
+         * make sure inode is on some writeback list and leave it there unless
+         * we have completely cleaned the inode.
         */
-        if (!(inode->i_state & I_DIRTY))
+        if (!(inode->i_state & I_DIRTY) &&
+            (wbc->sync_mode != WB_SYNC_ALL ||
+             !mapping_tagged(inode->i_mapping, PAGECACHE_TAG_WRITEBACK)))
                goto out;
        inode->i_state |= I_SYNC;
        spin_unlock(&inode->i_lock);
diff --git a/fs/gfs2/aops.c b/fs/gfs2/aops.c
index b7fc035a6943..73f3e4ee4037 100644
--- a/fs/gfs2/aops.c
+++ b/fs/gfs2/aops.c
@@ -986,6 +986,7 @@ static ssize_t gfs2_direct_IO(int rw, struct kiocb *iocb,
 {
        struct file *file = iocb->ki_filp;
        struct inode *inode = file->f_mapping->host;
+        struct address_space *mapping = inode->i_mapping;
        struct gfs2_inode *ip = GFS2_I(inode);
        struct gfs2_holder gh;
        int rv;
@@ -1006,6 +1007,35 @@ static ssize_t gfs2_direct_IO(int rw, struct kiocb *iocb,
        if (rv != 1)
                goto out; /* dio not valid, fall back to buffered i/o */
+        /*
+         * Now since we are holding a deferred (CW) lock at this point, you
+         * might be wondering why this is ever needed. There is a case however
+         * where we've granted a deferred local lock against a cached exclusive
+         * glock. That is ok provided all granted local locks are deferred, but
+         * it also means that it is possible to encounter pages which are
+         * cached and possibly also mapped. So here we check for that and sort
+         * them out ahead of the dio. The glock state machine will take care of
+         * everything else.
+         *
+         * If in fact the cached glock state (gl->gl_state) is deferred (CW) in
+         * the first place, mapping->nr_pages will always be zero.
+         */
+        if (mapping->nrpages) {
+                loff_t lstart = offset & (PAGE_CACHE_SIZE - 1);
+                loff_t len = iov_length(iov, nr_segs);
+                loff_t end = PAGE_ALIGN(offset + len) - 1;
+                rv = 0;
+                if (len == 0)
+                        goto out;
+                if (test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
+                        unmap_shared_mapping_range(ip->i_inode.i_mapping, offset, len);
+                rv = filemap_write_and_wait_range(mapping, lstart, end);
+                if (rv)
+                        return rv;
+                truncate_inode_pages_range(mapping, lstart, end);
+        }
        rv = __blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
                                  offset, nr_segs, gfs2_get_block_direct,
                                  NULL, NULL, 0);
diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c
index c8420f7e4db6..6f7a47c05259 100644
--- a/fs/gfs2/glock.c
+++ b/fs/gfs2/glock.c
@@ -1655,6 +1655,7 @@ static int dump_holder(struct seq_file *seq, const struct gfs2_holder *gh)
        struct task_struct *gh_owner = NULL;
        char flags_buf[32];
+        rcu_read_lock();
        if (gh->gh_owner_pid)
                gh_owner = pid_task(gh->gh_owner_pid, PIDTYPE_PID);
        gfs2_print_dbg(seq, " H: s:%s f:%s e:%d p:%ld [%s] %pS\n",
@@ -1664,6 +1665,7 @@ static int dump_holder(struct seq_file *seq, const struct gfs2_holder *gh)
                       gh->gh_owner_pid ? (long)pid_nr(gh->gh_owner_pid) : -1,
                       gh_owner ? gh_owner->comm : "(ended)",
                       (void *)gh->gh_ip);
+        rcu_read_unlock();
        return 0;
 }
diff --git a/fs/gfs2/glops.c b/fs/gfs2/glops.c
index db908f697139..f88dcd925010 100644
--- a/fs/gfs2/glops.c
+++ b/fs/gfs2/glops.c
@@ -192,8 +192,11 @@ static void inode_go_sync(struct gfs2_glock *gl)
        if (ip && !S_ISREG(ip->i_inode.i_mode))
                ip = NULL;
-        if (ip && test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
+        if (ip) {
-                unmap_shared_mapping_range(ip->i_inode.i_mapping, 0, 0);
+                if (test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
+                        unmap_shared_mapping_range(ip->i_inode.i_mapping, 0, 0);
+                inode_dio_wait(&ip->i_inode);
+        }
        if (!test_and_clear_bit(GLF_DIRTY, &gl->gl_flags))
                return;
@@ -410,6 +413,9 @@ static int inode_go_lock(struct gfs2_holder *gh)
                        return error;
        }
+        if (gh->gh_state != LM_ST_DEFERRED)
+                inode_dio_wait(&ip->i_inode);
        if ((ip->i_diskflags & GFS2_DIF_TRUNC_IN_PROG) &&
            (gl->gl_state == LM_ST_EXCLUSIVE) &&
            (gh->gh_state == LM_ST_EXCLUSIVE)) {
diff --git a/fs/gfs2/log.c b/fs/gfs2/log.c
index 610613fb65b5..9dcb9777a5f8 100644
--- a/fs/gfs2/log.c
+++ b/fs/gfs2/log.c
@@ -551,10 +551,10 @@ void gfs2_add_revoke(struct gfs2_sbd *sdp, struct gfs2_bufdata *bd)
        struct buffer_head *bh = bd->bd_bh;
        struct gfs2_glock *gl = bd->bd_gl;
-        gfs2_remove_from_ail(bd);
-        bd->bd_bh = NULL;
        bh->b_private = NULL;
        bd->bd_blkno = bh->b_blocknr;
+        gfs2_remove_from_ail(bd); /* drops ref on bh */
+        bd->bd_bh = NULL;
        bd->bd_ops = &gfs2_revoke_lops;
        sdp->sd_log_num_revoke++;
        atomic_inc(&gl->gl_revokes);
diff --git a/fs/gfs2/meta_io.c b/fs/gfs2/meta_io.c
index 932415050540..52f177be3bf8 100644
--- a/fs/gfs2/meta_io.c
+++ b/fs/gfs2/meta_io.c
@@ -258,6 +258,7 @@ void gfs2_remove_from_journal(struct buffer_head *bh, struct gfs2_trans *tr, int
        struct address_space *mapping = bh->b_page->mapping;
        struct gfs2_sbd *sdp = gfs2_mapping2sbd(mapping);
        struct gfs2_bufdata *bd = bh->b_private;
+        int was_pinned = 0;
        if (test_clear_buffer_pinned(bh)) {
                trace_gfs2_pin(bd, 0);
@@ -273,12 +274,16 @@ void gfs2_remove_from_journal(struct buffer_head *bh, struct gfs2_trans *tr, int
                        tr->tr_num_databuf_rm++;
                }
                tr->tr_touched = 1;
+                was_pinned = 1;
                brelse(bh);
        }
        if (bd) {
                spin_lock(&sdp->sd_ail_lock);
                if (bd->bd_tr) {
                        gfs2_trans_add_revoke(sdp, bd);
+                } else if (was_pinned) {
+                        bh->b_private = NULL;
+                        kmem_cache_free(gfs2_bufdata_cachep, bd);
                }
                spin_unlock(&sdp->sd_ail_lock);
        }
diff --git a/fs/gfs2/ops_fstype.c b/fs/gfs2/ops_fstype.c
index 82303b474958..52fa88314f5c 100644
--- a/fs/gfs2/ops_fstype.c
+++ b/fs/gfs2/ops_fstype.c
@@ -1366,8 +1366,18 @@ static struct dentry *gfs2_mount(struct file_system_type *fs_type, int flags,
        if (IS_ERR(s))
                goto error_bdev;
-        if (s->s_root)
+        if (s->s_root) {
+                /*
+                 * s_umount nests inside bd_mutex during
+                 * __invalidate_device().  blkdev_put() acquires
+                 * bd_mutex and can't be called under s_umount.  Drop
+                 * s_umount temporarily.  This is safe as we're
+                 * holding an active reference.
+                 */
+                up_write(&s->s_umount);
                blkdev_put(bdev, mode);
+                down_write(&s->s_umount);
+        }
        memset(&args, 0, sizeof(args));
        args.ar_quota = GFS2_QUOTA_DEFAULT;
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 52032647dd4a..5fa344afb49a 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -702,7 +702,7 @@ int jbd2_log_wait_commit(journal_t *journal, tid_t tid)
        read_lock(&journal->j_state_lock);
 #ifdef CONFIG_JBD2_DEBUG
        if (!tid_geq(journal->j_commit_request, tid)) {
-                printk(KERN_EMERG
+                printk(KERN_ERR
                       "%s: error: j_commit_request=%d, tid=%d\n",
                       __func__, journal->j_commit_request, tid);
        }
@@ -718,10 +718,8 @@ int jbd2_log_wait_commit(journal_t *journal, tid_t tid)
        }
        read_unlock(&journal->j_state_lock);
-        if (unlikely(is_journal_aborted(journal))) {
+        if (unlikely(is_journal_aborted(journal)))
-                printk(KERN_EMERG "journal commit I/O error\n");
                err = -EIO;
-        }
        return err;
 }
@@ -1527,13 +1525,13 @@ static int journal_get_superblock(journal_t *journal)
        if (JBD2_HAS_COMPAT_FEATURE(journal, JBD2_FEATURE_COMPAT_CHECKSUM) &&
            JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
                /* Can't have checksum v1 and v2 on at the same time! */
-                printk(KERN_ERR "JBD: Can't enable checksumming v1 and v2 "
+                printk(KERN_ERR "JBD2: Can't enable checksumming v1 and v2 "
                       "at the same time!\n");
                goto out;
        }
        if (!jbd2_verify_csum_type(journal, sb)) {
-                printk(KERN_ERR "JBD: Unknown checksum type\n");
+                printk(KERN_ERR "JBD2: Unknown checksum type\n");
                goto out;
        }
@@ -1541,7 +1539,7 @@ static int journal_get_superblock(journal_t *journal)
        if (JBD2_HAS_INCOMPAT_FEATURE(journal, JBD2_FEATURE_INCOMPAT_CSUM_V2)) {
                journal->j_chksum_driver = crypto_alloc_shash("crc32c", 0, 0);
                if (IS_ERR(journal->j_chksum_driver)) {
-                        printk(KERN_ERR "JBD: Cannot load crc32c driver.\n");
+                        printk(KERN_ERR "JBD2: Cannot load crc32c driver.\n");
                        err = PTR_ERR(journal->j_chksum_driver);
                        journal->j_chksum_driver = NULL;
                        goto out;
@@ -1550,7 +1548,7 @@ static int journal_get_superblock(journal_t *journal)
        /* Check superblock checksum */
        if (!jbd2_superblock_csum_verify(journal, sb)) {
-                printk(KERN_ERR "JBD: journal checksum error\n");
+                printk(KERN_ERR "JBD2: journal checksum error\n");
                goto out;
        }
@@ -1836,7 +1834,7 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
                        journal->j_chksum_driver = crypto_alloc_shash("crc32c",
                                                                      0, 0);
                        if (IS_ERR(journal->j_chksum_driver)) {
-                                printk(KERN_ERR "JBD: Cannot load crc32c "
+                                printk(KERN_ERR "JBD2: Cannot load crc32c "
                                       "driver.\n");
                                journal->j_chksum_driver = NULL;
                                return 0;
@@ -2645,7 +2643,7 @@ static void __exit journal_exit(void)
 #ifdef CONFIG_JBD2_DEBUG
        int n = atomic_read(&nr_journal_heads);
        if (n)
-                printk(KERN_EMERG "JBD2: leaked %d journal_heads!\n", n);
+                printk(KERN_ERR "JBD2: leaked %d journal_heads!\n", n);
 #endif
        jbd2_remove_jbd_stats_proc_entry();
        jbd2_journal_destroy_caches();
diff --git a/fs/jbd2/recovery.c b/fs/jbd2/recovery.c
index 3929c50428b1..3b6bb19d60b1 100644
--- a/fs/jbd2/recovery.c
+++ b/fs/jbd2/recovery.c
@@ -594,7 +594,7 @@ static int do_one_pass(journal_t *journal,
                                                be32_to_cpu(tmp->h_sequence))) {
                                                brelse(obh);
                                                success = -EIO;
-                                                printk(KERN_ERR "JBD: Invalid "
+                                                printk(KERN_ERR "JBD2: Invalid "
                                                       "checksum recovering "
                                                       "block %llu in log\n",
                                                       blocknr);
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 7aa9a32573bb..8360674c85bc 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -932,7 +932,7 @@ repeat:
                                        jbd2_alloc(jh2bh(jh)->b_size,
                                                         GFP_NOFS);
                                if (!frozen_buffer) {
-                                        printk(KERN_EMERG
+                                        printk(KERN_ERR
                                               "%s: OOM for frozen_buffer\n",
                                               __func__);
                                        JBUFFER_TRACE(jh, "oom!");
@@ -1166,7 +1166,7 @@ repeat:
        if (!jh->b_committed_data) {
                committed_data = jbd2_alloc(jh2bh(jh)->b_size, GFP_NOFS);
                if (!committed_data) {
-                        printk(KERN_EMERG "%s: No memory for committed data\n",
+                        printk(KERN_ERR "%s: No memory for committed data\n",
                                __func__);
                        err = -ENOMEM;
                        goto out;
@@ -1290,7 +1290,10 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
                 * once a transaction -bzzz
                 */
                jh->b_modified = 1;
-                J_ASSERT_JH(jh, handle->h_buffer_credits > 0);
+                if (handle->h_buffer_credits <= 0) {
+                        ret = -ENOSPC;
+                        goto out_unlock_bh;
+                }
                handle->h_buffer_credits--;
        }
@@ -1305,7 +1308,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
                JBUFFER_TRACE(jh, "fastpath");
                if (unlikely(jh->b_transaction !=
                             journal->j_running_transaction)) {
-                        printk(KERN_EMERG "JBD: %s: "
+                        printk(KERN_ERR "JBD2: %s: "
                               "jh->b_transaction (%llu, %p, %u) != "
                               "journal->j_running_transaction (%p, %u)",
                               journal->j_devname,
@@ -1332,7 +1335,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
                JBUFFER_TRACE(jh, "already on other transaction");
                if (unlikely(jh->b_transaction !=
                             journal->j_committing_transaction)) {
-                        printk(KERN_EMERG "JBD: %s: "
+                        printk(KERN_ERR "JBD2: %s: "
                               "jh->b_transaction (%llu, %p, %u) != "
                               "journal->j_committing_transaction (%p, %u)",
                               journal->j_devname,
@@ -1345,7 +1348,7 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh)
                        ret = -EINVAL;
                }
                if (unlikely(jh->b_next_transaction != transaction)) {
-                        printk(KERN_EMERG "JBD: %s: "
+                        printk(KERN_ERR "JBD2: %s: "
                               "jh->b_next_transaction (%llu, %p, %u) != "
                               "transaction (%p, %u)",
                               journal->j_devname,
@@ -1373,7 +1376,6 @@ out_unlock_bh:
        jbd2_journal_put_journal_head(jh);
 out:
        JBUFFER_TRACE(jh, "exit");
-        WARN_ON(ret);   /* All errors are bugs, so dump the stack */
        return ret;
 }
diff --git a/fs/namespace.c b/fs/namespace.c
index a511ea003f89..22e536705c45 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2888,7 +2888,7 @@ bool fs_fully_visible(struct file_system_type *type)
                        struct inode *inode = child->mnt_mountpoint->d_inode;
                        if (!S_ISDIR(inode->i_mode))
                                goto next;
-                        if (inode->i_nlink != 2)
+                        if (inode->i_nlink > 2)
                                goto next;
                }
                visible = true;
diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index 9f6b486b6c01..a1a191634abc 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -1440,17 +1440,19 @@ static int nilfs_segctor_collect(struct nilfs_sc_info *sci,
                nilfs_clear_logs(&sci->sc_segbufs);
-                err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
-                if (unlikely(err))
-                        return err;
                if (sci->sc_stage.flags & NILFS_CF_SUFREED) {
                        err = nilfs_sufile_cancel_freev(nilfs->ns_sufile,
                                                        sci->sc_freesegs,
                                                        sci->sc_nfreesegs,
                                                        NULL);
                        WARN_ON(err); /* do not happen */
+                        sci->sc_stage.flags &= ~NILFS_CF_SUFREED;
                }
+                err = nilfs_segctor_extend_segments(sci, nilfs, nadd);
+                if (unlikely(err))
+                        return err;
                nadd = min_t(int, nadd << 1, SC_MAX_SEGDELTA);
                sci->sc_stage = prev_stage;
        }
diff --git a/fs/xfs/xfs_attr_remote.c b/fs/xfs/xfs_attr_remote.c
index 739e0a52deda..5549d69ddb45 100644
--- a/fs/xfs/xfs_attr_remote.c
+++ b/fs/xfs/xfs_attr_remote.c
@@ -110,7 +110,7 @@ xfs_attr3_rmt_verify(
        if (be32_to_cpu(rmt->rm_bytes) > fsbsize - sizeof(*rmt))
                return false;
        if (be32_to_cpu(rmt->rm_offset) +
-                                be32_to_cpu(rmt->rm_bytes) >= XATTR_SIZE_MAX)
+                                be32_to_cpu(rmt->rm_bytes) > XATTR_SIZE_MAX)
                return false;
        if (rmt->rm_owner == 0)
                return false;
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index 1394106ed22d..82e0dab46ee5 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -287,6 +287,7 @@ xfs_bmapi_allocate(
        INIT_WORK_ONSTACK(&args->work, xfs_bmapi_allocate_worker);
        queue_work(xfs_alloc_wq, &args->work);
        wait_for_completion(&done);
+        destroy_work_on_stack(&args->work);
        return args->result;
 }
diff --git a/include/acpi/acpi_bus.h b/include/acpi/acpi_bus.h
index c602c7718421..ddabed1f51c2 100644
--- a/include/acpi/acpi_bus.h
+++ b/include/acpi/acpi_bus.h
@@ -169,7 +169,8 @@ struct acpi_device_flags {
        u32 ejectable:1;
        u32 power_manageable:1;
        u32 match_driver:1;
-        u32 reserved:27;
+        u32 no_hotplug:1;
+        u32 reserved:26;
 };
 /* File System */
@@ -344,6 +345,7 @@ extern struct kobject *acpi_kobj;
 extern int acpi_bus_generate_netlink_event(const char*, const char*, u8, int);
 void acpi_bus_private_data_handler(acpi_handle, void *);
 int acpi_bus_get_private_data(acpi_handle, void **);
+void acpi_bus_no_hotplug(acpi_handle handle);
 extern int acpi_notifier_call_chain(struct acpi_device *, u32, u32);
 extern int register_acpi_notifier(struct notifier_block *);
 extern int unregister_acpi_notifier(struct notifier_block *);
diff --git a/include/asm-generic/barrier.h b/include/asm-generic/barrier.h
index 639d7a4d033b..6f692f8ac664 100644
--- a/include/asm-generic/barrier.h
+++ b/include/asm-generic/barrier.h
@@ -1,4 +1,5 @@
-/* Generic barrier definitions, based on MN10300 definitions.
+/*
+ * Generic barrier definitions, originally based on MN10300 definitions.
 *
 * It should be possible to use these on really simple architectures,
 * but it serves more as a starting point for new ports.
@@ -16,35 +17,65 @@
 #ifndef __ASSEMBLY__
-#define nop() asm volatile ("nop")
+#include <linux/compiler.h>
+#ifndef nop
+#define nop()   asm volatile ("nop")
+#endif
 /*
- * Force strict CPU ordering.
+ * Force strict CPU ordering. And yes, this is required on UP too when we're
- * And yes, this is required on UP too when we're talking
+ * talking to devices.
- * to devices.
 *
- * This implementation only contains a compiler barrier.
+ * Fall back to compiler barriers if nothing better is provided.
 */
-#define mb()    asm volatile ("": : :"memory")
+#ifndef mb
+#define mb()    barrier()
+#endif
+#ifndef rmb
 #define rmb()   mb()
-#define wmb()   asm volatile ("": : :"memory")
+#endif
+#ifndef wmb
+#define wmb()   mb()
+#endif
+#ifndef read_barrier_depends
+#define read_barrier_depends()          do { } while (0)
+#endif
 #ifdef CONFIG_SMP
 #define smp_mb()        mb()
 #define smp_rmb()       rmb()
 #define smp_wmb()       wmb()
+#define smp_read_barrier_depends()      read_barrier_depends()
 #else
 #define smp_mb()        barrier()
 #define smp_rmb()       barrier()
 #define smp_wmb()       barrier()
+#define smp_read_barrier_depends()      do { } while (0)
+#endif
+#ifndef set_mb
+#define set_mb(var, value)  do { (var) = (value); mb(); } while (0)
 #endif
-#define set_mb(var, value)  do { var = value;  mb(); } while (0)
+#define smp_store_release(p, v)                                         \
-#define set_wmb(var, value) do { var = value; wmb(); } while (0)
+do {                                                                    \
+        compiletime_assert_atomic_type(*p);                             \
+        smp_mb();                                                       \
+        ACCESS_ONCE(*p) = (v);                                          \
+} while (0)
-#define read_barrier_depends()          do {} while (0)
+#define smp_load_acquire(p)                                             \
-#define smp_read_barrier_depends()      do {} while (0)
+({                                                                      \
+        typeof(*p) ___p1 = ACCESS_ONCE(*p);                             \
+        compiletime_assert_atomic_type(*p);                             \
+        smp_mb();                                                       \
+        ___p1;                                                          \
+})
 #endif /* !__ASSEMBLY__ */
 #endif /* __ASM_GENERIC_BARRIER_H */
diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
index 87578c109e48..49376aec2fbb 100644
--- a/include/drm/drm_pciids.h
+++ b/include/drm/drm_pciids.h
@@ -600,7 +600,7 @@
        {0x1002, 0x9645, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO2|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x9647, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
        {0x1002, 0x9648, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
-        {0x1002, 0x9649, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
+        {0x1002, 0x9649, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO2|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP},\
        {0x1002, 0x964a, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x964b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
        {0x1002, 0x964c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_SUMO|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
diff --git a/include/linux/auxvec.h b/include/linux/auxvec.h
index 669fef5c745a..3e0fbe441763 100644
--- a/include/linux/auxvec.h
+++ b/include/linux/auxvec.h
@@ -3,6 +3,6 @@
 #include <uapi/linux/auxvec.h>
-#define AT_VECTOR_SIZE_BASE 19 /* NEW_AUX_ENT entries in auxiliary table */
+#define AT_VECTOR_SIZE_BASE 20 /* NEW_AUX_ENT entries in auxiliary table */
  /* number of "#define AT_.*" above, minus {AT_NULL, AT_IGNORE, AT_NOTELF} */
 #endif /* _LINUX_AUXVEC_H */
diff --git a/include/linux/bottom_half.h b/include/linux/bottom_half.h
index 27b1bcffe408..86c12c93e3cf 100644
--- a/include/linux/bottom_half.h
+++ b/include/linux/bottom_half.h
@@ -1,9 +1,35 @@
 #ifndef _LINUX_BH_H
 #define _LINUX_BH_H
-extern void local_bh_disable(void);
+#include <linux/preempt.h>
+#include <linux/preempt_mask.h>
+#ifdef CONFIG_TRACE_IRQFLAGS
+extern void __local_bh_disable_ip(unsigned long ip, unsigned int cnt);
+#else
+static __always_inline void __local_bh_disable_ip(unsigned long ip, unsigned int cnt)
+{
+        preempt_count_add(cnt);
+        barrier();
+}
+#endif
+static inline void local_bh_disable(void)
+{
+        __local_bh_disable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
+}
 extern void _local_bh_enable(void);
-extern void local_bh_enable(void);
+extern void __local_bh_enable_ip(unsigned long ip, unsigned int cnt);
-extern void local_bh_enable_ip(unsigned long ip);
+static inline void local_bh_enable_ip(unsigned long ip)
+{
+        __local_bh_enable_ip(ip, SOFTIRQ_DISABLE_OFFSET);
+}
+static inline void local_bh_enable(void)
+{
+        __local_bh_enable_ip(_THIS_IP_, SOFTIRQ_DISABLE_OFFSET);
+}
 #endif /* _LINUX_BH_H */
diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index 92669cd182a6..fe7a686dfd8d 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -298,6 +298,11 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
 # define __same_type(a, b) __builtin_types_compatible_p(typeof(a), typeof(b))
 #endif
+/* Is this type a native word size -- useful for atomic operations */
+#ifndef __native_word
+# define __native_word(t) (sizeof(t) == sizeof(int) || sizeof(t) == sizeof(long))
+#endif
 /* Compile time object size, -1 for unknown */
 #ifndef __compiletime_object_size
 # define __compiletime_object_size(obj) -1
@@ -337,6 +342,10 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect);
 #define compiletime_assert(condition, msg) \
        _compiletime_assert(condition, msg, __compiletime_assert_, __LINE__)
+#define compiletime_assert_atomic_type(t)                               \
+        compiletime_assert(__native_word(t),                            \
+                "Need native word sized stores/loads for atomicity.")
 /*
 * Prevent the compiler from merging or refetching accesses.  The compiler
 * is also forbidden from reordering successive instances of ACCESS_ONCE(),
diff --git a/include/linux/context_tracking.h b/include/linux/context_tracking.h
index 158158704c30..37b81bd51ec0 100644
--- a/include/linux/context_tracking.h
+++ b/include/linux/context_tracking.h
@@ -17,13 +17,13 @@ extern void __context_tracking_task_switch(struct task_struct *prev,
 static inline void user_enter(void)
 {
-        if (static_key_false(&context_tracking_enabled))
+        if (context_tracking_is_enabled())
                context_tracking_user_enter();
 }
 static inline void user_exit(void)
 {
-        if (static_key_false(&context_tracking_enabled))
+        if (context_tracking_is_enabled())
                context_tracking_user_exit();
 }
@@ -31,7 +31,7 @@ static inline enum ctx_state exception_enter(void)
 {
        enum ctx_state prev_ctx;
-        if (!static_key_false(&context_tracking_enabled))
+        if (!context_tracking_is_enabled())
                return 0;
        prev_ctx = this_cpu_read(context_tracking.state);
@@ -42,7 +42,7 @@ static inline enum ctx_state exception_enter(void)
 static inline void exception_exit(enum ctx_state prev_ctx)
 {
-        if (static_key_false(&context_tracking_enabled)) {
+        if (context_tracking_is_enabled()) {
                if (prev_ctx == IN_USER)
                        context_tracking_user_enter();
        }
@@ -51,7 +51,7 @@ static inline void exception_exit(enum ctx_state prev_ctx)
 static inline void context_tracking_task_switch(struct task_struct *prev,
                                                struct task_struct *next)
 {
-        if (static_key_false(&context_tracking_enabled))
+        if (context_tracking_is_enabled())
                __context_tracking_task_switch(prev, next);
 }
 #else
diff --git a/include/linux/context_tracking_state.h b/include/linux/context_tracking_state.h
index 0f1979d0674f..97a81225d037 100644
--- a/include/linux/context_tracking_state.h
+++ b/include/linux/context_tracking_state.h
@@ -22,15 +22,20 @@ struct context_tracking {
 extern struct static_key context_tracking_enabled;
 DECLARE_PER_CPU(struct context_tracking, context_tracking);
-static inline bool context_tracking_in_user(void)
+static inline bool context_tracking_is_enabled(void)
 {
-        return __this_cpu_read(context_tracking.state) == IN_USER;
+        return static_key_false(&context_tracking_enabled);
 }
-static inline bool context_tracking_active(void)
+static inline bool context_tracking_cpu_is_enabled(void)
 {
        return __this_cpu_read(context_tracking.active);
 }
+static inline bool context_tracking_in_user(void)
+{
+        return __this_cpu_read(context_tracking.state) == IN_USER;
+}
 #else
 static inline bool context_tracking_in_user(void) { return false; }
 static inline bool context_tracking_active(void) { return false; }
diff --git a/include/linux/crash_dump.h b/include/linux/crash_dump.h
index fe68a5a98583..7032518f8542 100644
--- a/include/linux/crash_dump.h
+++ b/include/linux/crash_dump.h
@@ -6,6 +6,8 @@
 #include <linux/proc_fs.h>
 #include <linux/elf.h>
+#include <asm/pgtable.h> /* for pgprot_t */
 #define ELFCORE_ADDR_MAX        (-1ULL)
 #define ELFCORE_ADDR_ERR        (-2ULL)
diff --git a/include/linux/edac.h b/include/linux/edac.h
index dbdffe8d4469..8e6c20af11a2 100644
--- a/include/linux/edac.h
+++ b/include/linux/edac.h
@@ -35,6 +35,34 @@ extern void edac_atomic_assert_error(void);
 extern struct bus_type *edac_get_sysfs_subsys(void);
 extern void edac_put_sysfs_subsys(void);
+enum {
+        EDAC_REPORTING_ENABLED,
+        EDAC_REPORTING_DISABLED,
+        EDAC_REPORTING_FORCE
+};
+extern int edac_report_status;
+#ifdef CONFIG_EDAC
+static inline int get_edac_report_status(void)
+{
+        return edac_report_status;
+}
+static inline void set_edac_report_status(int new)
+{
+        edac_report_status = new;
+}
+#else
+static inline int get_edac_report_status(void)
+{
+        return EDAC_REPORTING_DISABLED;
+}
+static inline void set_edac_report_status(int new)
+{
+}
+#endif
 static inline void opstate_init(void)
 {
        switch (edac_op_state) {
diff --git a/include/linux/efi.h b/include/linux/efi.h
index 11ce6784a196..0a819e7a60c9 100644
--- a/include/linux/efi.h
+++ b/include/linux/efi.h
@@ -556,6 +556,9 @@ extern struct efi {
        unsigned long hcdp;             /* HCDP table */
        unsigned long uga;              /* UGA table */
        unsigned long uv_systab;        /* UV system table */
+        unsigned long fw_vendor;        /* fw_vendor */
+        unsigned long runtime;          /* runtime table */
+        unsigned long config_table;     /* config tables */
        efi_get_time_t *get_time;
        efi_set_time_t *set_time;
        efi_get_wakeup_time_t *get_wakeup_time;
@@ -653,6 +656,7 @@ extern int __init efi_setup_pcdp_console(char *);
 #define EFI_RUNTIME_SERVICES    3       /* Can we use runtime services? */
 #define EFI_MEMMAP              4       /* Can we use EFI memory map? */
 #define EFI_64BIT               5       /* Is the firmware 64-bit? */
+#define EFI_ARCH_1              6       /* First arch-specific bit */
 #ifdef CONFIG_EFI
 # ifdef CONFIG_X86
@@ -872,4 +876,17 @@ int efivars_sysfs_init(void);
 #endif /* CONFIG_EFI_VARS */
+#ifdef CONFIG_EFI_RUNTIME_MAP
+int efi_runtime_map_init(struct kobject *);
+void efi_runtime_map_setup(void *, int, u32);
+#else
+static inline int efi_runtime_map_init(struct kobject *kobj)
+{
+        return 0;
+}
+static inline void
+efi_runtime_map_setup(void *map, int nr_entries, u32 desc_size) {}
+#endif
 #endif /* _LINUX_EFI_H */
diff --git a/include/linux/extcon/extcon-gpio.h b/include/linux/extcon/extcon-gpio.h
index 4195810f87fe..8900fdf511c6 100644
--- a/include/linux/extcon/extcon-gpio.h
+++ b/include/linux/extcon/extcon-gpio.h
@@ -51,6 +51,7 @@ struct gpio_extcon_platform_data {
        /* if NULL, "0" or "1" will be printed */
        const char *state_on;
        const char *state_off;
+        bool check_on_resume;
 };
 #endif /* __EXTCON_GPIO_H__ */
diff --git a/include/linux/hardirq.h b/include/linux/hardirq.h
index d9cf963ac832..12d5f972f23f 100644
--- a/include/linux/hardirq.h
+++ b/include/linux/hardirq.h
@@ -5,6 +5,7 @@
 #include <linux/lockdep.h>
 #include <linux/ftrace_irq.h>
 #include <linux/vtime.h>
+#include <asm/hardirq.h>
 extern void synchronize_irq(unsigned int irq);
diff --git a/include/linux/i2c.h b/include/linux/i2c.h
index eff50e062be8..d9c8dbd3373f 100644
--- a/include/linux/i2c.h
+++ b/include/linux/i2c.h
@@ -445,7 +445,7 @@ static inline void i2c_set_adapdata(struct i2c_adapter *dev, void *data)
 static inline struct i2c_adapter *
 i2c_parent_is_i2c_adapter(const struct i2c_adapter *adapter)
 {
-#if IS_ENABLED(I2C_MUX)
+#if IS_ENABLED(CONFIG_I2C_MUX)
        struct device *parent = adapter->dev.parent;
        if (parent != NULL && parent->type == &i2c_adapter_type)
diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index b0ed422e4e4a..f0e52383a001 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -11,6 +11,7 @@
 #include <linux/user_namespace.h>
 #include <linux/securebits.h>
 #include <linux/seqlock.h>
+#include <linux/rbtree.h>
 #include <net/net_namespace.h>
 #include <linux/sched/rt.h>
@@ -154,6 +155,14 @@ extern struct task_group root_task_group;
 #define INIT_TASK_COMM "swapper"
+#ifdef CONFIG_RT_MUTEXES
+# define INIT_RT_MUTEXES(tsk)                                           \
+        .pi_waiters = RB_ROOT,                                          \
+        .pi_waiters_leftmost = NULL,
+#else
+# define INIT_RT_MUTEXES(tsk)
+#endif
 /*
 *  INIT_TASK is used to set up the first task table, touch at
 * your own risk!. Base=0, limit=0x1fffff (=2MB)
@@ -221,6 +230,7 @@ extern struct task_group root_task_group;
        INIT_TRACE_RECURSION                                            \
        INIT_TASK_RCU_PREEMPT(tsk)                                      \
        INIT_CPUSET_SEQ(tsk)                                            \
+        INIT_RT_MUTEXES(tsk)                                            \
        INIT_VTIME(tsk)                                                 \
 }
diff --git a/include/linux/irqdesc.h b/include/linux/irqdesc.h
index 56fb646909dc..26e2661d3935 100644
--- a/include/linux/irqdesc.h
+++ b/include/linux/irqdesc.h
@@ -152,6 +152,14 @@ static inline int irq_balancing_disabled(unsigned int irq)
        return desc->status_use_accessors & IRQ_NO_BALANCING_MASK;
 }
+static inline int irq_is_percpu(unsigned int irq)
+{
+        struct irq_desc *desc;
+        desc = irq_to_desc(irq);
+        return desc->status_use_accessors & IRQ_PER_CPU;
+}
 static inline void
 irq_set_lockdep_class(unsigned int irq, struct lock_class_key *class)
 {
diff --git a/include/linux/jump_label.h b/include/linux/jump_label.h
index 39999775b922..5c1dfb2a9e73 100644
--- a/include/linux/jump_label.h
+++ b/include/linux/jump_label.h
@@ -81,18 +81,21 @@ struct module;
 #include <linux/atomic.h>
 #ifdef HAVE_JUMP_LABEL
-#define JUMP_LABEL_TRUE_BRANCH 1UL
+#define JUMP_LABEL_TYPE_FALSE_BRANCH    0UL
+#define JUMP_LABEL_TYPE_TRUE_BRANCH     1UL
+#define JUMP_LABEL_TYPE_MASK            1UL
 static
 inline struct jump_entry *jump_label_get_entries(struct static_key *key)
 {
        return (struct jump_entry *)((unsigned long)key->entries
-                                                & ~JUMP_LABEL_TRUE_BRANCH);
+                                                & ~JUMP_LABEL_TYPE_MASK);
 }
 static inline bool jump_label_get_branch_default(struct static_key *key)
 {
-        if ((unsigned long)key->entries & JUMP_LABEL_TRUE_BRANCH)
+        if (((unsigned long)key->entries & JUMP_LABEL_TYPE_MASK) ==
+            JUMP_LABEL_TYPE_TRUE_BRANCH)
                return true;
        return false;
 }
@@ -122,10 +125,12 @@ extern void static_key_slow_inc(struct static_key *key);
 extern void static_key_slow_dec(struct static_key *key);
 extern void jump_label_apply_nops(struct module *mod);
-#define STATIC_KEY_INIT_TRUE ((struct static_key) \
+#define STATIC_KEY_INIT_TRUE ((struct static_key)               \
-        { .enabled = ATOMIC_INIT(1), .entries = (void *)1 })
+        { .enabled = ATOMIC_INIT(1),                            \
-#define STATIC_KEY_INIT_FALSE ((struct static_key) \
+          .entries = (void *)JUMP_LABEL_TYPE_TRUE_BRANCH })
-        { .enabled = ATOMIC_INIT(0), .entries = (void *)0 })
+#define STATIC_KEY_INIT_FALSE ((struct static_key)              \
+        { .enabled = ATOMIC_INIT(0),                            \
+          .entries = (void *)JUMP_LABEL_TYPE_FALSE_BRANCH })
 #else  /* !HAVE_JUMP_LABEL */
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index ecb87544cc5d..2aa3d4b000e6 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -394,6 +394,15 @@ extern int panic_on_oops;
 extern int panic_on_unrecovered_nmi;
 extern int panic_on_io_nmi;
 extern int sysctl_panic_on_stackoverflow;
+/*
+ * Only to be used by arch init code. If the user over-wrote the default
+ * CONFIG_PANIC_TIMEOUT, honor it.
+ */
+static inline void set_arch_panic_timeout(int timeout, int arch_default_timeout)
+{
+        if (panic_timeout == arch_default_timeout)
+                panic_timeout = timeout;
+}
 extern const char *print_tainted(void);
 enum lockdep_ok {
        LOCKDEP_STILL_OK,
diff --git a/include/linux/libata.h b/include/linux/libata.h
index 0e23c26485f4..9b503376738f 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -418,6 +418,7 @@ enum {
        ATA_HORKAGE_DUMP_ID     = (1 << 16),    /* dump IDENTIFY data */
        ATA_HORKAGE_MAX_SEC_LBA48 = (1 << 17),  /* Set max sects to 65535 */
        ATA_HORKAGE_ATAPI_DMADIR = (1 << 18),   /* device requires dmadir */
+        ATA_HORKAGE_NO_NCQ_TRIM = (1 << 19),    /* don't use queued TRIM */
         /* DMA mask for user DMA control: User visible values; DO NOT
            renumber */
diff --git a/include/linux/mfd/arizona/registers.h b/include/linux/mfd/arizona/registers.h
index cb49417f8ba9..b31976595eba 100644
--- a/include/linux/mfd/arizona/registers.h
+++ b/include/linux/mfd/arizona/registers.h
@@ -2196,6 +2196,15 @@
 /*
 * R677 (0x2A5) - Mic Detect 3
 */
+#define ARIZONA_MICD_LVL_0                       0x0004  /* MICD_LVL - [2] */
+#define ARIZONA_MICD_LVL_1                       0x0008  /* MICD_LVL - [3] */
+#define ARIZONA_MICD_LVL_2                       0x0010  /* MICD_LVL - [4] */
+#define ARIZONA_MICD_LVL_3                       0x0020  /* MICD_LVL - [5] */
+#define ARIZONA_MICD_LVL_4                       0x0040  /* MICD_LVL - [6] */
+#define ARIZONA_MICD_LVL_5                       0x0080  /* MICD_LVL - [7] */
+#define ARIZONA_MICD_LVL_6                       0x0100  /* MICD_LVL - [8] */
+#define ARIZONA_MICD_LVL_7                       0x0200  /* MICD_LVL - [9] */
+#define ARIZONA_MICD_LVL_8                       0x0400  /* MICD_LVL - [10] */
 #define ARIZONA_MICD_LVL_MASK                    0x07FC  /* MICD_LVL - [10:2] */
 #define ARIZONA_MICD_LVL_SHIFT                        2  /* MICD_LVL - [10:2] */
 #define ARIZONA_MICD_LVL_WIDTH                        9  /* MICD_LVL - [10:2] */
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index d9a550bf3e8e..ce2a1f5f9a1e 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -769,7 +769,8 @@ struct netdev_phys_port_id {
 *        (can also return NETDEV_TX_LOCKED iff NETIF_F_LLTX)
 *      Required can not be NULL.
 *
- * u16 (*ndo_select_queue)(struct net_device *dev, struct sk_buff *skb);
+ * u16 (*ndo_select_queue)(struct net_device *dev, struct sk_buff *skb,
+ *                         void *accel_priv);
 *      Called to decide which queue to when device supports multiple
 *      transmit queues.
 *
@@ -990,7 +991,8 @@ struct net_device_ops {
        netdev_tx_t             (*ndo_start_xmit) (struct sk_buff *skb,
                                                   struct net_device *dev);
        u16                     (*ndo_select_queue)(struct net_device *dev,
-                                                    struct sk_buff *skb);
+                                                    struct sk_buff *skb,
+                                                    void *accel_priv);
        void                    (*ndo_change_rx_flags)(struct net_device *dev,
                                                       int flags);
        void                    (*ndo_set_rx_mode)(struct net_device *dev);
@@ -1529,7 +1531,8 @@ static inline void netdev_for_each_tx_queue(struct net_device *dev,
 }
 struct netdev_queue *netdev_pick_tx(struct net_device *dev,
-                                    struct sk_buff *skb);
+                                    struct sk_buff *skb,
+                                    void *accel_priv);
 u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb);
 /*
@@ -1819,6 +1822,7 @@ int dev_close(struct net_device *dev);
 void dev_disable_lro(struct net_device *dev);
 int dev_loopback_xmit(struct sk_buff *newskb);
 int dev_queue_xmit(struct sk_buff *skb);
+int dev_queue_xmit_accel(struct sk_buff *skb, void *accel_priv);
 int register_netdevice(struct net_device *dev);
 void unregister_netdevice_queue(struct net_device *dev, struct list_head *head);
 void unregister_netdevice_many(struct list_head *head);
@@ -1912,6 +1916,15 @@ static inline int dev_parse_header(const struct sk_buff *skb,
        return dev->header_ops->parse(skb, haddr);
 }
+static inline int dev_rebuild_header(struct sk_buff *skb)
+{
+        const struct net_device *dev = skb->dev;
+        if (!dev->header_ops || !dev->header_ops->rebuild)
+                return 0;
+        return dev->header_ops->rebuild(skb);
+}
 typedef int gifconf_func_t(struct net_device * dev, char __user * bufptr, int len);
 int register_gifconf(unsigned int family, gifconf_func_t *gifconf);
 static inline int unregister_gifconf(unsigned int family)
@@ -2417,7 +2430,7 @@ int dev_change_carrier(struct net_device *, bool new_carrier);
 int dev_get_phys_port_id(struct net_device *dev,
                         struct netdev_phys_port_id *ppid);
 int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
-                        struct netdev_queue *txq, void *accel_priv);
+                        struct netdev_queue *txq);
 int dev_forward_skb(struct net_device *dev, struct sk_buff *skb);
 extern int              netdev_budget;
@@ -3008,6 +3021,19 @@ static inline void netif_set_gso_max_size(struct net_device *dev,
        dev->gso_max_size = size;
 }
+static inline void skb_gso_error_unwind(struct sk_buff *skb, __be16 protocol,
+                                        int pulled_hlen, u16 mac_offset,
+                                        int mac_len)
+{
+        skb->protocol = protocol;
+        skb->encapsulation = 1;
+        skb_push(skb, pulled_hlen);
+        skb_reset_transport_header(skb);
+        skb->mac_header = mac_offset;
+        skb->network_header = skb->mac_header + mac_len;
+        skb->mac_len = mac_len;
+}
 static inline bool netif_is_macvlan(struct net_device *dev)
 {
        return dev->priv_flags & IFF_MACVLAN;
diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h
index 57e890abe1f0..a5fc7d01aad6 100644
--- a/include/linux/percpu-defs.h
+++ b/include/linux/percpu-defs.h
@@ -69,6 +69,7 @@
        __PCPU_DUMMY_ATTRS char __pcpu_scope_##name;                    \
        extern __PCPU_DUMMY_ATTRS char __pcpu_unique_##name;            \
        __PCPU_DUMMY_ATTRS char __pcpu_unique_##name;                   \
+        extern __PCPU_ATTRS(sec) __typeof__(type) name;                 \
        __PCPU_ATTRS(sec) PER_CPU_DEF_ATTRIBUTES __weak                 \
        __typeof__(type) name
 #else
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index 2e069d1288df..e56b07f5c9b6 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -320,6 +320,7 @@ struct perf_event {
        struct list_head                migrate_entry;
        struct hlist_node               hlist_entry;
+        struct list_head                active_entry;
        int                             nr_siblings;
        int                             group_flags;
        struct perf_event               *group_leader;
diff --git a/include/linux/platform_data/hwmon-s3c.h b/include/linux/platform_data/hwmon-s3c.h
index c167e4429bc7..0e3cce130fe2 100644
--- a/include/linux/platform_data/hwmon-s3c.h
+++ b/include/linux/platform_data/hwmon-s3c.h
@@ -1,5 +1,4 @@
-/* linux/arch/arm/plat-s3c/include/plat/hwmon.h
+/*
- *
 * Copyright 2005 Simtec Electronics
 *      Ben Dooks <ben@simtec.co.uk>
 *      http://armlinux.simtec.co.uk/
@@ -11,8 +10,8 @@
 * published by the Free Software Foundation.
 */
-#ifndef __ASM_ARCH_ADC_HWMON_H
+#ifndef __HWMON_S3C_H__
-#define __ASM_ARCH_ADC_HWMON_H __FILE__
+#define __HWMON_S3C_H__
 /**
 * s3c_hwmon_chcfg - channel configuration
@@ -47,5 +46,4 @@ struct s3c_hwmon_pdata {
 */
 extern void __init s3c_hwmon_set_platdata(struct s3c_hwmon_pdata *pd);
-#endif /* __ASM_ARCH_ADC_HWMON_H */
+#endif /* __HWMON_S3C_H__ */
diff --git a/include/linux/platform_data/max197.h b/include/linux/platform_data/max197.h
index e2a41dd7690c..8da8f94ee15c 100644
--- a/include/linux/platform_data/max197.h
+++ b/include/linux/platform_data/max197.h
@@ -11,6 +11,9 @@
 * For further information, see the Documentation/hwmon/max197 file.
 */
+#ifndef _PDATA_MAX197_H
+#define _PDATA_MAX197_H
 /**
 * struct max197_platform_data - MAX197 connectivity info
 * @convert:    Function used to start a conversion with control byte ctrl.
@@ -19,3 +22,5 @@
 struct max197_platform_data {
        int (*convert)(u8 ctrl);
 };
+#endif /* _PDATA_MAX197_H */
diff --git a/include/linux/platform_data/sht15.h b/include/linux/platform_data/sht15.h
index 33e0fd27225e..12289c1e9413 100644
--- a/include/linux/platform_data/sht15.h
+++ b/include/linux/platform_data/sht15.h
@@ -12,6 +12,9 @@
 * For further information, see the Documentation/hwmon/sht15 file.
 */
+#ifndef _PDATA_SHT15_H
+#define _PDATA_SHT15_H
 /**
 * struct sht15_platform_data - sht15 connectivity info
 * @gpio_data:          no. of gpio to which bidirectional data line is
@@ -31,3 +34,5 @@ struct sht15_platform_data {
        bool no_otp_reload;
        bool low_resolution;
 };
+#endif /* _PDATA_SHT15_H */
diff --git a/include/linux/preempt.h b/include/linux/preempt.h
index a3d9dc8c2c00..59749fc48328 100644
--- a/include/linux/preempt.h
+++ b/include/linux/preempt.h
@@ -64,7 +64,11 @@ do { \
 } while (0)
 #else
-#define preempt_enable() preempt_enable_no_resched()
+#define preempt_enable() \
+do { \
+        barrier(); \
+        preempt_count_dec(); \
+} while (0)
 #define preempt_check_resched() do { } while (0)
 #endif
@@ -93,7 +97,11 @@ do { \
                __preempt_schedule_context(); \
 } while (0)
 #else
-#define preempt_enable_notrace() preempt_enable_no_resched_notrace()
+#define preempt_enable_notrace() \
+do { \
+        barrier(); \
+        __preempt_count_dec(); \
+} while (0)
 #endif
 #else /* !CONFIG_PREEMPT_COUNT */
@@ -116,6 +124,31 @@ do { \
 #endif /* CONFIG_PREEMPT_COUNT */
+#ifdef MODULE
+/*
+ * Modules have no business playing preemption tricks.
+ */
+#undef sched_preempt_enable_no_resched
+#undef preempt_enable_no_resched
+#undef preempt_enable_no_resched_notrace
+#undef preempt_check_resched
+#endif
+#ifdef CONFIG_PREEMPT
+#define preempt_set_need_resched() \
+do { \
+        set_preempt_need_resched(); \
+} while (0)
+#define preempt_fold_need_resched() \
+do { \
+        if (tif_need_resched()) \
+                set_preempt_need_resched(); \
+} while (0)
+#else
+#define preempt_set_need_resched() do { } while (0)
+#define preempt_fold_need_resched() do { } while (0)
+#endif
 #ifdef CONFIG_PREEMPT_NOTIFIERS
 struct preempt_notifier;
diff --git a/include/linux/preempt_mask.h b/include/linux/preempt_mask.h
index d169820203dd..dbeec4d4a3be 100644
--- a/include/linux/preempt_mask.h
+++ b/include/linux/preempt_mask.h
@@ -2,7 +2,6 @@
 #define LINUX_PREEMPT_MASK_H
 #include <linux/preempt.h>
-#include <asm/hardirq.h>
 /*
 * We put the hardirq and softirq counter into the preemption
@@ -79,6 +78,21 @@
 #endif
 /*
+ * The preempt_count offset needed for things like:
+ *
+ *  spin_lock_bh()
+ *
+ * Which need to disable both preemption (CONFIG_PREEMPT_COUNT) and
+ * softirqs, such that unlock sequences of:
+ *
+ *  spin_unlock();
+ *  local_bh_enable();
+ *
+ * Work as expected.
+ */
+#define SOFTIRQ_LOCK_OFFSET (SOFTIRQ_DISABLE_OFFSET + PREEMPT_CHECK_OFFSET)
+/*
 * Are we running in atomic context?  WARNING: this macro cannot
 * always detect atomic context; in particular, it cannot know about
 * held spinlocks in non-preemptible kernels.  Thus it should not be
diff --git a/include/linux/rculist.h b/include/linux/rculist.h
index 45a0a9e81478..dbaf99084112 100644
--- a/include/linux/rculist.h
+++ b/include/linux/rculist.h
@@ -55,8 +55,8 @@ static inline void __list_add_rcu(struct list_head *new,
        next->prev = new;
 }
 #else
-extern void __list_add_rcu(struct list_head *new,
+void __list_add_rcu(struct list_head *new,
-                struct list_head *prev, struct list_head *next);
+                    struct list_head *prev, struct list_head *next);
 #endif
 /**
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 39cbb889e20d..3e355c688618 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -50,13 +50,13 @@ extern int rcutorture_runnable; /* for sysctl */
 #endif /* #ifdef CONFIG_RCU_TORTURE_TEST */
 #if defined(CONFIG_TREE_RCU) || defined(CONFIG_TREE_PREEMPT_RCU)
-extern void rcutorture_record_test_transition(void);
+void rcutorture_record_test_transition(void);
-extern void rcutorture_record_progress(unsigned long vernum);
+void rcutorture_record_progress(unsigned long vernum);
-extern void do_trace_rcu_torture_read(const char *rcutorturename,
+void do_trace_rcu_torture_read(const char *rcutorturename,
-                                      struct rcu_head *rhp,
+                               struct rcu_head *rhp,
-                                      unsigned long secs,
+                               unsigned long secs,
-                                      unsigned long c_old,
+                               unsigned long c_old,
-                                      unsigned long c);
+                               unsigned long c);
 #else
 static inline void rcutorture_record_test_transition(void)
 {
@@ -65,11 +65,11 @@ static inline void rcutorture_record_progress(unsigned long vernum)
 {
 }
 #ifdef CONFIG_RCU_TRACE
-extern void do_trace_rcu_torture_read(const char *rcutorturename,
+void do_trace_rcu_torture_read(const char *rcutorturename,
-                                      struct rcu_head *rhp,
+                               struct rcu_head *rhp,
-                                      unsigned long secs,
+                               unsigned long secs,
-                                      unsigned long c_old,
+                               unsigned long c_old,
-                                      unsigned long c);
+                               unsigned long c);
 #else
 #define do_trace_rcu_torture_read(rcutorturename, rhp, secs, c_old, c) \
        do { } while (0)
@@ -118,8 +118,8 @@ extern void do_trace_rcu_torture_read(const char *rcutorturename,
 * if CPU A and CPU B are the same CPU (but again only if the system has
 * more than one CPU).
 */
-extern void call_rcu(struct rcu_head *head,
+void call_rcu(struct rcu_head *head,
-                              void (*func)(struct rcu_head *head));
+              void (*func)(struct rcu_head *head));
 #else /* #ifdef CONFIG_PREEMPT_RCU */
@@ -149,8 +149,8 @@ extern void call_rcu(struct rcu_head *head,
 * See the description of call_rcu() for more detailed information on
 * memory ordering guarantees.
 */
-extern void call_rcu_bh(struct rcu_head *head,
+void call_rcu_bh(struct rcu_head *head,
-                        void (*func)(struct rcu_head *head));
+                 void (*func)(struct rcu_head *head));
 /**
 * call_rcu_sched() - Queue an RCU for invocation after sched grace period.
@@ -171,16 +171,16 @@ extern void call_rcu_bh(struct rcu_head *head,
 * See the description of call_rcu() for more detailed information on
 * memory ordering guarantees.
 */
-extern void call_rcu_sched(struct rcu_head *head,
+void call_rcu_sched(struct rcu_head *head,
-                           void (*func)(struct rcu_head *rcu));
+                    void (*func)(struct rcu_head *rcu));
-extern void synchronize_sched(void);
+void synchronize_sched(void);
 #ifdef CONFIG_PREEMPT_RCU
-extern void __rcu_read_lock(void);
+void __rcu_read_lock(void);
-extern void __rcu_read_unlock(void);
+void __rcu_read_unlock(void);
-extern void rcu_read_unlock_special(struct task_struct *t);
+void rcu_read_unlock_special(struct task_struct *t);
 void synchronize_rcu(void);
 /*
@@ -216,19 +216,19 @@ static inline int rcu_preempt_depth(void)
 #endif /* #else #ifdef CONFIG_PREEMPT_RCU */
 /* Internal to kernel */
-extern void rcu_init(void);
+void rcu_init(void);
-extern void rcu_sched_qs(int cpu);
+void rcu_sched_qs(int cpu);
-extern void rcu_bh_qs(int cpu);
+void rcu_bh_qs(int cpu);
-extern void rcu_check_callbacks(int cpu, int user);
+void rcu_check_callbacks(int cpu, int user);
 struct notifier_block;
-extern void rcu_idle_enter(void);
+void rcu_idle_enter(void);
-extern void rcu_idle_exit(void);
+void rcu_idle_exit(void);
-extern void rcu_irq_enter(void);
+void rcu_irq_enter(void);
-extern void rcu_irq_exit(void);
+void rcu_irq_exit(void);
 #ifdef CONFIG_RCU_USER_QS
-extern void rcu_user_enter(void);
+void rcu_user_enter(void);
-extern void rcu_user_exit(void);
+void rcu_user_exit(void);
 #else
 static inline void rcu_user_enter(void) { }
 static inline void rcu_user_exit(void) { }
@@ -262,7 +262,7 @@ static inline void rcu_user_hooks_switch(struct task_struct *prev,
        } while (0)
 #if defined(CONFIG_DEBUG_LOCK_ALLOC) || defined(CONFIG_RCU_TRACE) || defined(CONFIG_SMP)
-extern bool __rcu_is_watching(void);
+bool __rcu_is_watching(void);
 #endif /* #if defined(CONFIG_DEBUG_LOCK_ALLOC) || defined(CONFIG_RCU_TRACE) || defined(CONFIG_SMP) */
 /*
@@ -289,8 +289,8 @@ void wait_rcu_gp(call_rcu_func_t crf);
 * initialization.
 */
 #ifdef CONFIG_DEBUG_OBJECTS_RCU_HEAD
-extern void init_rcu_head_on_stack(struct rcu_head *head);
+void init_rcu_head_on_stack(struct rcu_head *head);
-extern void destroy_rcu_head_on_stack(struct rcu_head *head);
+void destroy_rcu_head_on_stack(struct rcu_head *head);
 #else /* !CONFIG_DEBUG_OBJECTS_RCU_HEAD */
 static inline void init_rcu_head_on_stack(struct rcu_head *head)
 {
@@ -325,6 +325,7 @@ static inline void rcu_lock_release(struct lockdep_map *map)
 extern struct lockdep_map rcu_lock_map;
 extern struct lockdep_map rcu_bh_lock_map;
 extern struct lockdep_map rcu_sched_lock_map;
+extern struct lockdep_map rcu_callback_map;
 extern int debug_lockdep_rcu_enabled(void);
 /**
@@ -362,7 +363,7 @@ static inline int rcu_read_lock_held(void)
 * rcu_read_lock_bh_held() is defined out of line to avoid #include-file
 * hell.
 */
-extern int rcu_read_lock_bh_held(void);
+int rcu_read_lock_bh_held(void);
 /**
 * rcu_read_lock_sched_held() - might we be in RCU-sched read-side critical section?
@@ -448,7 +449,7 @@ static inline int rcu_read_lock_sched_held(void)
 #ifdef CONFIG_PROVE_RCU
-extern int rcu_my_thread_group_empty(void);
+int rcu_my_thread_group_empty(void);
 /**
 * rcu_lockdep_assert - emit lockdep splat if specified condition not met
@@ -548,10 +549,48 @@ static inline void rcu_preempt_sleep_check(void)
                smp_read_barrier_depends(); \
                (_________p1); \
        })
-#define __rcu_assign_pointer(p, v, space) \
+/**
+ * RCU_INITIALIZER() - statically initialize an RCU-protected global variable
+ * @v: The value to statically initialize with.
+ */
+#define RCU_INITIALIZER(v) (typeof(*(v)) __force __rcu *)(v)
+/**
+ * rcu_assign_pointer() - assign to RCU-protected pointer
+ * @p: pointer to assign to
+ * @v: value to assign (publish)
+ *
+ * Assigns the specified value to the specified RCU-protected
+ * pointer, ensuring that any concurrent RCU readers will see
+ * any prior initialization.
+ *
+ * Inserts memory barriers on architectures that require them
+ * (which is most of them), and also prevents the compiler from
+ * reordering the code that initializes the structure after the pointer
+ * assignment.  More importantly, this call documents which pointers
+ * will be dereferenced by RCU read-side code.
+ *
+ * In some special cases, you may use RCU_INIT_POINTER() instead
+ * of rcu_assign_pointer().  RCU_INIT_POINTER() is a bit faster due
+ * to the fact that it does not constrain either the CPU or the compiler.
+ * That said, using RCU_INIT_POINTER() when you should have used
+ * rcu_assign_pointer() is a very bad thing that results in
+ * impossible-to-diagnose memory corruption.  So please be careful.
+ * See the RCU_INIT_POINTER() comment header for details.
+ *
+ * Note that rcu_assign_pointer() evaluates each of its arguments only
+ * once, appearances notwithstanding.  One of the "extra" evaluations
+ * is in typeof() and the other visible only to sparse (__CHECKER__),
+ * neither of which actually execute the argument.  As with most cpp
+ * macros, this execute-arguments-only-once property is important, so
+ * please be careful when making changes to rcu_assign_pointer() and the
+ * other macros that it invokes.
+ */
+#define rcu_assign_pointer(p, v) \
        do { \
                smp_wmb(); \
-                (p) = (typeof(*v) __force space *)(v); \
+                ACCESS_ONCE(p) = RCU_INITIALIZER(v); \
        } while (0)
@@ -890,32 +929,6 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)
 }
 /**
- * rcu_assign_pointer() - assign to RCU-protected pointer
- * @p: pointer to assign to
- * @v: value to assign (publish)
- *
- * Assigns the specified value to the specified RCU-protected
- * pointer, ensuring that any concurrent RCU readers will see
- * any prior initialization.
- *
- * Inserts memory barriers on architectures that require them
- * (which is most of them), and also prevents the compiler from
- * reordering the code that initializes the structure after the pointer
- * assignment.  More importantly, this call documents which pointers
- * will be dereferenced by RCU read-side code.
- *
- * In some special cases, you may use RCU_INIT_POINTER() instead
- * of rcu_assign_pointer().  RCU_INIT_POINTER() is a bit faster due
- * to the fact that it does not constrain either the CPU or the compiler.
- * That said, using RCU_INIT_POINTER() when you should have used
- * rcu_assign_pointer() is a very bad thing that results in
- * impossible-to-diagnose memory corruption.  So please be careful.
- * See the RCU_INIT_POINTER() comment header for details.
- */
-#define rcu_assign_pointer(p, v) \
-        __rcu_assign_pointer((p), (v), __rcu)
-/**
 * RCU_INIT_POINTER() - initialize an RCU protected pointer
 *
 * Initialize an RCU-protected pointer in special cases where readers
@@ -949,7 +962,7 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)
 */
 #define RCU_INIT_POINTER(p, v) \
        do { \
-                p = (typeof(*v) __force __rcu *)(v); \
+                p = RCU_INITIALIZER(v); \
        } while (0)
 /**
@@ -958,7 +971,7 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)
 * GCC-style initialization for an RCU-protected pointer in a structure field.
 */
 #define RCU_POINTER_INITIALIZER(p, v) \
-                .p = (typeof(*v) __force __rcu *)(v)
+                .p = RCU_INITIALIZER(v)
 /*
 * Does the specified offset indicate that the corresponding rcu_head
@@ -1005,7 +1018,7 @@ static inline notrace void rcu_read_unlock_sched_notrace(void)
        __kfree_rcu(&((ptr)->rcu_head), offsetof(typeof(*(ptr)), rcu_head))
 #ifdef CONFIG_RCU_NOCB_CPU
-extern bool rcu_is_nocb_cpu(int cpu);
+bool rcu_is_nocb_cpu(int cpu);
 #else
 static inline bool rcu_is_nocb_cpu(int cpu) { return false; }
 #endif /* #else #ifdef CONFIG_RCU_NOCB_CPU */
@@ -1013,8 +1026,8 @@ static inline bool rcu_is_nocb_cpu(int cpu) { return false; }
 /* Only for use by adaptive-ticks code. */
 #ifdef CONFIG_NO_HZ_FULL_SYSIDLE
-extern bool rcu_sys_is_idle(void);
+bool rcu_sys_is_idle(void);
-extern void rcu_sysidle_force_exit(void);
+void rcu_sysidle_force_exit(void);
 #else /* #ifdef CONFIG_NO_HZ_FULL_SYSIDLE */
 static inline bool rcu_sys_is_idle(void)
diff --git a/include/linux/rcutiny.h b/include/linux/rcutiny.h
index 09ebcbe9fd78..6f01771b571c 100644
--- a/include/linux/rcutiny.h
+++ b/include/linux/rcutiny.h
@@ -125,7 +125,7 @@ static inline void exit_rcu(void)
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 extern int rcu_scheduler_active __read_mostly;
-extern void rcu_scheduler_starting(void);
+void rcu_scheduler_starting(void);
 #else /* #ifdef CONFIG_DEBUG_LOCK_ALLOC */
 static inline void rcu_scheduler_starting(void)
 {
diff --git a/include/linux/rcutree.h b/include/linux/rcutree.h
index 4b9c81548742..72137ee8c603 100644
--- a/include/linux/rcutree.h
+++ b/include/linux/rcutree.h
@@ -30,9 +30,9 @@
 #ifndef __LINUX_RCUTREE_H
 #define __LINUX_RCUTREE_H
-extern void rcu_note_context_switch(int cpu);
+void rcu_note_context_switch(int cpu);
-extern int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies);
+int rcu_needs_cpu(int cpu, unsigned long *delta_jiffies);
-extern void rcu_cpu_stall_reset(void);
+void rcu_cpu_stall_reset(void);
 /*
 * Note a virtualization-based context switch.  This is simply a
@@ -44,9 +44,9 @@ static inline void rcu_virt_note_context_switch(int cpu)
        rcu_note_context_switch(cpu);
 }
-extern void synchronize_rcu_bh(void);
+void synchronize_rcu_bh(void);
-extern void synchronize_sched_expedited(void);
+void synchronize_sched_expedited(void);
-extern void synchronize_rcu_expedited(void);
+void synchronize_rcu_expedited(void);
 void kfree_call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu));
@@ -71,25 +71,25 @@ static inline void synchronize_rcu_bh_expedited(void)
        synchronize_sched_expedited();
 }
-extern void rcu_barrier(void);
+void rcu_barrier(void);
-extern void rcu_barrier_bh(void);
+void rcu_barrier_bh(void);
-extern void rcu_barrier_sched(void);
+void rcu_barrier_sched(void);
 extern unsigned long rcutorture_testseq;
 extern unsigned long rcutorture_vernum;
-extern long rcu_batches_completed(void);
+long rcu_batches_completed(void);
-extern long rcu_batches_completed_bh(void);
+long rcu_batches_completed_bh(void);
-extern long rcu_batches_completed_sched(void);
+long rcu_batches_completed_sched(void);
-extern void rcu_force_quiescent_state(void);
+void rcu_force_quiescent_state(void);
-extern void rcu_bh_force_quiescent_state(void);
+void rcu_bh_force_quiescent_state(void);
-extern void rcu_sched_force_quiescent_state(void);
+void rcu_sched_force_quiescent_state(void);
-extern void exit_rcu(void);
+void exit_rcu(void);
-extern void rcu_scheduler_starting(void);
+void rcu_scheduler_starting(void);
 extern int rcu_scheduler_active __read_mostly;
-extern bool rcu_is_watching(void);
+bool rcu_is_watching(void);
 #endif /* __LINUX_RCUTREE_H */
diff --git a/include/linux/rtmutex.h b/include/linux/rtmutex.h
index de17134244f3..3aed8d737e1a 100644
--- a/include/linux/rtmutex.h
+++ b/include/linux/rtmutex.h
@@ -13,7 +13,7 @@
 #define __LINUX_RT_MUTEX_H
 #include <linux/linkage.h>
-#include <linux/plist.h>
+#include <linux/rbtree.h>
 #include <linux/spinlock_types.h>
 extern int max_lock_depth; /* for sysctl */
@@ -22,12 +22,14 @@ extern int max_lock_depth; /* for sysctl */
 * The rt_mutex structure
 *
 * @wait_lock:  spinlock to protect the structure
- * @wait_list:  pilist head to enqueue waiters in priority order
+ * @waiters:    rbtree root to enqueue waiters in priority order
+ * @waiters_leftmost: top waiter
 * @owner:      the mutex owner
 */
 struct rt_mutex {
        raw_spinlock_t          wait_lock;
-        struct plist_head       wait_list;
+        struct rb_root          waiters;
+        struct rb_node          *waiters_leftmost;
        struct task_struct      *owner;
 #ifdef CONFIG_DEBUG_RT_MUTEXES
        int                     save_state;
@@ -66,7 +68,7 @@ struct hrtimer_sleeper;
 #define __RT_MUTEX_INITIALIZER(mutexname) \
        { .wait_lock = __RAW_SPIN_LOCK_UNLOCKED(mutexname.wait_lock) \
-        , .wait_list = PLIST_HEAD_INIT(mutexname.wait_list) \
+        , .waiters = RB_ROOT \
        , .owner = NULL \
        __DEBUG_RT_MUTEX_INITIALIZER(mutexname)}
@@ -98,12 +100,4 @@ extern int rt_mutex_trylock(struct rt_mutex *lock);
 extern void rt_mutex_unlock(struct rt_mutex *lock);
-#ifdef CONFIG_RT_MUTEXES
-# define INIT_RT_MUTEXES(tsk)                                           \
-        .pi_waiters     = PLIST_HEAD_INIT(tsk.pi_waiters),      \
-        INIT_RT_MUTEX_DEBUG(tsk)
-#else
-# define INIT_RT_MUTEXES(tsk)
-#endif
 #endif
diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
index 939428ad25ac..8e3e66ac0a52 100644
--- a/include/linux/rtnetlink.h
+++ b/include/linux/rtnetlink.h
@@ -24,6 +24,11 @@ extern int rtnl_trylock(void);
 extern int rtnl_is_locked(void);
 #ifdef CONFIG_PROVE_LOCKING
 extern int lockdep_rtnl_is_held(void);
+#else
+static inline int lockdep_rtnl_is_held(void)
+{
+        return 1;
+}
 #endif /* #ifdef CONFIG_PROVE_LOCKING */
 /**
diff --git a/include/linux/rwlock_api_smp.h b/include/linux/rwlock_api_smp.h
index 9c9f0495d37c..5b9b84b20407 100644
--- a/include/linux/rwlock_api_smp.h
+++ b/include/linux/rwlock_api_smp.h
@@ -172,8 +172,7 @@ static inline void __raw_read_lock_irq(rwlock_t *lock)
 static inline void __raw_read_lock_bh(rwlock_t *lock)
 {
-        local_bh_disable();
+        __local_bh_disable_ip(_RET_IP_, SOFTIRQ_LOCK_OFFSET);
-        preempt_disable();
        rwlock_acquire_read(&lock->dep_map, 0, 0, _RET_IP_);
        LOCK_CONTENDED(lock, do_raw_read_trylock, do_raw_read_lock);
 }
@@ -200,8 +199,7 @@ static inline void __raw_write_lock_irq(rwlock_t *lock)
 static inline void __raw_write_lock_bh(rwlock_t *lock)
 {
-        local_bh_disable();
+        __local_bh_disable_ip(_RET_IP_, SOFTIRQ_LOCK_OFFSET);
-        preempt_disable();
        rwlock_acquire(&lock->dep_map, 0, 0, _RET_IP_);
        LOCK_CONTENDED(lock, do_raw_write_trylock, do_raw_write_lock);
 }
@@ -250,8 +248,7 @@ static inline void __raw_read_unlock_bh(rwlock_t *lock)
 {
        rwlock_release(&lock->dep_map, 1, _RET_IP_);
        do_raw_read_unlock(lock);
-        preempt_enable_no_resched();
+        __local_bh_enable_ip(_RET_IP_, SOFTIRQ_LOCK_OFFSET);
-        local_bh_enable_ip((unsigned long)__builtin_return_address(0));
 }
 static inline void __raw_write_unlock_irqrestore(rwlock_t *lock,
@@ -275,8 +272,7 @@ static inline void __raw_write_unlock_bh(rwlock_t *lock)
 {
        rwlock_release(&lock->dep_map, 1, _RET_IP_);
        do_raw_write_unlock(lock);
-        preempt_enable_no_resched();
+        __local_bh_enable_ip(_RET_IP_, SOFTIRQ_LOCK_OFFSET);
-        local_bh_enable_ip((unsigned long)__builtin_return_address(0));
 }
 #endif /* __LINUX_RWLOCK_API_SMP_H */
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 53f97eb8dbc7..ffccdad050b5 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -16,6 +16,7 @@ struct sched_param {
 #include <linux/types.h>
 #include <linux/timex.h>
 #include <linux/jiffies.h>
+#include <linux/plist.h>
 #include <linux/rbtree.h>
 #include <linux/thread_info.h>
 #include <linux/cpumask.h>
@@ -56,6 +57,70 @@ struct sched_param {
 #include <asm/processor.h>
+#define SCHED_ATTR_SIZE_VER0    48      /* sizeof first published struct */
+/*
+ * Extended scheduling parameters data structure.
+ *
+ * This is needed because the original struct sched_param can not be
+ * altered without introducing ABI issues with legacy applications
+ * (e.g., in sched_getparam()).
+ *
+ * However, the possibility of specifying more than just a priority for
+ * the tasks may be useful for a wide variety of application fields, e.g.,
+ * multimedia, streaming, automation and control, and many others.
+ *
+ * This variant (sched_attr) is meant at describing a so-called
+ * sporadic time-constrained task. In such model a task is specified by:
+ *  - the activation period or minimum instance inter-arrival time;
+ *  - the maximum (or average, depending on the actual scheduling
+ *    discipline) computation time of all instances, a.k.a. runtime;
+ *  - the deadline (relative to the actual activation time) of each
+ *    instance.
+ * Very briefly, a periodic (sporadic) task asks for the execution of
+ * some specific computation --which is typically called an instance--
+ * (at most) every period. Moreover, each instance typically lasts no more
+ * than the runtime and must be completed by time instant t equal to
+ * the instance activation time + the deadline.
+ *
+ * This is reflected by the actual fields of the sched_attr structure:
+ *
+ *  @size               size of the structure, for fwd/bwd compat.
+ *
+ *  @sched_policy       task's scheduling policy
+ *  @sched_flags        for customizing the scheduler behaviour
+ *  @sched_nice         task's nice value      (SCHED_NORMAL/BATCH)
+ *  @sched_priority     task's static priority (SCHED_FIFO/RR)
+ *  @sched_deadline     representative of the task's deadline
+ *  @sched_runtime      representative of the task's runtime
+ *  @sched_period       representative of the task's period
+ *
+ * Given this task model, there are a multiplicity of scheduling algorithms
+ * and policies, that can be used to ensure all the tasks will make their
+ * timing constraints.
+ *
+ * As of now, the SCHED_DEADLINE policy (sched_dl scheduling class) is the
+ * only user of this new interface. More information about the algorithm
+ * available in the scheduling class file or in Documentation/.
+ */
+struct sched_attr {
+        u32 size;
+        u32 sched_policy;
+        u64 sched_flags;
+        /* SCHED_NORMAL, SCHED_BATCH */
+        s32 sched_nice;
+        /* SCHED_FIFO, SCHED_RR */
+        u32 sched_priority;
+        /* SCHED_DEADLINE */
+        u64 sched_runtime;
+        u64 sched_deadline;
+        u64 sched_period;
+};
 struct exec_domain;
 struct futex_pi_state;
 struct robust_list_head;
@@ -168,7 +233,6 @@ extern char ___assert_task_state[1 - 2*!!(
 #define task_is_traced(task)    ((task->state & __TASK_TRACED) != 0)
 #define task_is_stopped(task)   ((task->state & __TASK_STOPPED) != 0)
-#define task_is_dead(task)      ((task)->exit_state != 0)
 #define task_is_stopped_or_traced(task) \
                        ((task->state & (__TASK_STOPPED | __TASK_TRACED)) != 0)
 #define task_contributes_to_load(task)  \
@@ -1029,6 +1093,51 @@ struct sched_rt_entity {
 #endif
 };
+struct sched_dl_entity {
+        struct rb_node  rb_node;
+        /*
+         * Original scheduling parameters. Copied here from sched_attr
+         * during sched_setscheduler2(), they will remain the same until
+         * the next sched_setscheduler2().
+         */
+        u64 dl_runtime;         /* maximum runtime for each instance    */
+        u64 dl_deadline;        /* relative deadline of each instance   */
+        u64 dl_period;          /* separation of two instances (period) */
+        u64 dl_bw;              /* dl_runtime / dl_deadline             */
+        /*
+         * Actual scheduling parameters. Initialized with the values above,
+         * they are continously updated during task execution. Note that
+         * the remaining runtime could be < 0 in case we are in overrun.
+         */
+        s64 runtime;            /* remaining runtime for this instance  */
+        u64 deadline;           /* absolute deadline for this instance  */
+        unsigned int flags;     /* specifying the scheduler behaviour   */
+        /*
+         * Some bool flags:
+         *
+         * @dl_throttled tells if we exhausted the runtime. If so, the
+         * task has to wait for a replenishment to be performed at the
+         * next firing of dl_timer.
+         *
+         * @dl_new tells if a new instance arrived. If so we must
+         * start executing it with full runtime and reset its absolute
+         * deadline;
+         *
+         * @dl_boosted tells if we are boosted due to DI. If so we are
+         * outside bandwidth enforcement mechanism (but only until we
+         * exit the critical section).
+         */
+        int dl_throttled, dl_new, dl_boosted;
+        /*
+         * Bandwidth enforcement timer. Each -deadline task has its
+         * own bandwidth to be enforced, thus we need one timer per task.
+         */
+        struct hrtimer dl_timer;
+};
 struct rcu_node;
@@ -1065,6 +1174,7 @@ struct task_struct {
 #ifdef CONFIG_CGROUP_SCHED
        struct task_group *sched_task_group;
 #endif
+        struct sched_dl_entity dl;
 #ifdef CONFIG_PREEMPT_NOTIFIERS
        /* list of struct preempt_notifier: */
@@ -1098,6 +1208,7 @@ struct task_struct {
        struct list_head tasks;
 #ifdef CONFIG_SMP
        struct plist_node pushable_tasks;
+        struct rb_node pushable_dl_tasks;
 #endif
        struct mm_struct *mm, *active_mm;
@@ -1249,9 +1360,12 @@ struct task_struct {
 #ifdef CONFIG_RT_MUTEXES
        /* PI waiters blocked on a rt_mutex held by this task */
-        struct plist_head pi_waiters;
+        struct rb_root pi_waiters;
+        struct rb_node *pi_waiters_leftmost;
        /* Deadlock detection and priority inheritance handling */
        struct rt_mutex_waiter *pi_blocked_on;
+        /* Top pi_waiters task */
+        struct task_struct *pi_top_task;
 #endif
 #ifdef CONFIG_DEBUG_MUTEXES
@@ -1880,7 +1994,9 @@ static inline void sched_clock_idle_wakeup_event(u64 delta_ns)
 * but then during bootup it turns out that sched_clock()
 * is reliable after all:
 */
-extern int sched_clock_stable;
+extern int sched_clock_stable(void);
+extern void set_sched_clock_stable(void);
+extern void clear_sched_clock_stable(void);
 extern void sched_clock_tick(void);
 extern void sched_clock_idle_sleep_event(void);
@@ -1959,6 +2075,8 @@ extern int sched_setscheduler(struct task_struct *, int,
                              const struct sched_param *);
 extern int sched_setscheduler_nocheck(struct task_struct *, int,
                                      const struct sched_param *);
+extern int sched_setattr(struct task_struct *,
+                         const struct sched_attr *);
 extern struct task_struct *idle_task(int cpu);
 /**
 * is_idle_task - is the specified task an idle task?
@@ -2038,7 +2156,7 @@ extern void wake_up_new_task(struct task_struct *tsk);
 #else
 static inline void kick_process(struct task_struct *tsk) { }
 #endif
-extern void sched_fork(unsigned long clone_flags, struct task_struct *p);
+extern int sched_fork(unsigned long clone_flags, struct task_struct *p);
 extern void sched_dead(struct task_struct *p);
 extern void proc_caches_init(void);
@@ -2627,6 +2745,21 @@ static inline bool __must_check current_clr_polling_and_test(void)
 }
 #endif
+static inline void current_clr_polling(void)
+{
+        __current_clr_polling();
+        /*
+         * Ensure we check TIF_NEED_RESCHED after we clear the polling bit.
+         * Once the bit is cleared, we'll get IPIs with every new
+         * TIF_NEED_RESCHED and the IPI handler, scheduler_ipi(), will also
+         * fold.
+         */
+        smp_mb(); /* paired with resched_task() */
+        preempt_fold_need_resched();
+}
 static __always_inline bool need_resched(void)
 {
        return unlikely(tif_need_resched());
diff --git a/include/linux/sched/deadline.h b/include/linux/sched/deadline.h
new file mode 100644
index 000000000000..9d303b8847df
--- /dev/null
+++ b/include/linux/sched/deadline.h
@@ -0,0 +1,24 @@
+#ifndef _SCHED_DEADLINE_H
+#define _SCHED_DEADLINE_H
+/*
+ * SCHED_DEADLINE tasks has negative priorities, reflecting
+ * the fact that any of them has higher prio than RT and
+ * NORMAL/BATCH tasks.
+ */
+#define MAX_DL_PRIO             0
+static inline int dl_prio(int prio)
+{
+        if (unlikely(prio < MAX_DL_PRIO))
+                return 1;
+        return 0;
+}
+static inline int dl_task(struct task_struct *p)
+{
+        return dl_prio(p->prio);
+}
+#endif /* _SCHED_DEADLINE_H */
diff --git a/include/linux/sched/rt.h b/include/linux/sched/rt.h
index 440434df3627..34e4ebea8fce 100644
--- a/include/linux/sched/rt.h
+++ b/include/linux/sched/rt.h
@@ -35,6 +35,7 @@ static inline int rt_task(struct task_struct *p)
 #ifdef CONFIG_RT_MUTEXES
 extern int rt_mutex_getprio(struct task_struct *p);
 extern void rt_mutex_setprio(struct task_struct *p, int prio);
+extern struct task_struct *rt_mutex_get_top_task(struct task_struct *task);
 extern void rt_mutex_adjust_pi(struct task_struct *p);
 static inline bool tsk_is_pi_blocked(struct task_struct *tsk)
 {
@@ -45,6 +46,10 @@ static inline int rt_mutex_getprio(struct task_struct *p)
 {
        return p->normal_prio;
 }
+static inline struct task_struct *rt_mutex_get_top_task(struct task_struct *task)
+{
+        return NULL;
+}
 # define rt_mutex_adjust_pi(p)          do { } while (0)
 static inline bool tsk_is_pi_blocked(struct task_struct *tsk)
 {
diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h
index 41467f8ff8ec..31e0193cb0c5 100644
--- a/include/linux/sched/sysctl.h
+++ b/include/linux/sched/sysctl.h
@@ -48,7 +48,6 @@ extern unsigned int sysctl_numa_balancing_scan_delay;
 extern unsigned int sysctl_numa_balancing_scan_period_min;
 extern unsigned int sysctl_numa_balancing_scan_period_max;
 extern unsigned int sysctl_numa_balancing_scan_size;
-extern unsigned int sysctl_numa_balancing_settle_count;
 #ifdef CONFIG_SCHED_DEBUG
 extern unsigned int sysctl_sched_migration_cost;
diff --git a/include/linux/seqlock.h b/include/linux/seqlock.h
index cf87a24c0f92..535f158977b9 100644
--- a/include/linux/seqlock.h
+++ b/include/linux/seqlock.h
@@ -117,15 +117,15 @@ repeat:
 }
 /**
- * read_seqcount_begin_no_lockdep - start seq-read critical section w/o lockdep
+ * raw_read_seqcount_begin - start seq-read critical section w/o lockdep
 * @s: pointer to seqcount_t
 * Returns: count to be passed to read_seqcount_retry
 *
- * read_seqcount_begin_no_lockdep opens a read critical section of the given
+ * raw_read_seqcount_begin opens a read critical section of the given
 * seqcount, but without any lockdep checking. Validity of the critical
 * section is tested by checking read_seqcount_retry function.
 */
-static inline unsigned read_seqcount_begin_no_lockdep(const seqcount_t *s)
+static inline unsigned raw_read_seqcount_begin(const seqcount_t *s)
 {
        unsigned ret = __read_seqcount_begin(s);
        smp_rmb();
@@ -144,7 +144,7 @@ static inline unsigned read_seqcount_begin_no_lockdep(const seqcount_t *s)
 static inline unsigned read_seqcount_begin(const seqcount_t *s)
 {
        seqcount_lockdep_reader_access(s);
-        return read_seqcount_begin_no_lockdep(s);
+        return raw_read_seqcount_begin(s);
 }
 /**
@@ -206,14 +206,26 @@ static inline int read_seqcount_retry(const seqcount_t *s, unsigned start)
 }
+static inline void raw_write_seqcount_begin(seqcount_t *s)
+{
+        s->sequence++;
+        smp_wmb();
+}
+static inline void raw_write_seqcount_end(seqcount_t *s)
+{
+        smp_wmb();
+        s->sequence++;
+}
 /*
 * Sequence counter only version assumes that callers are using their
 * own mutexing.
 */
 static inline void write_seqcount_begin_nested(seqcount_t *s, int subclass)
 {
-        s->sequence++;
+        raw_write_seqcount_begin(s);
-        smp_wmb();
        seqcount_acquire(&s->dep_map, subclass, 0, _RET_IP_);
 }
@@ -225,8 +237,7 @@ static inline void write_seqcount_begin(seqcount_t *s)
 static inline void write_seqcount_end(seqcount_t *s)
 {
        seqcount_release(&s->dep_map, 1, _RET_IP_);
-        smp_wmb();
+        raw_write_seqcount_end(s);
-        s->sequence++;
 }
 /**
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 215b5ea1cb30..6f69b3f914fb 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1638,6 +1638,11 @@ static inline void skb_set_mac_header(struct sk_buff *skb, const int offset)
        skb->mac_header += offset;
 }
+static inline void skb_pop_mac_header(struct sk_buff *skb)
+{
+        skb->mac_header = skb->network_header;
+}
 static inline void skb_probe_transport_header(struct sk_buff *skb,
                                              const int offset_hint)
 {
@@ -2526,6 +2531,10 @@ static inline void sw_tx_timestamp(struct sk_buff *skb)
 * Ethernet MAC Drivers should call this function in their hard_xmit()
 * function immediately before giving the sk_buff to the MAC hardware.
 *
+ * Specifically, one should make absolutely sure that this function is
+ * called before TX completion of this packet can trigger.  Otherwise
+ * the packet could potentially already be freed.
+ *
 * @skb: A socket buffer.
 */
 static inline void skb_tx_timestamp(struct sk_buff *skb)
diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h
index 75f34949d9ab..3f2867ff0ced 100644
--- a/include/linux/spinlock.h
+++ b/include/linux/spinlock.h
@@ -130,6 +130,16 @@ do {								\
 #define smp_mb__before_spinlock()       smp_wmb()
 #endif
+/*
+ * Place this after a lock-acquisition primitive to guarantee that
+ * an UNLOCK+LOCK pair act as a full barrier.  This guarantee applies
+ * if the UNLOCK and LOCK are executed by the same CPU or if the
+ * UNLOCK and LOCK operate on the same lock variable.
+ */
+#ifndef smp_mb__after_unlock_lock
+#define smp_mb__after_unlock_lock()     do { } while (0)
+#endif
 /**
 * raw_spin_unlock_wait - wait until the spinlock gets unlocked
 * @lock: the spinlock in question.
diff --git a/include/linux/spinlock_api_smp.h b/include/linux/spinlock_api_smp.h
index bdb9993f0fda..42dfab89e740 100644
--- a/include/linux/spinlock_api_smp.h
+++ b/include/linux/spinlock_api_smp.h
@@ -131,8 +131,7 @@ static inline void __raw_spin_lock_irq(raw_spinlock_t *lock)
 static inline void __raw_spin_lock_bh(raw_spinlock_t *lock)
 {
-        local_bh_disable();
+        __local_bh_disable_ip(_RET_IP_, SOFTIRQ_LOCK_OFFSET);
-        preempt_disable();
        spin_acquire(&lock->dep_map, 0, 0, _RET_IP_);
        LOCK_CONTENDED(lock, do_raw_spin_trylock, do_raw_spin_lock);
 }
@@ -174,20 +173,17 @@ static inline void __raw_spin_unlock_bh(raw_spinlock_t *lock)
 {
        spin_release(&lock->dep_map, 1, _RET_IP_);
        do_raw_spin_unlock(lock);
-        preempt_enable_no_resched();
+        __local_bh_enable_ip(_RET_IP_, SOFTIRQ_LOCK_OFFSET);
-        local_bh_enable_ip((unsigned long)__builtin_return_address(0));
 }
 static inline int __raw_spin_trylock_bh(raw_spinlock_t *lock)
 {
-        local_bh_disable();
+        __local_bh_disable_ip(_RET_IP_, SOFTIRQ_LOCK_OFFSET);
-        preempt_disable();
        if (do_raw_spin_trylock(lock)) {
                spin_acquire(&lock->dep_map, 0, 1, _RET_IP_);
                return 1;
        }
-        preempt_enable_no_resched();
+        __local_bh_enable_ip(_RET_IP_, SOFTIRQ_LOCK_OFFSET);
-        local_bh_enable_ip((unsigned long)__builtin_return_address(0));
        return 0;
 }
diff --git a/include/linux/spinlock_api_up.h b/include/linux/spinlock_api_up.h
index af1f47229e70..d0d188861ad6 100644
--- a/include/linux/spinlock_api_up.h
+++ b/include/linux/spinlock_api_up.h
@@ -24,11 +24,14 @@
 * flags straight, to suppress compiler warnings of unused lock
 * variables, and to add the proper checker annotations:
 */
+#define ___LOCK(lock) \
+  do { __acquire(lock); (void)(lock); } while (0)
 #define __LOCK(lock) \
-  do { preempt_disable(); __acquire(lock); (void)(lock); } while (0)
+  do { preempt_disable(); ___LOCK(lock); } while (0)
 #define __LOCK_BH(lock) \
-  do { local_bh_disable(); __LOCK(lock); } while (0)
+  do { __local_bh_disable_ip(_THIS_IP_, SOFTIRQ_LOCK_OFFSET); ___LOCK(lock); } while (0)
 #define __LOCK_IRQ(lock) \
  do { local_irq_disable(); __LOCK(lock); } while (0)
@@ -36,12 +39,15 @@
 #define __LOCK_IRQSAVE(lock, flags) \
  do { local_irq_save(flags); __LOCK(lock); } while (0)
+#define ___UNLOCK(lock) \
+  do { __release(lock); (void)(lock); } while (0)
 #define __UNLOCK(lock) \
-  do { preempt_enable(); __release(lock); (void)(lock); } while (0)
+  do { preempt_enable(); ___UNLOCK(lock); } while (0)
 #define __UNLOCK_BH(lock) \
-  do { preempt_enable_no_resched(); local_bh_enable(); \
+  do { __local_bh_enable_ip(_THIS_IP_, SOFTIRQ_LOCK_OFFSET); \
-          __release(lock); (void)(lock); } while (0)
+       ___UNLOCK(lock); } while (0)
 #define __UNLOCK_IRQ(lock) \
  do { local_irq_enable(); __UNLOCK(lock); } while (0)
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 94273bbe6050..40ed9e9a77e5 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -38,6 +38,7 @@ struct rlimit;
 struct rlimit64;
 struct rusage;
 struct sched_param;
+struct sched_attr;
 struct sel_arg_struct;
 struct semaphore;
 struct sembuf;
@@ -279,9 +280,14 @@ asmlinkage long sys_sched_setscheduler(pid_t pid, int policy,
                                        struct sched_param __user *param);
 asmlinkage long sys_sched_setparam(pid_t pid,
                                        struct sched_param __user *param);
+asmlinkage long sys_sched_setattr(pid_t pid,
+                                        struct sched_attr __user *attr);
 asmlinkage long sys_sched_getscheduler(pid_t pid);
 asmlinkage long sys_sched_getparam(pid_t pid,
                                        struct sched_param __user *param);
+asmlinkage long sys_sched_getattr(pid_t pid,
+                                        struct sched_attr __user *attr,
+                                        unsigned int size);
 asmlinkage long sys_sched_setaffinity(pid_t pid, unsigned int len,
                                        unsigned long __user *user_mask_ptr);
 asmlinkage long sys_sched_getaffinity(pid_t pid, unsigned int len,
diff --git a/include/linux/tick.h b/include/linux/tick.h
index 5128d33bbb39..0175d8663b6c 100644
--- a/include/linux/tick.h
+++ b/include/linux/tick.h
@@ -104,7 +104,7 @@ extern struct cpumask *tick_get_broadcast_oneshot_mask(void);
 extern void tick_clock_notify(void);
 extern int tick_check_oneshot_change(int allow_nohz);
 extern struct tick_sched *tick_get_tick_sched(int cpu);
-extern void tick_check_idle(int cpu);
+extern void tick_check_idle(void);
 extern int tick_oneshot_mode_active(void);
 #  ifndef arch_needs_cpu
 #   define arch_needs_cpu(cpu) (0)
@@ -112,7 +112,7 @@ extern int tick_oneshot_mode_active(void);
 # else
 static inline void tick_clock_notify(void) { }
 static inline int tick_check_oneshot_change(int allow_nohz) { return 0; }
-static inline void tick_check_idle(int cpu) { }
+static inline void tick_check_idle(void) { }
 static inline int tick_oneshot_mode_active(void) { return 0; }
 # endif
@@ -121,7 +121,7 @@ static inline void tick_init(void) { }
 static inline void tick_cancel_sched_timer(int cpu) { }
 static inline void tick_clock_notify(void) { }
 static inline int tick_check_oneshot_change(int allow_nohz) { return 0; }
-static inline void tick_check_idle(int cpu) { }
+static inline void tick_check_idle(void) { }
 static inline int tick_oneshot_mode_active(void) { return 0; }
 #endif /* !CONFIG_GENERIC_CLOCKEVENTS */
@@ -165,7 +165,7 @@ extern cpumask_var_t tick_nohz_full_mask;
 static inline bool tick_nohz_full_enabled(void)
 {
-        if (!static_key_false(&context_tracking_enabled))
+        if (!context_tracking_is_enabled())
                return false;
        return tick_nohz_full_running;
diff --git a/include/linux/uaccess.h b/include/linux/uaccess.h
index 9d8cf056e661..ecd3319dac33 100644
--- a/include/linux/uaccess.h
+++ b/include/linux/uaccess.h
@@ -25,13 +25,16 @@ static inline void pagefault_disable(void)
 static inline void pagefault_enable(void)
 {
+#ifndef CONFIG_PREEMPT
        /*
         * make sure to issue those last loads/stores before enabling
         * the pagefault handler again.
         */
        barrier();
        preempt_count_dec();
-        preempt_check_resched();
+#else
+        preempt_enable();
+#endif
 }
 #ifndef ARCH_HAS_NOCACHE_UACCESS
diff --git a/include/linux/uprobes.h b/include/linux/uprobes.h
index 319eae70fe84..e32251e00e62 100644
--- a/include/linux/uprobes.h
+++ b/include/linux/uprobes.h
@@ -26,16 +26,13 @@
 #include <linux/errno.h>
 #include <linux/rbtree.h>
+#include <linux/types.h>
 struct vm_area_struct;
 struct mm_struct;
 struct inode;
 struct notifier_block;
-#ifdef CONFIG_ARCH_SUPPORTS_UPROBES
-# include <asm/uprobes.h>
-#endif
 #define UPROBE_HANDLER_REMOVE           1
 #define UPROBE_HANDLER_MASK             1
@@ -60,6 +57,8 @@ struct uprobe_consumer {
 };
 #ifdef CONFIG_UPROBES
+#include <asm/uprobes.h>
 enum uprobe_task_state {
        UTASK_RUNNING,
        UTASK_SSTEP,
@@ -72,35 +71,28 @@ enum uprobe_task_state {
 */
 struct uprobe_task {
        enum uprobe_task_state          state;
-        struct arch_uprobe_task         autask;
-        struct return_instance          *return_instances;
+        union {
-        unsigned int                    depth;
+                struct {
-        struct uprobe                   *active_uprobe;
+                        struct arch_uprobe_task autask;
+                        unsigned long           vaddr;
+                };
+                struct {
+                        struct callback_head    dup_xol_work;
+                        unsigned long           dup_xol_addr;
+                };
+        };
+        struct uprobe                   *active_uprobe;
        unsigned long                   xol_vaddr;
-        unsigned long                   vaddr;
-};
-/*
+        struct return_instance          *return_instances;
- * On a breakpoint hit, thread contests for a slot.  It frees the
+        unsigned int                    depth;
- * slot after singlestep. Currently a fixed number of slots are
- * allocated.
- */
-struct xol_area {
-        wait_queue_head_t       wq;             /* if all slots are busy */
-        atomic_t                slot_count;     /* number of in-use slots */
-        unsigned long           *bitmap;        /* 0 = free slot */
-        struct page             *page;
-        /*
-         * We keep the vma's vm_start rather than a pointer to the vma
-         * itself.  The probed process or a naughty kernel module could make
-         * the vma go away, and we must handle that reasonably gracefully.
-         */
-        unsigned long           vaddr;          /* Page(s) of instruction slots */
 };
+struct xol_area;
 struct uprobes_state {
        struct xol_area         *xol_area;
 };
@@ -109,6 +101,7 @@ extern int __weak set_swbp(struct arch_uprobe *aup, struct mm_struct *mm, unsign
 extern int __weak set_orig_insn(struct arch_uprobe *aup, struct mm_struct *mm, unsigned long vaddr);
 extern bool __weak is_swbp_insn(uprobe_opcode_t *insn);
 extern bool __weak is_trap_insn(uprobe_opcode_t *insn);
+extern unsigned long __weak uprobe_get_swbp_addr(struct pt_regs *regs);
 extern int uprobe_write_opcode(struct mm_struct *mm, unsigned long vaddr, uprobe_opcode_t);
 extern int uprobe_register(struct inode *inode, loff_t offset, struct uprobe_consumer *uc);
 extern int uprobe_apply(struct inode *inode, loff_t offset, struct uprobe_consumer *uc, bool);
@@ -120,7 +113,6 @@ extern void uprobe_end_dup_mmap(void);
 extern void uprobe_dup_mmap(struct mm_struct *oldmm, struct mm_struct *newmm);
 extern void uprobe_free_utask(struct task_struct *t);
 extern void uprobe_copy_process(struct task_struct *t, unsigned long flags);
-extern unsigned long __weak uprobe_get_swbp_addr(struct pt_regs *regs);
 extern int uprobe_post_sstep_notifier(struct pt_regs *regs);
 extern int uprobe_pre_sstep_notifier(struct pt_regs *regs);
 extern void uprobe_notify_resume(struct pt_regs *regs);
@@ -176,10 +168,6 @@ static inline bool uprobe_deny_signal(void)
 {
        return false;
 }
-static inline unsigned long uprobe_get_swbp_addr(struct pt_regs *regs)
-{
-        return 0;
-}
 static inline void uprobe_free_utask(struct task_struct *t)
 {
 }
diff --git a/include/linux/vtime.h b/include/linux/vtime.h
index f5b72b364bda..c5165fd256f9 100644
--- a/include/linux/vtime.h
+++ b/include/linux/vtime.h
@@ -19,8 +19,8 @@ static inline bool vtime_accounting_enabled(void) { return true; }
 #ifdef CONFIG_VIRT_CPU_ACCOUNTING_GEN
 static inline bool vtime_accounting_enabled(void)
 {
-        if (static_key_false(&context_tracking_enabled)) {
+        if (context_tracking_is_enabled()) {
-                if (context_tracking_active())
+                if (context_tracking_cpu_is_enabled())
                        return true;
        }
diff --git a/include/linux/zorro.h b/include/linux/zorro.h
index dff42025649b..63fbba0740c2 100644
--- a/include/linux/zorro.h
+++ b/include/linux/zorro.h
@@ -11,107 +11,10 @@
 #ifndef _LINUX_ZORRO_H
 #define _LINUX_ZORRO_H
-#include <linux/device.h>
-    /*
-     *  Each Zorro board has a 32-bit ID of the form
-     *
-     *      mmmmmmmmmmmmmmmmppppppppeeeeeeee
-     *
-     *  with
-     *
-     *      mmmmmmmmmmmmmmmm    16-bit Manufacturer ID (assigned by CBM (sigh))
-     *      pppppppp            8-bit Product ID (assigned by manufacturer)
-     *      eeeeeeee            8-bit Extended Product ID (currently only used
-     *                          for some GVP boards)
-     */
-#define ZORRO_MANUF(id)         ((id) >> 16)
-#define ZORRO_PROD(id)          (((id) >> 8) & 0xff)
-#define ZORRO_EPC(id)           ((id) & 0xff)
-#define ZORRO_ID(manuf, prod, epc) \
-    ((ZORRO_MANUF_##manuf << 16) | ((prod) << 8) | (epc))
-typedef __u32 zorro_id;
-/* Include the ID list */
-#include <linux/zorro_ids.h>
-    /*
+#include <uapi/linux/zorro.h>
-     *  GVP identifies most of its products through the 'extended product code'
-     *  (epc). The epc has to be ANDed with the GVP_PRODMASK before the
-     *  identification.
-     */
-#define GVP_PRODMASK                    (0xf8)
-#define GVP_SCSICLKMASK                 (0x01)
-enum GVP_flags {
-    GVP_IO              = 0x01,
-    GVP_ACCEL           = 0x02,
-    GVP_SCSI            = 0x04,
-    GVP_24BITDMA        = 0x08,
-    GVP_25BITDMA        = 0x10,
-    GVP_NOBANK          = 0x20,
-    GVP_14MHZ           = 0x40,
-};
-struct Node {
-    struct  Node *ln_Succ;      /* Pointer to next (successor) */
-    struct  Node *ln_Pred;      /* Pointer to previous (predecessor) */
-    __u8    ln_Type;
-    __s8    ln_Pri;             /* Priority, for sorting */
-    __s8    *ln_Name;           /* ID string, null terminated */
-} __attribute__ ((packed));
-struct ExpansionRom {
-    /* -First 16 bytes of the expansion ROM */
-    __u8  er_Type;              /* Board type, size and flags */
-    __u8  er_Product;           /* Product number, assigned by manufacturer */
-    __u8  er_Flags;             /* Flags */
-    __u8  er_Reserved03;        /* Must be zero ($ff inverted) */
-    __u16 er_Manufacturer;      /* Unique ID, ASSIGNED BY COMMODORE-AMIGA! */
-    __u32 er_SerialNumber;      /* Available for use by manufacturer */
-    __u16 er_InitDiagVec;       /* Offset to optional "DiagArea" structure */
-    __u8  er_Reserved0c;
-    __u8  er_Reserved0d;
-    __u8  er_Reserved0e;
-    __u8  er_Reserved0f;
-} __attribute__ ((packed));
-/* er_Type board type bits */
-#define ERT_TYPEMASK    0xc0
-#define ERT_ZORROII     0xc0
-#define ERT_ZORROIII    0x80
-/* other bits defined in er_Type */
-#define ERTB_MEMLIST    5               /* Link RAM into free memory list */
-#define ERTF_MEMLIST    (1<<5)
-struct ConfigDev {
-    struct Node         cd_Node;
-    __u8                cd_Flags;       /* (read/write) */
-    __u8                cd_Pad;         /* reserved */
-    struct ExpansionRom cd_Rom;         /* copy of board's expansion ROM */
-    void                *cd_BoardAddr;  /* where in memory the board was placed */
-    __u32               cd_BoardSize;   /* size of board in bytes */
-    __u16               cd_SlotAddr;    /* which slot number (PRIVATE) */
-    __u16               cd_SlotSize;    /* number of slots (PRIVATE) */
-    void                *cd_Driver;     /* pointer to node of driver */
-    struct ConfigDev    *cd_NextCD;     /* linked list of drivers to config */
-    __u32               cd_Unused[4];   /* for whatever the driver wants */
-} __attribute__ ((packed));
-#define ZORRO_NUM_AUTO          16
-#ifdef __KERNEL__
+#include <linux/device.h>
 #include <linux/init.h>
 #include <linux/ioport.h>
 #include <linux/mod_devicetable.h>
@@ -175,7 +78,23 @@ static inline struct zorro_driver *zorro_dev_driver(const struct zorro_dev *z)
 extern unsigned int zorro_num_autocon;  /* # of autoconfig devices found */
-extern struct zorro_dev zorro_autocon[ZORRO_NUM_AUTO];
+extern struct zorro_dev *zorro_autocon;
+    /*
+     * Minimal information about a Zorro device, passed from bootinfo
+     * Only available temporarily, i.e. until initmem has been freed!
+     */
+struct zorro_dev_init {
+        struct ExpansionRom rom;
+        u16 slotaddr;
+        u16 slotsize;
+        u32 boardaddr;
+        u32 boardsize;
+};
+extern struct zorro_dev_init zorro_autocon_init[ZORRO_NUM_AUTO] __initdata;
    /*
@@ -229,6 +148,4 @@ extern DECLARE_BITMAP(zorro_unused_z2ram, 128);
 #define Z2RAM_CHUNKSHIFT        (16)
-#endif /* __KERNEL__ */
 #endif /* _LINUX_ZORRO_H */
diff --git a/include/net/busy_poll.h b/include/net/busy_poll.h
index 829627d7b846..1d67fb6b23a0 100644
--- a/include/net/busy_poll.h
+++ b/include/net/busy_poll.h
@@ -42,27 +42,10 @@ static inline bool net_busy_loop_on(void)
        return sysctl_net_busy_poll;
 }
-/* a wrapper to make debug_smp_processor_id() happy
- * we can use sched_clock() because we don't care much about precision
- * we only care that the average is bounded
- */
-#ifdef CONFIG_DEBUG_PREEMPT
-static inline u64 busy_loop_us_clock(void)
-{
-        u64 rc;
-        preempt_disable_notrace();
-        rc = sched_clock();
-        preempt_enable_no_resched_notrace();
-        return rc >> 10;
-}
-#else /* CONFIG_DEBUG_PREEMPT */
 static inline u64 busy_loop_us_clock(void)
 {
-        return sched_clock() >> 10;
+        return local_clock() >> 10;
 }
-#endif /* CONFIG_DEBUG_PREEMPT */
 static inline unsigned long sk_busy_loop_end_time(struct sock *sk)
 {
diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h
index 76d54270f2e2..65bb13035598 100644
--- a/include/net/if_inet6.h
+++ b/include/net/if_inet6.h
@@ -165,7 +165,6 @@ struct inet6_dev {
        struct net_device       *dev;
        struct list_head        addr_list;
-        int                     valid_ll_addr_cnt;
        struct ifmcaddr6        *mc_list;
        struct ifmcaddr6        *mc_tomb;
diff --git a/include/net/llc_pdu.h b/include/net/llc_pdu.h
index 31e2de7d57c5..c0f0a13ed818 100644
--- a/include/net/llc_pdu.h
+++ b/include/net/llc_pdu.h
@@ -142,7 +142,7 @@
 #define LLC_S_PF_IS_1(pdu)     ((pdu->ctrl_2 & LLC_S_PF_BIT_MASK) ? 1 : 0)
 #define PDU_SUPV_GET_Nr(pdu)   ((pdu->ctrl_2 & 0xFE) >> 1)
-#define PDU_GET_NEXT_Vr(sn)    (++sn & ~LLC_2_SEQ_NBR_MODULO)
+#define PDU_GET_NEXT_Vr(sn)    (((sn) + 1) & ~LLC_2_SEQ_NBR_MODULO)
 /* FRMR information field macros */
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 67b5d0068273..0a248b323d87 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -1046,9 +1046,6 @@ struct sctp_outq {
        /* Corked? */
        char cork;
-        /* Is this structure empty?  */
-        char empty;
 };
 void sctp_outq_init(struct sctp_association *, struct sctp_outq *);
diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h
index 979874c627ee..61e1935c91b1 100644
--- a/include/rdma/ib_verbs.h
+++ b/include/rdma/ib_verbs.h
@@ -978,7 +978,7 @@ struct ib_uobject {
 };
 struct ib_udata {
-        void __user *inbuf;
+        const void __user *inbuf;
        void __user *outbuf;
        size_t       inlen;
        size_t       outlen;
diff --git a/include/trace/events/ras.h b/include/trace/events/ras.h
index 88b878383797..1c875ad1ee5f 100644
--- a/include/trace/events/ras.h
+++ b/include/trace/events/ras.h
@@ -5,7 +5,7 @@
 #define _TRACE_AER_H
 #include <linux/tracepoint.h>
-#include <linux/edac.h>
+#include <linux/aer.h>
 /*
@@ -63,10 +63,10 @@ TRACE_EVENT(aer_event,
        TP_printk("%s PCIe Bus Error: severity=%s, %s\n",
                __get_str(dev_name),
-                __entry->severity == HW_EVENT_ERR_CORRECTED ? "Corrected" :
+                __entry->severity == AER_CORRECTABLE ? "Corrected" :
-                        __entry->severity == HW_EVENT_ERR_FATAL ?
+                        __entry->severity == AER_FATAL ?
-                        "Fatal" : "Uncorrected",
+                        "Fatal" : "Uncorrected, non-fatal",
-                __entry->severity == HW_EVENT_ERR_CORRECTED ?
+                __entry->severity == AER_CORRECTABLE ?
                __print_flags(__entry->status, "|", aer_correctable_errors) :
                __print_flags(__entry->status, "|", aer_uncorrectable_errors))
 );
diff --git a/include/uapi/asm-generic/statfs.h b/include/uapi/asm-generic/statfs.h
index 0999647fca13..cb89cc730f0b 100644
--- a/include/uapi/asm-generic/statfs.h
+++ b/include/uapi/asm-generic/statfs.h
@@ -13,7 +13,7 @@
 */
 #ifndef __statfs_word
 #if __BITS_PER_LONG == 64
-#define __statfs_word long
+#define __statfs_word __kernel_long_t
 #else
 #define __statfs_word __u32
 #endif
diff --git a/include/uapi/drm/radeon_drm.h b/include/uapi/drm/radeon_drm.h
index 2f3f7ea8c77b..fe421e8a431b 100644
--- a/include/uapi/drm/radeon_drm.h
+++ b/include/uapi/drm/radeon_drm.h
@@ -983,6 +983,8 @@ struct drm_radeon_cs {
 #define RADEON_INFO_SI_CP_DMA_COMPUTE   0x17
 /* CIK macrotile mode array */
 #define RADEON_INFO_CIK_MACROTILE_MODE_ARRAY    0x18
+/* query the number of render backends */
+#define RADEON_INFO_SI_BACKEND_ENABLED_MASK     0x19
 struct drm_radeon_info {
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index 33d2b8fe166d..3ce25b5d75a9 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -426,3 +426,5 @@ header-y += x25.h
 header-y += xattr.h
 header-y += xfrm.h
 header-y += hw_breakpoint.h
+header-y += zorro.h
+header-y += zorro_ids.h
diff --git a/include/uapi/linux/genwqe/genwqe_card.h b/include/uapi/linux/genwqe/genwqe_card.h
new file mode 100644
index 000000000000..795e957bb840
--- /dev/null
+++ b/include/uapi/linux/genwqe/genwqe_card.h
@@ -0,0 +1,500 @@
+#ifndef __GENWQE_CARD_H__
+#define __GENWQE_CARD_H__
+/**
+ * IBM Accelerator Family 'GenWQE'
+ *
+ * (C) Copyright IBM Corp. 2013
+ *
+ * Author: Frank Haverkamp <haver@linux.vnet.ibm.com>
+ * Author: Joerg-Stephan Vogt <jsvogt@de.ibm.com>
+ * Author: Michael Jung <mijung@de.ibm.com>
+ * Author: Michael Ruettger <michael@ibmra.de>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License (version 2 only)
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ */
+/*
+ * User-space API for the GenWQE card. For debugging and test purposes
+ * the register addresses are included here too.
+ */
+#include <linux/types.h>
+#include <linux/ioctl.h>
+/* Basename of sysfs, debugfs and /dev interfaces */
+#define GENWQE_DEVNAME                  "genwqe"
+#define GENWQE_TYPE_ALTERA_230          0x00 /* GenWQE4 Stratix-IV-230 */
+#define GENWQE_TYPE_ALTERA_530          0x01 /* GenWQE4 Stratix-IV-530 */
+#define GENWQE_TYPE_ALTERA_A4           0x02 /* GenWQE5 A4 Stratix-V-A4 */
+#define GENWQE_TYPE_ALTERA_A7           0x03 /* GenWQE5 A7 Stratix-V-A7 */
+/* MMIO Unit offsets: Each UnitID occupies a defined address range */
+#define GENWQE_UID_OFFS(uid)            ((uid) << 24)
+#define GENWQE_SLU_OFFS                 GENWQE_UID_OFFS(0)
+#define GENWQE_HSU_OFFS                 GENWQE_UID_OFFS(1)
+#define GENWQE_APP_OFFS                 GENWQE_UID_OFFS(2)
+#define GENWQE_MAX_UNITS                3
+/* Common offsets per UnitID */
+#define IO_EXTENDED_ERROR_POINTER       0x00000048
+#define IO_ERROR_INJECT_SELECTOR        0x00000060
+#define IO_EXTENDED_DIAG_SELECTOR       0x00000070
+#define IO_EXTENDED_DIAG_READ_MBX       0x00000078
+#define IO_EXTENDED_DIAG_MAP(ring)      (0x00000500 | ((ring) << 3))
+#define GENWQE_EXTENDED_DIAG_SELECTOR(ring, trace) (((ring) << 8) | (trace))
+/* UnitID 0: Service Layer Unit (SLU) */
+/* SLU: Unit Configuration Register */
+#define IO_SLU_UNITCFG                  0x00000000
+#define IO_SLU_UNITCFG_TYPE_MASK        0x000000000ff00000 /* 27:20 */
+/* SLU: Fault Isolation Register (FIR) (ac_slu_fir) */
+#define IO_SLU_FIR                      0x00000008 /* read only, wr direct */
+#define IO_SLU_FIR_CLR                  0x00000010 /* read and clear */
+/* SLU: First Error Capture Register (FEC/WOF) */
+#define IO_SLU_FEC                      0x00000018
+#define IO_SLU_ERR_ACT_MASK             0x00000020
+#define IO_SLU_ERR_ATTN_MASK            0x00000028
+#define IO_SLU_FIRX1_ACT_MASK           0x00000030
+#define IO_SLU_FIRX0_ACT_MASK           0x00000038
+#define IO_SLU_SEC_LEM_DEBUG_OVR        0x00000040
+#define IO_SLU_EXTENDED_ERR_PTR         0x00000048
+#define IO_SLU_COMMON_CONFIG            0x00000060
+#define IO_SLU_FLASH_FIR                0x00000108
+#define IO_SLU_SLC_FIR                  0x00000110
+#define IO_SLU_RIU_TRAP                 0x00000280
+#define IO_SLU_FLASH_FEC                0x00000308
+#define IO_SLU_SLC_FEC                  0x00000310
+/*
+ * The  Virtual Function's Access is from offset 0x00010000
+ * The Physical Function's Access is from offset 0x00050000
+ * Single Shared Registers exists only at offset 0x00060000
+ *
+ * SLC: Queue Virtual Window Window for accessing into a specific VF
+ * queue. When accessing the 0x10000 space using the 0x50000 address
+ * segment, the value indicated here is used to specify which VF
+ * register is decoded. This register, and the 0x50000 register space
+ * can only be accessed by the PF. Example, if this register is set to
+ * 0x2, then a read from 0x50000 is the same as a read from 0x10000
+ * from VF=2.
+ */
+/* SLC: Queue Segment */
+#define IO_SLC_QUEUE_SEGMENT            0x00010000
+#define IO_SLC_VF_QUEUE_SEGMENT         0x00050000
+/* SLC: Queue Offset */
+#define IO_SLC_QUEUE_OFFSET             0x00010008
+#define IO_SLC_VF_QUEUE_OFFSET          0x00050008
+/* SLC: Queue Configuration */
+#define IO_SLC_QUEUE_CONFIG             0x00010010
+#define IO_SLC_VF_QUEUE_CONFIG          0x00050010
+/* SLC: Job Timout/Only accessible for the PF */
+#define IO_SLC_APPJOB_TIMEOUT           0x00010018
+#define IO_SLC_VF_APPJOB_TIMEOUT        0x00050018
+#define TIMEOUT_250MS                   0x0000000f
+#define HEARTBEAT_DISABLE               0x0000ff00
+/* SLC: Queue InitSequence Register */
+#define IO_SLC_QUEUE_INITSQN            0x00010020
+#define IO_SLC_VF_QUEUE_INITSQN         0x00050020
+/* SLC: Queue Wrap */
+#define IO_SLC_QUEUE_WRAP               0x00010028
+#define IO_SLC_VF_QUEUE_WRAP            0x00050028
+/* SLC: Queue Status */
+#define IO_SLC_QUEUE_STATUS             0x00010100
+#define IO_SLC_VF_QUEUE_STATUS          0x00050100
+/* SLC: Queue Working Time */
+#define IO_SLC_QUEUE_WTIME              0x00010030
+#define IO_SLC_VF_QUEUE_WTIME           0x00050030
+/* SLC: Queue Error Counts */
+#define IO_SLC_QUEUE_ERRCNTS            0x00010038
+#define IO_SLC_VF_QUEUE_ERRCNTS         0x00050038
+/* SLC: Queue Loast Response Word */
+#define IO_SLC_QUEUE_LRW                0x00010040
+#define IO_SLC_VF_QUEUE_LRW             0x00050040
+/* SLC: Freerunning Timer */
+#define IO_SLC_FREE_RUNNING_TIMER       0x00010108
+#define IO_SLC_VF_FREE_RUNNING_TIMER    0x00050108
+/* SLC: Queue Virtual Access Region */
+#define IO_PF_SLC_VIRTUAL_REGION        0x00050000
+/* SLC: Queue Virtual Window */
+#define IO_PF_SLC_VIRTUAL_WINDOW        0x00060000
+/* SLC: DDCB Application Job Pending [n] (n=0:63) */
+#define IO_PF_SLC_JOBPEND(n)            (0x00061000 + 8*(n))
+#define IO_SLC_JOBPEND(n)               IO_PF_SLC_JOBPEND(n)
+/* SLC: Parser Trap RAM [n] (n=0:31) */
+#define IO_SLU_SLC_PARSE_TRAP(n)        (0x00011000 + 8*(n))
+/* SLC: Dispatcher Trap RAM [n] (n=0:31) */
+#define IO_SLU_SLC_DISP_TRAP(n) (0x00011200 + 8*(n))
+/* Global Fault Isolation Register (GFIR) */
+#define IO_SLC_CFGREG_GFIR              0x00020000
+#define GFIR_ERR_TRIGGER                0x0000ffff
+/* SLU: Soft Reset Register */
+#define IO_SLC_CFGREG_SOFTRESET         0x00020018
+/* SLU: Misc Debug Register */
+#define IO_SLC_MISC_DEBUG               0x00020060
+#define IO_SLC_MISC_DEBUG_CLR           0x00020068
+#define IO_SLC_MISC_DEBUG_SET           0x00020070
+/* Temperature Sensor Reading */
+#define IO_SLU_TEMPERATURE_SENSOR       0x00030000
+#define IO_SLU_TEMPERATURE_CONFIG       0x00030008
+/* Voltage Margining Control */
+#define IO_SLU_VOLTAGE_CONTROL          0x00030080
+#define IO_SLU_VOLTAGE_NOMINAL          0x00000000
+#define IO_SLU_VOLTAGE_DOWN5            0x00000006
+#define IO_SLU_VOLTAGE_UP5              0x00000007
+/* Direct LED Control Register */
+#define IO_SLU_LEDCONTROL               0x00030100
+/* SLU: Flashbus Direct Access -A5 */
+#define IO_SLU_FLASH_DIRECTACCESS       0x00040010
+/* SLU: Flashbus Direct Access2 -A5 */
+#define IO_SLU_FLASH_DIRECTACCESS2      0x00040020
+/* SLU: Flashbus Command Interface -A5 */
+#define IO_SLU_FLASH_CMDINTF            0x00040030
+/* SLU: BitStream Loaded */
+#define IO_SLU_BITSTREAM                0x00040040
+/* This Register has a switch which will change the CAs to UR */
+#define IO_HSU_ERR_BEHAVIOR             0x01001010
+#define IO_SLC2_SQB_TRAP                0x00062000
+#define IO_SLC2_QUEUE_MANAGER_TRAP      0x00062008
+#define IO_SLC2_FLS_MASTER_TRAP         0x00062010
+/* UnitID 1: HSU Registers */
+#define IO_HSU_UNITCFG                  0x01000000
+#define IO_HSU_FIR                      0x01000008
+#define IO_HSU_FIR_CLR                  0x01000010
+#define IO_HSU_FEC                      0x01000018
+#define IO_HSU_ERR_ACT_MASK             0x01000020
+#define IO_HSU_ERR_ATTN_MASK            0x01000028
+#define IO_HSU_FIRX1_ACT_MASK           0x01000030
+#define IO_HSU_FIRX0_ACT_MASK           0x01000038
+#define IO_HSU_SEC_LEM_DEBUG_OVR        0x01000040
+#define IO_HSU_EXTENDED_ERR_PTR         0x01000048
+#define IO_HSU_COMMON_CONFIG            0x01000060
+/* UnitID 2: Application Unit (APP) */
+#define IO_APP_UNITCFG                  0x02000000
+#define IO_APP_FIR                      0x02000008
+#define IO_APP_FIR_CLR                  0x02000010
+#define IO_APP_FEC                      0x02000018
+#define IO_APP_ERR_ACT_MASK             0x02000020
+#define IO_APP_ERR_ATTN_MASK            0x02000028
+#define IO_APP_FIRX1_ACT_MASK           0x02000030
+#define IO_APP_FIRX0_ACT_MASK           0x02000038
+#define IO_APP_SEC_LEM_DEBUG_OVR        0x02000040
+#define IO_APP_EXTENDED_ERR_PTR         0x02000048
+#define IO_APP_COMMON_CONFIG            0x02000060
+#define IO_APP_DEBUG_REG_01             0x02010000
+#define IO_APP_DEBUG_REG_02             0x02010008
+#define IO_APP_DEBUG_REG_03             0x02010010
+#define IO_APP_DEBUG_REG_04             0x02010018
+#define IO_APP_DEBUG_REG_05             0x02010020
+#define IO_APP_DEBUG_REG_06             0x02010028
+#define IO_APP_DEBUG_REG_07             0x02010030
+#define IO_APP_DEBUG_REG_08             0x02010038
+#define IO_APP_DEBUG_REG_09             0x02010040
+#define IO_APP_DEBUG_REG_10             0x02010048
+#define IO_APP_DEBUG_REG_11             0x02010050
+#define IO_APP_DEBUG_REG_12             0x02010058
+#define IO_APP_DEBUG_REG_13             0x02010060
+#define IO_APP_DEBUG_REG_14             0x02010068
+#define IO_APP_DEBUG_REG_15             0x02010070
+#define IO_APP_DEBUG_REG_16             0x02010078
+#define IO_APP_DEBUG_REG_17             0x02010080
+#define IO_APP_DEBUG_REG_18             0x02010088
+/* Read/write from/to registers */
+struct genwqe_reg_io {
+        __u64 num;              /* register offset/address */
+        __u64 val64;
+};
+/*
+ * All registers of our card will return values not equal this values.
+ * If we see IO_ILLEGAL_VALUE on any of our MMIO register reads, the
+ * card can be considered as unusable. It will need recovery.
+ */
+#define IO_ILLEGAL_VALUE                0xffffffffffffffffull
+/*
+ * Generic DDCB execution interface.
+ *
+ * This interface is a first prototype resulting from discussions we
+ * had with other teams which wanted to use the Genwqe card. It allows
+ * to issue a DDCB request in a generic way. The request will block
+ * until it finishes or time out with error.
+ *
+ * Some DDCBs require DMA addresses to be specified in the ASIV
+ * block. The interface provies the capability to let the kernel
+ * driver know where those addresses are by specifying the ATS field,
+ * such that it can replace the user-space addresses with appropriate
+ * DMA addresses or DMA addresses of a scatter gather list which is
+ * dynamically created.
+ *
+ * Our hardware will refuse DDCB execution if the ATS field is not as
+ * expected. That means the DDCB execution engine in the chip knows
+ * where it expects DMA addresses within the ASIV part of the DDCB and
+ * will check that against the ATS field definition. Any invalid or
+ * unknown ATS content will lead to DDCB refusal.
+ */
+/* Genwqe chip Units */
+#define DDCB_ACFUNC_SLU                 0x00  /* chip service layer unit */
+#define DDCB_ACFUNC_APP                 0x01  /* chip application */
+/* DDCB return codes (RETC) */
+#define DDCB_RETC_IDLE                  0x0000 /* Unexecuted/DDCB created */
+#define DDCB_RETC_PENDING               0x0101 /* Pending Execution */
+#define DDCB_RETC_COMPLETE              0x0102 /* Cmd complete. No error */
+#define DDCB_RETC_FAULT                 0x0104 /* App Err, recoverable */
+#define DDCB_RETC_ERROR                 0x0108 /* App Err, non-recoverable */
+#define DDCB_RETC_FORCED_ERROR          0x01ff /* overwritten by driver  */
+#define DDCB_RETC_UNEXEC                0x0110 /* Unexe/Removed from queue */
+#define DDCB_RETC_TERM                  0x0120 /* Terminated */
+#define DDCB_RETC_RES0                  0x0140 /* Reserved */
+#define DDCB_RETC_RES1                  0x0180 /* Reserved */
+/* DDCB Command Options (CMDOPT) */
+#define DDCB_OPT_ECHO_FORCE_NO          0x0000 /* ECHO DDCB */
+#define DDCB_OPT_ECHO_FORCE_102         0x0001 /* force return code */
+#define DDCB_OPT_ECHO_FORCE_104         0x0002
+#define DDCB_OPT_ECHO_FORCE_108         0x0003
+#define DDCB_OPT_ECHO_FORCE_110         0x0004 /* only on PF ! */
+#define DDCB_OPT_ECHO_FORCE_120         0x0005
+#define DDCB_OPT_ECHO_FORCE_140         0x0006
+#define DDCB_OPT_ECHO_FORCE_180         0x0007
+#define DDCB_OPT_ECHO_COPY_NONE         (0 << 5)
+#define DDCB_OPT_ECHO_COPY_ALL          (1 << 5)
+/* Definitions of Service Layer Commands */
+#define SLCMD_ECHO_SYNC                 0x00 /* PF/VF */
+#define SLCMD_MOVE_FLASH                0x06 /* PF only */
+#define SLCMD_MOVE_FLASH_FLAGS_MODE     0x03 /* bit 0 and 1 used for mode */
+#define SLCMD_MOVE_FLASH_FLAGS_DLOAD    0       /* mode: download  */
+#define SLCMD_MOVE_FLASH_FLAGS_EMUL     1       /* mode: emulation */
+#define SLCMD_MOVE_FLASH_FLAGS_UPLOAD   2       /* mode: upload    */
+#define SLCMD_MOVE_FLASH_FLAGS_VERIFY   3       /* mode: verify    */
+#define SLCMD_MOVE_FLASH_FLAG_NOTAP     (1 << 2)/* just dump DDCB and exit */
+#define SLCMD_MOVE_FLASH_FLAG_POLL      (1 << 3)/* wait for RETC >= 0102   */
+#define SLCMD_MOVE_FLASH_FLAG_PARTITION (1 << 4)
+#define SLCMD_MOVE_FLASH_FLAG_ERASE     (1 << 5)
+enum genwqe_card_state {
+        GENWQE_CARD_UNUSED = 0,
+        GENWQE_CARD_USED = 1,
+        GENWQE_CARD_FATAL_ERROR = 2,
+        GENWQE_CARD_STATE_MAX,
+};
+/* common struct for chip image exchange */
+struct genwqe_bitstream {
+        __u64 data_addr;                /* pointer to image data */
+        __u32 size;                     /* size of image file */
+        __u32 crc;                      /* crc of this image */
+        __u64 target_addr;              /* starting address in Flash */
+        __u32 partition;                /* '0', '1', or 'v' */
+        __u32 uid;                      /* 1=host/x=dram */
+        __u64 slu_id;                   /* informational/sim: SluID */
+        __u64 app_id;                   /* informational/sim: AppID */
+        __u16 retc;                     /* returned from processing */
+        __u16 attn;                     /* attention code from processing */
+        __u32 progress;                 /* progress code from processing */
+};
+/* Issuing a specific DDCB command */
+#define DDCB_LENGTH                     256 /* for debug data */
+#define DDCB_ASIV_LENGTH                104 /* len of the DDCB ASIV array */
+#define DDCB_ASIV_LENGTH_ATS            96  /* ASIV in ATS architecture */
+#define DDCB_ASV_LENGTH                 64  /* len of the DDCB ASV array  */
+#define DDCB_FIXUPS                     12  /* maximum number of fixups */
+struct genwqe_debug_data {
+        char driver_version[64];
+        __u64 slu_unitcfg;
+        __u64 app_unitcfg;
+        __u8  ddcb_before[DDCB_LENGTH];
+        __u8  ddcb_prev[DDCB_LENGTH];
+        __u8  ddcb_finished[DDCB_LENGTH];
+};
+/*
+ * Address Translation Specification (ATS) definitions
+ *
+ * Each 4 bit within the ATS 64-bit word specify the required address
+ * translation at the defined offset.
+ *
+ * 63 LSB
+ *         6666.5555.5555.5544.4444.4443.3333.3333 ... 11
+ *         3210.9876.5432.1098.7654.3210.9876.5432 ... 1098.7654.3210
+ *
+ * offset: 0x00 0x08 0x10 0x18 0x20 0x28 0x30 0x38 ... 0x68 0x70 0x78
+ *         res  res  res  res  ASIV ...
+ * The first 4 entries in the ATS word are reserved. The following nibbles
+ * each describe at an 8 byte offset the format of the required data.
+ */
+#define ATS_TYPE_DATA                   0x0ull /* data  */
+#define ATS_TYPE_FLAT_RD                0x4ull /* flat buffer read only */
+#define ATS_TYPE_FLAT_RDWR              0x5ull /* flat buffer read/write */
+#define ATS_TYPE_SGL_RD                 0x6ull /* sgl read only */
+#define ATS_TYPE_SGL_RDWR               0x7ull /* sgl read/write */
+#define ATS_SET_FLAGS(_struct, _field, _flags)                          \
+        (((_flags) & 0xf) << (44 - (4 * (offsetof(_struct, _field) / 8))))
+#define ATS_GET_FLAGS(_ats, _byte_offs)                                 \
+        (((_ats)          >> (44 - (4 * ((_byte_offs) / 8)))) & 0xf)
+/**
+ * struct genwqe_ddcb_cmd - User parameter for generic DDCB commands
+ *
+ * On the way into the kernel the driver will read the whole data
+ * structure. On the way out the driver will not copy the ASIV data
+ * back to user-space.
+ */
+struct genwqe_ddcb_cmd {
+        /* START of data copied to/from driver */
+        __u64 next_addr;                /* chaining genwqe_ddcb_cmd */
+        __u64 flags;                    /* reserved */
+        __u8  acfunc;                   /* accelerators functional unit */
+        __u8  cmd;                      /* command to execute */
+        __u8  asiv_length;              /* used parameter length */
+        __u8  asv_length;               /* length of valid return values  */
+        __u16 cmdopts;                  /* command options */
+        __u16 retc;                     /* return code from processing    */
+        __u16 attn;                     /* attention code from processing */
+        __u16 vcrc;                     /* variant crc16 */
+        __u32 progress;                 /* progress code from processing  */
+        __u64 deque_ts;                 /* dequeue time stamp */
+        __u64 cmplt_ts;                 /* completion time stamp */
+        __u64 disp_ts;                  /* SW processing start */
+        /* move to end and avoid copy-back */
+        __u64 ddata_addr;               /* collect debug data */
+        /* command specific values */
+        __u8  asv[DDCB_ASV_LENGTH];
+        /* END of data copied from driver */
+        union {
+                struct {
+                        __u64 ats;
+                        __u8  asiv[DDCB_ASIV_LENGTH_ATS];
+                };
+                /* used for flash update to keep it backward compatible */
+                __u8 __asiv[DDCB_ASIV_LENGTH];
+        };
+        /* END of data copied to driver */
+};
+#define GENWQE_IOC_CODE     0xa5
+/* Access functions */
+#define GENWQE_READ_REG64   _IOR(GENWQE_IOC_CODE, 30, struct genwqe_reg_io)
+#define GENWQE_WRITE_REG64  _IOW(GENWQE_IOC_CODE, 31, struct genwqe_reg_io)
+#define GENWQE_READ_REG32   _IOR(GENWQE_IOC_CODE, 32, struct genwqe_reg_io)
+#define GENWQE_WRITE_REG32  _IOW(GENWQE_IOC_CODE, 33, struct genwqe_reg_io)
+#define GENWQE_READ_REG16   _IOR(GENWQE_IOC_CODE, 34, struct genwqe_reg_io)
+#define GENWQE_WRITE_REG16  _IOW(GENWQE_IOC_CODE, 35, struct genwqe_reg_io)
+#define GENWQE_GET_CARD_STATE _IOR(GENWQE_IOC_CODE, 36, enum genwqe_card_state)
+/**
+ * struct genwqe_mem - Memory pinning/unpinning information
+ * @addr:          virtual user space address
+ * @size:          size of the area pin/dma-map/unmap
+ * direction:      0: read/1: read and write
+ *
+ * Avoid pinning and unpinning of memory pages dynamically. Instead
+ * the idea is to pin the whole buffer space required for DDCB
+ * opertionas in advance. The driver will reuse this pinning and the
+ * memory associated with it to setup the sglists for the DDCB
+ * requests without the need to allocate and free memory or map and
+ * unmap to get the DMA addresses.
+ *
+ * The inverse operation needs to be called after the pinning is not
+ * needed anymore. The pinnings else the pinnings will get removed
+ * after the device is closed. Note that pinnings will required
+ * memory.
+ */
+struct genwqe_mem {
+        __u64 addr;
+        __u64 size;
+        __u64 direction;
+        __u64 flags;
+};
+#define GENWQE_PIN_MEM        _IOWR(GENWQE_IOC_CODE, 40, struct genwqe_mem)
+#define GENWQE_UNPIN_MEM      _IOWR(GENWQE_IOC_CODE, 41, struct genwqe_mem)
+/*
+ * Generic synchronous DDCB execution interface.
+ * Synchronously execute a DDCB.
+ *
+ * Return: 0 on success or negative error code.
+ *         -EINVAL: Invalid parameters (ASIV_LEN, ASV_LEN, illegal fixups
+ *                  no mappings found/could not create mappings
+ *         -EFAULT: illegal addresses in fixups, purging failed
+ *         -EBADMSG: enqueing failed, retc != DDCB_RETC_COMPLETE
+ */
+#define GENWQE_EXECUTE_DDCB                                     \
+        _IOWR(GENWQE_IOC_CODE, 50, struct genwqe_ddcb_cmd)
+#define GENWQE_EXECUTE_RAW_DDCB                                 \
+        _IOWR(GENWQE_IOC_CODE, 51, struct genwqe_ddcb_cmd)
+/* Service Layer functions (PF only) */
+#define GENWQE_SLU_UPDATE  _IOWR(GENWQE_IOC_CODE, 80, struct genwqe_bitstream)
+#define GENWQE_SLU_READ    _IOWR(GENWQE_IOC_CODE, 81, struct genwqe_bitstream)
+#endif  /* __GENWQE_CARD_H__ */
diff --git a/include/uapi/linux/input.h b/include/uapi/linux/input.h
index ecc88592ecbe..bd24470d24a2 100644
--- a/include/uapi/linux/input.h
+++ b/include/uapi/linux/input.h
@@ -464,7 +464,8 @@ struct input_keymap_entry {
 #define KEY_BRIGHTNESS_ZERO     244     /* brightness off, use ambient */
 #define KEY_DISPLAY_OFF         245     /* display device to off state */
-#define KEY_WIMAX               246
+#define KEY_WWAN                246     /* Wireless WAN (LTE, UMTS, GSM, etc.) */
+#define KEY_WIMAX               KEY_WWAN
 #define KEY_RFKILL              247     /* Key that controls all radios */
 #define KEY_MICMUTE             248     /* Mute / unmute the microphone */
diff --git a/include/uapi/linux/kexec.h b/include/uapi/linux/kexec.h
index 104838f65bc1..d6629d49a243 100644
--- a/include/uapi/linux/kexec.h
+++ b/include/uapi/linux/kexec.h
@@ -18,6 +18,7 @@
 */
 #define KEXEC_ARCH_DEFAULT ( 0 << 16)
 #define KEXEC_ARCH_386     ( 3 << 16)
+#define KEXEC_ARCH_68K     ( 4 << 16)
 #define KEXEC_ARCH_X86_64  (62 << 16)
 #define KEXEC_ARCH_PPC     (20 << 16)
 #define KEXEC_ARCH_PPC64   (21 << 16)
diff --git a/include/uapi/linux/perf_event.h b/include/uapi/linux/perf_event.h
index 959d454f76a1..e244ed412745 100644
--- a/include/uapi/linux/perf_event.h
+++ b/include/uapi/linux/perf_event.h
@@ -725,6 +725,7 @@ enum perf_callchain_context {
 #define PERF_FLAG_FD_NO_GROUP           (1U << 0)
 #define PERF_FLAG_FD_OUTPUT             (1U << 1)
 #define PERF_FLAG_PID_CGROUP            (1U << 2) /* pid=cgroup id, per-cpu mode only */
+#define PERF_FLAG_FD_CLOEXEC            (1U << 3) /* O_CLOEXEC */
 union perf_mem_data_src {
        __u64 val;
diff --git a/include/uapi/linux/sched.h b/include/uapi/linux/sched.h
index 5a0f945927ac..34f9d7387d13 100644
--- a/include/uapi/linux/sched.h
+++ b/include/uapi/linux/sched.h
@@ -39,8 +39,14 @@
 #define SCHED_BATCH             3
 /* SCHED_ISO: reserved but not implemented yet */
 #define SCHED_IDLE              5
+#define SCHED_DEADLINE          6
 /* Can be ORed in to make sure the process is reverted back to SCHED_NORMAL on fork */
 #define SCHED_RESET_ON_FORK     0x40000000
+/*
+ * For the sched_{set,get}attr() calls
+ */
+#define SCHED_FLAG_RESET_ON_FORK        0x01
 #endif /* _UAPI_LINUX_SCHED_H */
diff --git a/include/uapi/linux/zorro.h b/include/uapi/linux/zorro.h
new file mode 100644
index 000000000000..59d021b242ed
--- /dev/null
+++ b/include/uapi/linux/zorro.h
@@ -0,0 +1,113 @@
+/*
+ *  linux/zorro.h -- Amiga AutoConfig (Zorro) Bus Definitions
+ *
+ *  Copyright (C) 1995--2003 Geert Uytterhoeven
+ *
+ *  This file is subject to the terms and conditions of the GNU General Public
+ *  License.  See the file COPYING in the main directory of this archive
+ *  for more details.
+ */
+#ifndef _UAPI_LINUX_ZORRO_H
+#define _UAPI_LINUX_ZORRO_H
+#include <linux/types.h>
+    /*
+     *  Each Zorro board has a 32-bit ID of the form
+     *
+     *      mmmmmmmmmmmmmmmmppppppppeeeeeeee
+     *
+     *  with
+     *
+     *      mmmmmmmmmmmmmmmm    16-bit Manufacturer ID (assigned by CBM (sigh))
+     *      pppppppp            8-bit Product ID (assigned by manufacturer)
+     *      eeeeeeee            8-bit Extended Product ID (currently only used
+     *                          for some GVP boards)
+     */
+#define ZORRO_MANUF(id)         ((id) >> 16)
+#define ZORRO_PROD(id)          (((id) >> 8) & 0xff)
+#define ZORRO_EPC(id)           ((id) & 0xff)
+#define ZORRO_ID(manuf, prod, epc) \
+        ((ZORRO_MANUF_##manuf << 16) | ((prod) << 8) | (epc))
+typedef __u32 zorro_id;
+/* Include the ID list */
+#include <linux/zorro_ids.h>
+    /*
+     *  GVP identifies most of its products through the 'extended product code'
+     *  (epc). The epc has to be ANDed with the GVP_PRODMASK before the
+     *  identification.
+     */
+#define GVP_PRODMASK            (0xf8)
+#define GVP_SCSICLKMASK         (0x01)
+enum GVP_flags {
+        GVP_IO                  = 0x01,
+        GVP_ACCEL               = 0x02,
+        GVP_SCSI                = 0x04,
+        GVP_24BITDMA            = 0x08,
+        GVP_25BITDMA            = 0x10,
+        GVP_NOBANK              = 0x20,
+        GVP_14MHZ               = 0x40,
+};
+struct Node {
+        __be32 ln_Succ;         /* Pointer to next (successor) */
+        __be32 ln_Pred;         /* Pointer to previous (predecessor) */
+        __u8   ln_Type;
+        __s8   ln_Pri;          /* Priority, for sorting */
+        __be32 ln_Name;         /* ID string, null terminated */
+} __packed;
+struct ExpansionRom {
+        /* -First 16 bytes of the expansion ROM */
+        __u8   er_Type;         /* Board type, size and flags */
+        __u8   er_Product;      /* Product number, assigned by manufacturer */
+        __u8   er_Flags;                /* Flags */
+        __u8   er_Reserved03;   /* Must be zero ($ff inverted) */
+        __be16 er_Manufacturer; /* Unique ID, ASSIGNED BY COMMODORE-AMIGA! */
+        __be32 er_SerialNumber; /* Available for use by manufacturer */
+        __be16 er_InitDiagVec;  /* Offset to optional "DiagArea" structure */
+        __u8   er_Reserved0c;
+        __u8   er_Reserved0d;
+        __u8   er_Reserved0e;
+        __u8   er_Reserved0f;
+} __packed;
+/* er_Type board type bits */
+#define ERT_TYPEMASK    0xc0
+#define ERT_ZORROII     0xc0
+#define ERT_ZORROIII    0x80
+/* other bits defined in er_Type */
+#define ERTB_MEMLIST    5               /* Link RAM into free memory list */
+#define ERTF_MEMLIST    (1<<5)
+struct ConfigDev {
+        struct Node     cd_Node;
+        __u8            cd_Flags;       /* (read/write) */
+        __u8            cd_Pad;         /* reserved */
+        struct ExpansionRom cd_Rom;     /* copy of board's expansion ROM */
+        __be32          cd_BoardAddr;   /* where in memory the board was placed */
+        __be32          cd_BoardSize;   /* size of board in bytes */
+        __be16          cd_SlotAddr;    /* which slot number (PRIVATE) */
+        __be16          cd_SlotSize;    /* number of slots (PRIVATE) */
+        __be32          cd_Driver;      /* pointer to node of driver */
+        __be32          cd_NextCD;      /* linked list of drivers to config */
+        __be32          cd_Unused[4];   /* for whatever the driver wants */
+} __packed;
+#define ZORRO_NUM_AUTO          16
+#endif /* _UAPI_LINUX_ZORRO_H */
diff --git a/include/linux/zorro_ids.h b/include/uapi/linux/zorro_ids.h
index 74bc53bcfdcf..74bc53bcfdcf 100644
--- a/include/linux/zorro_ids.h
+++ b/include/uapi/linux/zorro_ids.h
diff --git a/include/xen/interface/callback.h b/include/xen/interface/callback.h
index 8c5fa0e20155..dc3193f4b581 100644
--- a/include/xen/interface/callback.h
+++ b/include/xen/interface/callback.h
@@ -36,7 +36,7 @@
 * @extra_args == Operation-specific extra arguments (NULL if none).
 */
-/* ia64, x86: Callback for event delivery. */
+/* x86: Callback for event delivery. */
 #define CALLBACKTYPE_event                 0
 /* x86: Failsafe callback when guest state cannot be restored by Xen. */
diff --git a/include/xen/interface/io/protocols.h b/include/xen/interface/io/protocols.h
index 056744b4b05e..545a14ba0bb3 100644
--- a/include/xen/interface/io/protocols.h
+++ b/include/xen/interface/io/protocols.h
@@ -3,7 +3,6 @@
 #define XEN_IO_PROTO_ABI_X86_32     "x86_32-abi"
 #define XEN_IO_PROTO_ABI_X86_64     "x86_64-abi"
-#define XEN_IO_PROTO_ABI_IA64       "ia64-abi"
 #define XEN_IO_PROTO_ABI_POWERPC64  "powerpc64-abi"
 #define XEN_IO_PROTO_ABI_ARM        "arm-abi"
@@ -11,8 +10,6 @@
 # define XEN_IO_PROTO_ABI_NATIVE XEN_IO_PROTO_ABI_X86_32
 #elif defined(__x86_64__)
 # define XEN_IO_PROTO_ABI_NATIVE XEN_IO_PROTO_ABI_X86_64
-#elif defined(__ia64__)
-# define XEN_IO_PROTO_ABI_NATIVE XEN_IO_PROTO_ABI_IA64
 #elif defined(__powerpc64__)
 # define XEN_IO_PROTO_ABI_NATIVE XEN_IO_PROTO_ABI_POWERPC64
 #elif defined(__arm__) || defined(__aarch64__)
diff --git a/init/Kconfig b/init/Kconfig
index 4e5d96ab2034..5236dc562a36 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -532,7 +532,7 @@ config CONTEXT_TRACKING_FORCE
          dynticks subsystem by forcing the context tracking on all
          CPUs in the system.
-          Say Y only if you're working on the developpement of an
+          Say Y only if you're working on the development of an
          architecture backend for the context tracking.
          Say N otherwise, this option brings an overhead that you
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 8b729c278b64..bc1dcabe9217 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -890,6 +890,16 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
                struct cgroup *cgrp = dentry->d_fsdata;
                BUG_ON(!(cgroup_is_dead(cgrp)));
+                /*
+                 * XXX: cgrp->id is only used to look up css's.  As cgroup
+                 * and css's lifetimes will be decoupled, it should be made
+                 * per-subsystem and moved to css->id so that lookups are
+                 * successful until the target css is released.
+                 */
+                idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
+                cgrp->id = -1;
                call_rcu(&cgrp->rcu_head, cgroup_free_rcu);
        } else {
                struct cfent *cfe = __d_cfe(dentry);
@@ -4268,6 +4278,7 @@ static void css_release(struct percpu_ref *ref)
        struct cgroup_subsys_state *css =
                container_of(ref, struct cgroup_subsys_state, refcnt);
+        rcu_assign_pointer(css->cgroup->subsys[css->ss->subsys_id], NULL);
        call_rcu(&css->rcu_head, css_free_rcu_fn);
 }
@@ -4426,14 +4437,6 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
        list_add_tail_rcu(&cgrp->sibling, &cgrp->parent->children);
        root->number_of_cgroups++;
-        /* each css holds a ref to the cgroup's dentry and the parent css */
-        for_each_root_subsys(root, ss) {
-                struct cgroup_subsys_state *css = css_ar[ss->subsys_id];
-                dget(dentry);
-                css_get(css->parent);
-        }
        /* hold a ref to the parent's dentry */
        dget(parent->dentry);
@@ -4445,6 +4448,13 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
                if (err)
                        goto err_destroy;
+                /* each css holds a ref to the cgroup's dentry and parent css */
+                dget(dentry);
+                css_get(css->parent);
+                /* mark it consumed for error path */
+                css_ar[ss->subsys_id] = NULL;
                if (ss->broken_hierarchy && !ss->warned_broken_hierarchy &&
                    parent->parent) {
                        pr_warning("cgroup: %s (%d) created nested cgroup for controller \"%s\" which has incomplete hierarchy support. Nested cgroups may change behavior in the future.\n",
@@ -4491,6 +4501,14 @@ err_free_cgrp:
        return err;
 err_destroy:
+        for_each_root_subsys(root, ss) {
+                struct cgroup_subsys_state *css = css_ar[ss->subsys_id];
+                if (css) {
+                        percpu_ref_cancel_init(&css->refcnt);
+                        ss->css_free(css);
+                }
+        }
        cgroup_destroy_locked(cgrp);
        mutex_unlock(&cgroup_mutex);
        mutex_unlock(&dentry->d_inode->i_mutex);
@@ -4652,8 +4670,12 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
         * will be invoked to perform the rest of destruction once the
         * percpu refs of all css's are confirmed to be killed.
         */
-        for_each_root_subsys(cgrp->root, ss)
+        for_each_root_subsys(cgrp->root, ss) {
-                kill_css(cgroup_css(cgrp, ss));
+                struct cgroup_subsys_state *css = cgroup_css(cgrp, ss);
+                if (css)
+                        kill_css(css);
+        }
        /*
         * Mark @cgrp dead.  This prevents further task migration and child
@@ -4722,14 +4744,6 @@ static void cgroup_destroy_css_killed(struct cgroup *cgrp)
        /* delete this cgroup from parent->children */
        list_del_rcu(&cgrp->sibling);
-        /*
-         * We should remove the cgroup object from idr before its grace
-         * period starts, so we won't be looking up a cgroup while the
-         * cgroup is being freed.
-         */
-        idr_remove(&cgrp->root->cgroup_idr, cgrp->id);
-        cgrp->id = -1;
        dput(d);
        set_bit(CGRP_RELEASABLE, &parent->flags);
diff --git a/kernel/context_tracking.c b/kernel/context_tracking.c
index e5f3917aa05b..6cb20d2e7ee0 100644
--- a/kernel/context_tracking.c
+++ b/kernel/context_tracking.c
@@ -53,10 +53,10 @@ void context_tracking_user_enter(void)
        /*
         * Repeat the user_enter() check here because some archs may be calling
         * this from asm and if no CPU needs context tracking, they shouldn't
-         * go further. Repeat the check here until they support the static key
+         * go further. Repeat the check here until they support the inline static
-         * check.
+         * key check.
         */
-        if (!static_key_false(&context_tracking_enabled))
+        if (!context_tracking_is_enabled())
                return;
        /*
@@ -160,7 +160,7 @@ void context_tracking_user_exit(void)
 {
        unsigned long flags;
-        if (!static_key_false(&context_tracking_enabled))
+        if (!context_tracking_is_enabled())
                return;
        if (in_interrupt())
diff --git a/kernel/cpu/idle.c b/kernel/cpu/idle.c
index 988573a9a387..277f494c2a9a 100644
--- a/kernel/cpu/idle.c
+++ b/kernel/cpu/idle.c
@@ -105,14 +105,17 @@ static void cpu_idle_loop(void)
                                __current_set_polling();
                        }
                        arch_cpu_idle_exit();
-                        /*
-                         * We need to test and propagate the TIF_NEED_RESCHED
-                         * bit here because we might not have send the
-                         * reschedule IPI to idle tasks.
-                         */
-                        if (tif_need_resched())
-                                set_preempt_need_resched();
                }
+                /*
+                 * Since we fell out of the loop above, we know
+                 * TIF_NEED_RESCHED must be set, propagate it into
+                 * PREEMPT_NEED_RESCHED.
+                 *
+                 * This is required because for polling idle loops we will
+                 * not have had an IPI to fold the state for us.
+                 */
+                preempt_set_need_resched();
                tick_nohz_idle_exit();
                schedule_preempt_disabled();
        }
diff --git a/kernel/events/core.c b/kernel/events/core.c
index f5744010a8d2..56003c6edfd3 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -119,7 +119,8 @@ static int cpu_function_call(int cpu, int (*func) (void *info), void *info)
 #define PERF_FLAG_ALL (PERF_FLAG_FD_NO_GROUP |\
                       PERF_FLAG_FD_OUTPUT  |\
-                       PERF_FLAG_PID_CGROUP)
+                       PERF_FLAG_PID_CGROUP |\
+                       PERF_FLAG_FD_CLOEXEC)
 /*
 * branch priv levels that need permission checks
@@ -3542,7 +3543,7 @@ static void perf_event_for_each(struct perf_event *event,
 static int perf_event_period(struct perf_event *event, u64 __user *arg)
 {
        struct perf_event_context *ctx = event->ctx;
-        int ret = 0;
+        int ret = 0, active;
        u64 value;
        if (!is_sampling_event(event))
@@ -3566,6 +3567,20 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg)
                event->attr.sample_period = value;
                event->hw.sample_period = value;
        }
+        active = (event->state == PERF_EVENT_STATE_ACTIVE);
+        if (active) {
+                perf_pmu_disable(ctx->pmu);
+                event->pmu->stop(event, PERF_EF_UPDATE);
+        }
+        local64_set(&event->hw.period_left, 0);
+        if (active) {
+                event->pmu->start(event, PERF_EF_RELOAD);
+                perf_pmu_enable(ctx->pmu);
+        }
 unlock:
        raw_spin_unlock_irq(&ctx->lock);
@@ -6670,6 +6685,9 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
        INIT_LIST_HEAD(&event->event_entry);
        INIT_LIST_HEAD(&event->sibling_list);
        INIT_LIST_HEAD(&event->rb_entry);
+        INIT_LIST_HEAD(&event->active_entry);
+        INIT_HLIST_NODE(&event->hlist_entry);
        init_waitqueue_head(&event->waitq);
        init_irq_work(&event->pending, perf_pending_event);
@@ -6980,6 +6998,7 @@ SYSCALL_DEFINE5(perf_event_open,
        int event_fd;
        int move_group = 0;
        int err;
+        int f_flags = O_RDWR;
        /* for future expandability... */
        if (flags & ~PERF_FLAG_ALL)
@@ -7008,7 +7027,10 @@ SYSCALL_DEFINE5(perf_event_open,
        if ((flags & PERF_FLAG_PID_CGROUP) && (pid == -1 || cpu == -1))
                return -EINVAL;
-        event_fd = get_unused_fd();
+        if (flags & PERF_FLAG_FD_CLOEXEC)
+                f_flags |= O_CLOEXEC;
+        event_fd = get_unused_fd_flags(f_flags);
        if (event_fd < 0)
                return event_fd;
@@ -7130,7 +7152,8 @@ SYSCALL_DEFINE5(perf_event_open,
                        goto err_context;
        }
-        event_file = anon_inode_getfile("[perf_event]", &perf_fops, event, O_RDWR);
+        event_file = anon_inode_getfile("[perf_event]", &perf_fops, event,
+                                        f_flags);
        if (IS_ERR(event_file)) {
                err = PTR_ERR(event_file);
                goto err_context;
diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index e8b168af135b..146a5792b1d2 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -61,19 +61,20 @@ again:
         *
         *   kernel                             user
         *
-         *   READ ->data_tail                   READ ->data_head
+         *   if (LOAD ->data_tail) {            LOAD ->data_head
-         *   smp_mb()   (A)                     smp_rmb()       (C)
+         *                      (A)             smp_rmb()       (C)
-         *   WRITE $data                        READ $data
+         *      STORE $data                     LOAD $data
-         *   smp_wmb()  (B)                     smp_mb()        (D)
+         *      smp_wmb()       (B)             smp_mb()        (D)
-         *   STORE ->data_head                  WRITE ->data_tail
+         *      STORE ->data_head               STORE ->data_tail
+         *   }
         *
         * Where A pairs with D, and B pairs with C.
         *
-         * I don't think A needs to be a full barrier because we won't in fact
+         * In our case (A) is a control dependency that separates the load of
-         * write data until we see the store from userspace. So we simply don't
+         * the ->data_tail and the stores of $data. In case ->data_tail
-         * issue the data WRITE until we observe it. Be conservative for now.
+         * indicates there is no room in the buffer to store $data we do not.
         *
-         * OTOH, D needs to be a full barrier since it separates the data READ
+         * D needs to be a full barrier since it separates the data READ
         * from the tail WRITE.
         *
         * For B a WMB is sufficient since it separates two WRITEs, and for C
@@ -81,7 +82,7 @@ again:
         *
         * See perf_output_begin().
         */
-        smp_wmb();
+        smp_wmb(); /* B, matches C */
        rb->user_page->data_head = head;
        /*
@@ -144,17 +145,26 @@ int perf_output_begin(struct perf_output_handle *handle,
                if (!rb->overwrite &&
                    unlikely(CIRC_SPACE(head, tail, perf_data_size(rb)) < size))
                        goto fail;
+                /*
+                 * The above forms a control dependency barrier separating the
+                 * @tail load above from the data stores below. Since the @tail
+                 * load is required to compute the branch to fail below.
+                 *
+                 * A, matches D; the full memory barrier userspace SHOULD issue
+                 * after reading the data and before storing the new tail
+                 * position.
+                 *
+                 * See perf_output_put_handle().
+                 */
                head += size;
        } while (local_cmpxchg(&rb->head, offset, head) != offset);
        /*
-         * Separate the userpage->tail read from the data stores below.
+         * We rely on the implied barrier() by local_cmpxchg() to ensure
-         * Matches the MB userspace SHOULD issue after reading the data
+         * none of the data stores below can be lifted up by the compiler.
-         * and before storing the new tail position.
-         *
-         * See perf_output_put_handle().
         */
-        smp_mb();
        if (unlikely(head - local_read(&rb->wakeup) > rb->watermark))
                local_add(rb->watermark, &rb->wakeup);
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 24b7d6ca871b..b886a5e7d4ff 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -73,6 +73,17 @@ struct uprobe {
        struct inode            *inode;         /* Also hold a ref to inode */
        loff_t                  offset;
        unsigned long           flags;
+        /*
+         * The generic code assumes that it has two members of unknown type
+         * owned by the arch-specific code:
+         *
+         *      insn -  copy_insn() saves the original instruction here for
+         *              arch_uprobe_analyze_insn().
+         *
+         *      ixol -  potentially modified instruction to execute out of
+         *              line, copied to xol_area by xol_get_insn_slot().
+         */
        struct arch_uprobe      arch;
 };
@@ -86,6 +97,29 @@ struct return_instance {
 };
 /*
+ * Execute out of line area: anonymous executable mapping installed
+ * by the probed task to execute the copy of the original instruction
+ * mangled by set_swbp().
+ *
+ * On a breakpoint hit, thread contests for a slot.  It frees the
+ * slot after singlestep. Currently a fixed number of slots are
+ * allocated.
+ */
+struct xol_area {
+        wait_queue_head_t       wq;             /* if all slots are busy */
+        atomic_t                slot_count;     /* number of in-use slots */
+        unsigned long           *bitmap;        /* 0 = free slot */
+        struct page             *page;
+        /*
+         * We keep the vma's vm_start rather than a pointer to the vma
+         * itself.  The probed process or a naughty kernel module could make
+         * the vma go away, and we must handle that reasonably gracefully.
+         */
+        unsigned long           vaddr;          /* Page(s) of instruction slots */
+};
+/*
 * valid_vma: Verify if the specified vma is an executable vma
 * Relax restrictions while unregistering: vm_flags might have
 * changed after breakpoint was inserted.
@@ -330,7 +364,7 @@ int __weak set_swbp(struct arch_uprobe *auprobe, struct mm_struct *mm, unsigned
 int __weak
 set_orig_insn(struct arch_uprobe *auprobe, struct mm_struct *mm, unsigned long vaddr)
 {
-        return uprobe_write_opcode(mm, vaddr, *(uprobe_opcode_t *)auprobe->insn);
+        return uprobe_write_opcode(mm, vaddr, *(uprobe_opcode_t *)&auprobe->insn);
 }
 static int match_uprobe(struct uprobe *l, struct uprobe *r)
@@ -529,8 +563,8 @@ static int copy_insn(struct uprobe *uprobe, struct file *filp)
 {
        struct address_space *mapping = uprobe->inode->i_mapping;
        loff_t offs = uprobe->offset;
-        void *insn = uprobe->arch.insn;
+        void *insn = &uprobe->arch.insn;
-        int size = MAX_UINSN_BYTES;
+        int size = sizeof(uprobe->arch.insn);
        int len, err = -EIO;
        /* Copy only available bytes, -EIO if nothing was read */
@@ -569,7 +603,7 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file,
                goto out;
        ret = -ENOTSUPP;
-        if (is_trap_insn((uprobe_opcode_t *)uprobe->arch.insn))
+        if (is_trap_insn((uprobe_opcode_t *)&uprobe->arch.insn))
                goto out;
        ret = arch_uprobe_analyze_insn(&uprobe->arch, mm, vaddr);
@@ -1264,7 +1298,7 @@ static unsigned long xol_get_insn_slot(struct uprobe *uprobe)
        /* Initialize the slot */
        copy_to_page(area->page, xol_vaddr,
-                        uprobe->arch.ixol, sizeof(uprobe->arch.ixol));
+                        &uprobe->arch.ixol, sizeof(uprobe->arch.ixol));
        /*
         * We probably need flush_icache_user_range() but it needs vma.
         * This should work on supported architectures too.
@@ -1403,12 +1437,10 @@ static void uprobe_warn(struct task_struct *t, const char *msg)
 static void dup_xol_work(struct callback_head *work)
 {
-        kfree(work);
        if (current->flags & PF_EXITING)
                return;
-        if (!__create_xol_area(current->utask->vaddr))
+        if (!__create_xol_area(current->utask->dup_xol_addr))
                uprobe_warn(current, "dup xol area");
 }
@@ -1419,7 +1451,6 @@ void uprobe_copy_process(struct task_struct *t, unsigned long flags)
 {
        struct uprobe_task *utask = current->utask;
        struct mm_struct *mm = current->mm;
-        struct callback_head *work;
        struct xol_area *area;
        t->utask = NULL;
@@ -1441,14 +1472,9 @@ void uprobe_copy_process(struct task_struct *t, unsigned long flags)
        if (mm == t->mm)
                return;
-        /* TODO: move it into the union in uprobe_task */
+        t->utask->dup_xol_addr = area->vaddr;
-        work = kmalloc(sizeof(*work), GFP_KERNEL);
+        init_task_work(&t->utask->dup_xol_work, dup_xol_work);
-        if (!work)
+        task_work_add(t, &t->utask->dup_xol_work, true);
-                return uprobe_warn(t, "dup xol area");
-        t->utask->vaddr = area->vaddr;
-        init_task_work(work, dup_xol_work);
-        task_work_add(t, work, true);
 }
 /*
diff --git a/kernel/fork.c b/kernel/fork.c
index 5721f0e3f2da..294189fc7ac8 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1087,8 +1087,10 @@ static void rt_mutex_init_task(struct task_struct *p)
 {
        raw_spin_lock_init(&p->pi_lock);
 #ifdef CONFIG_RT_MUTEXES
-        plist_head_init(&p->pi_waiters);
+        p->pi_waiters = RB_ROOT;
+        p->pi_waiters_leftmost = NULL;
        p->pi_blocked_on = NULL;
+        p->pi_top_task = NULL;
 #endif
 }
@@ -1172,7 +1174,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
         * do not allow it to share a thread group or signal handlers or
         * parent with the forking task.
         */
-        if (clone_flags & (CLONE_SIGHAND | CLONE_PARENT)) {
+        if (clone_flags & CLONE_SIGHAND) {
                if ((clone_flags & (CLONE_NEWUSER | CLONE_NEWPID)) ||
                    (task_active_pid_ns(current) !=
                                current->nsproxy->pid_ns_for_children))
@@ -1311,7 +1313,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 #endif
        /* Perform scheduler related setup. Assign this task to a CPU. */
-        sched_fork(clone_flags, p);
+        retval = sched_fork(clone_flags, p);
+        if (retval)
+                goto bad_fork_cleanup_policy;
        retval = perf_event_init_task(p);
        if (retval)
@@ -1403,13 +1407,11 @@ static struct task_struct *copy_process(unsigned long clone_flags,
                p->tgid = p->pid;
        }
-        p->pdeath_signal = 0;
-        p->exit_state = 0;
        p->nr_dirtied = 0;
        p->nr_dirtied_pause = 128 >> (PAGE_SHIFT - 10);
        p->dirty_paused_when = 0;
+        p->pdeath_signal = 0;
        INIT_LIST_HEAD(&p->thread_group);
        p->task_works = NULL;
diff --git a/kernel/freezer.c b/kernel/freezer.c
index b462fa197517..aa6a8aadb911 100644
--- a/kernel/freezer.c
+++ b/kernel/freezer.c
@@ -19,6 +19,12 @@ EXPORT_SYMBOL(system_freezing_cnt);
 bool pm_freezing;
 bool pm_nosig_freezing;
+/*
+ * Temporary export for the deadlock workaround in ata_scsi_hotplug().
+ * Remove once the hack becomes unnecessary.
+ */
+EXPORT_SYMBOL_GPL(pm_freezing);
 /* protects freezing and frozen transitions */
 static DEFINE_SPINLOCK(freezer_lock);
diff --git a/kernel/futex.c b/kernel/futex.c
index f6ff0191ecf7..44a1261cb9ff 100644
--- a/kernel/futex.c
+++ b/kernel/futex.c
@@ -63,14 +63,101 @@
 #include <linux/sched/rt.h>
 #include <linux/hugetlb.h>
 #include <linux/freezer.h>
+#include <linux/bootmem.h>
 #include <asm/futex.h>
 #include "locking/rtmutex_common.h"
-int __read_mostly futex_cmpxchg_enabled;
+/*
+ * Basic futex operation and ordering guarantees:
+ *
+ * The waiter reads the futex value in user space and calls
+ * futex_wait(). This function computes the hash bucket and acquires
+ * the hash bucket lock. After that it reads the futex user space value
+ * again and verifies that the data has not changed. If it has not changed
+ * it enqueues itself into the hash bucket, releases the hash bucket lock
+ * and schedules.
+ *
+ * The waker side modifies the user space value of the futex and calls
+ * futex_wake(). This function computes the hash bucket and acquires the
+ * hash bucket lock. Then it looks for waiters on that futex in the hash
+ * bucket and wakes them.
+ *
+ * In futex wake up scenarios where no tasks are blocked on a futex, taking
+ * the hb spinlock can be avoided and simply return. In order for this
+ * optimization to work, ordering guarantees must exist so that the waiter
+ * being added to the list is acknowledged when the list is concurrently being
+ * checked by the waker, avoiding scenarios like the following:
+ *
+ * CPU 0                               CPU 1
+ * val = *futex;
+ * sys_futex(WAIT, futex, val);
+ *   futex_wait(futex, val);
+ *   uval = *futex;
+ *                                     *futex = newval;
+ *                                     sys_futex(WAKE, futex);
+ *                                       futex_wake(futex);
+ *                                       if (queue_empty())
+ *                                         return;
+ *   if (uval == val)
+ *      lock(hash_bucket(futex));
+ *      queue();
+ *     unlock(hash_bucket(futex));
+ *     schedule();
+ *
+ * This would cause the waiter on CPU 0 to wait forever because it
+ * missed the transition of the user space value from val to newval
+ * and the waker did not find the waiter in the hash bucket queue.
+ *
+ * The correct serialization ensures that a waiter either observes
+ * the changed user space value before blocking or is woken by a
+ * concurrent waker:
+ *
+ * CPU 0                                 CPU 1
+ * val = *futex;
+ * sys_futex(WAIT, futex, val);
+ *   futex_wait(futex, val);
+ *
+ *   waiters++;
+ *   mb(); (A) <-- paired with -.
+ *                              |
+ *   lock(hash_bucket(futex));  |
+ *                              |
+ *   uval = *futex;             |
+ *                              |        *futex = newval;
+ *                              |        sys_futex(WAKE, futex);
+ *                              |          futex_wake(futex);
+ *                              |
+ *                              `------->  mb(); (B)
+ *   if (uval == val)
+ *     queue();
+ *     unlock(hash_bucket(futex));
+ *     schedule();                         if (waiters)
+ *                                           lock(hash_bucket(futex));
+ *                                           wake_waiters(futex);
+ *                                           unlock(hash_bucket(futex));
+ *
+ * Where (A) orders the waiters increment and the futex value read -- this
+ * is guaranteed by the head counter in the hb spinlock; and where (B)
+ * orders the write to futex and the waiters read -- this is done by the
+ * barriers in get_futex_key_refs(), through either ihold or atomic_inc,
+ * depending on the futex type.
+ *
+ * This yields the following case (where X:=waiters, Y:=futex):
+ *
+ *      X = Y = 0
+ *
+ *      w[X]=1          w[Y]=1
+ *      MB              MB
+ *      r[Y]=y          r[X]=x
+ *
+ * Which guarantees that x==0 && y==0 is impossible; which translates back into
+ * the guarantee that we cannot both miss the futex variable change and the
+ * enqueue.
+ */
-#define FUTEX_HASHBITS (CONFIG_BASE_SMALL ? 4 : 8)
+int __read_mostly futex_cmpxchg_enabled;
 /*
 * Futex flags used to encode options to functions and preserve them across
@@ -149,9 +236,41 @@ static const struct futex_q futex_q_init = {
 struct futex_hash_bucket {
        spinlock_t lock;
        struct plist_head chain;
-};
+} ____cacheline_aligned_in_smp;
-static struct futex_hash_bucket futex_queues[1<<FUTEX_HASHBITS];
+static unsigned long __read_mostly futex_hashsize;
+static struct futex_hash_bucket *futex_queues;
+static inline void futex_get_mm(union futex_key *key)
+{
+        atomic_inc(&key->private.mm->mm_count);
+        /*
+         * Ensure futex_get_mm() implies a full barrier such that
+         * get_futex_key() implies a full barrier. This is relied upon
+         * as full barrier (B), see the ordering comment above.
+         */
+        smp_mb__after_atomic_inc();
+}
+static inline bool hb_waiters_pending(struct futex_hash_bucket *hb)
+{
+#ifdef CONFIG_SMP
+        /*
+         * Tasks trying to enter the critical region are most likely
+         * potential waiters that will be added to the plist. Ensure
+         * that wakers won't miss to-be-slept tasks in the window between
+         * the wait call and the actual plist_add.
+         */
+        if (spin_is_locked(&hb->lock))
+                return true;
+        smp_rmb(); /* Make sure we check the lock state first */
+        return !plist_head_empty(&hb->chain);
+#else
+        return true;
+#endif
+}
 /*
 * We hash on the keys returned from get_futex_key (see below).
@@ -161,7 +280,7 @@ static struct futex_hash_bucket *hash_futex(union futex_key *key)
        u32 hash = jhash2((u32*)&key->both.word,
                          (sizeof(key->both.word)+sizeof(key->both.ptr))/4,
                          key->both.offset);
-        return &futex_queues[hash & ((1 << FUTEX_HASHBITS)-1)];
+        return &futex_queues[hash & (futex_hashsize - 1)];
 }
 /*
@@ -187,10 +306,10 @@ static void get_futex_key_refs(union futex_key *key)
        switch (key->both.offset & (FUT_OFF_INODE|FUT_OFF_MMSHARED)) {
        case FUT_OFF_INODE:
-                ihold(key->shared.inode);
+                ihold(key->shared.inode); /* implies MB (B) */
                break;
        case FUT_OFF_MMSHARED:
-                atomic_inc(&key->private.mm->mm_count);
+                futex_get_mm(key); /* implies MB (B) */
                break;
        }
 }
@@ -264,7 +383,7 @@ get_futex_key(u32 __user *uaddr, int fshared, union futex_key *key, int rw)
        if (!fshared) {
                key->private.mm = mm;
                key->private.address = address;
-                get_futex_key_refs(key);
+                get_futex_key_refs(key);  /* implies MB (B) */
                return 0;
        }
@@ -371,7 +490,7 @@ again:
                key->shared.pgoff = basepage_index(page);
        }
-        get_futex_key_refs(key);
+        get_futex_key_refs(key); /* implies MB (B) */
 out:
        unlock_page(page_head);
@@ -598,13 +717,10 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
 {
        struct futex_pi_state *pi_state = NULL;
        struct futex_q *this, *next;
-        struct plist_head *head;
        struct task_struct *p;
        pid_t pid = uval & FUTEX_TID_MASK;
-        head = &hb->chain;
+        plist_for_each_entry_safe(this, next, &hb->chain, list) {
-        plist_for_each_entry_safe(this, next, head, list) {
                if (match_futex(&this->key, key)) {
                        /*
                         * Another waiter already exists - bump up
@@ -986,7 +1102,6 @@ futex_wake(u32 __user *uaddr, unsigned int flags, int nr_wake, u32 bitset)
 {
        struct futex_hash_bucket *hb;
        struct futex_q *this, *next;
-        struct plist_head *head;
        union futex_key key = FUTEX_KEY_INIT;
        int ret;
@@ -998,10 +1113,14 @@ futex_wake(u32 __user *uaddr, unsigned int flags, int nr_wake, u32 bitset)
                goto out;
        hb = hash_futex(&key);
+        /* Make sure we really have tasks to wakeup */
+        if (!hb_waiters_pending(hb))
+                goto out_put_key;
        spin_lock(&hb->lock);
-        head = &hb->chain;
-        plist_for_each_entry_safe(this, next, head, list) {
+        plist_for_each_entry_safe(this, next, &hb->chain, list) {
                if (match_futex (&this->key, &key)) {
                        if (this->pi_state || this->rt_waiter) {
                                ret = -EINVAL;
@@ -1019,6 +1138,7 @@ futex_wake(u32 __user *uaddr, unsigned int flags, int nr_wake, u32 bitset)
        }
        spin_unlock(&hb->lock);
+out_put_key:
        put_futex_key(&key);
 out:
        return ret;
@@ -1034,7 +1154,6 @@ futex_wake_op(u32 __user *uaddr1, unsigned int flags, u32 __user *uaddr2,
 {
        union futex_key key1 = FUTEX_KEY_INIT, key2 = FUTEX_KEY_INIT;
        struct futex_hash_bucket *hb1, *hb2;
-        struct plist_head *head;
        struct futex_q *this, *next;
        int ret, op_ret;
@@ -1082,9 +1201,7 @@ retry_private:
                goto retry;
        }
-        head = &hb1->chain;
+        plist_for_each_entry_safe(this, next, &hb1->chain, list) {
-        plist_for_each_entry_safe(this, next, head, list) {
                if (match_futex (&this->key, &key1)) {
                        if (this->pi_state || this->rt_waiter) {
                                ret = -EINVAL;
@@ -1097,10 +1214,8 @@ retry_private:
        }
        if (op_ret > 0) {
-                head = &hb2->chain;
                op_ret = 0;
-                plist_for_each_entry_safe(this, next, head, list) {
+                plist_for_each_entry_safe(this, next, &hb2->chain, list) {
                        if (match_futex (&this->key, &key2)) {
                                if (this->pi_state || this->rt_waiter) {
                                        ret = -EINVAL;
@@ -1270,7 +1385,6 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
        int drop_count = 0, task_count = 0, ret;
        struct futex_pi_state *pi_state = NULL;
        struct futex_hash_bucket *hb1, *hb2;
-        struct plist_head *head1;
        struct futex_q *this, *next;
        u32 curval2;
@@ -1393,8 +1507,7 @@ retry_private:
                }
        }
-        head1 = &hb1->chain;
+        plist_for_each_entry_safe(this, next, &hb1->chain, list) {
-        plist_for_each_entry_safe(this, next, head1, list) {
                if (task_count - nr_wake >= nr_requeue)
                        break;
@@ -1489,12 +1602,12 @@ static inline struct futex_hash_bucket *queue_lock(struct futex_q *q)
        hb = hash_futex(&q->key);
        q->lock_ptr = &hb->lock;
-        spin_lock(&hb->lock);
+        spin_lock(&hb->lock); /* implies MB (A) */
        return hb;
 }
 static inline void
-queue_unlock(struct futex_q *q, struct futex_hash_bucket *hb)
+queue_unlock(struct futex_hash_bucket *hb)
        __releases(&hb->lock)
 {
        spin_unlock(&hb->lock);
@@ -1867,7 +1980,7 @@ retry_private:
        ret = get_futex_value_locked(&uval, uaddr);
        if (ret) {
-                queue_unlock(q, *hb);
+                queue_unlock(*hb);
                ret = get_user(uval, uaddr);
                if (ret)
@@ -1881,7 +1994,7 @@ retry_private:
        }
        if (uval != val) {
-                queue_unlock(q, *hb);
+                queue_unlock(*hb);
                ret = -EWOULDBLOCK;
        }
@@ -2029,7 +2142,7 @@ retry_private:
                         * Task is exiting and we just wait for the
                         * exit to complete.
                         */
-                        queue_unlock(&q, hb);
+                        queue_unlock(hb);
                        put_futex_key(&q.key);
                        cond_resched();
                        goto retry;
@@ -2081,7 +2194,7 @@ retry_private:
        goto out_put_key;
 out_unlock_put_key:
-        queue_unlock(&q, hb);
+        queue_unlock(hb);
 out_put_key:
        put_futex_key(&q.key);
@@ -2091,7 +2204,7 @@ out:
        return ret != -EINTR ? ret : -ERESTARTNOINTR;
 uaddr_faulted:
-        queue_unlock(&q, hb);
+        queue_unlock(hb);
        ret = fault_in_user_writeable(uaddr);
        if (ret)
@@ -2113,7 +2226,6 @@ static int futex_unlock_pi(u32 __user *uaddr, unsigned int flags)
 {
        struct futex_hash_bucket *hb;
        struct futex_q *this, *next;
-        struct plist_head *head;
        union futex_key key = FUTEX_KEY_INIT;
        u32 uval, vpid = task_pid_vnr(current);
        int ret;
@@ -2153,9 +2265,7 @@ retry:
         * Ok, other tasks may need to be woken up - check waiters
         * and do the wakeup if necessary:
         */
-        head = &hb->chain;
+        plist_for_each_entry_safe(this, next, &hb->chain, list) {
-        plist_for_each_entry_safe(this, next, head, list) {
                if (!match_futex (&this->key, &key))
                        continue;
                ret = wake_futex_pi(uaddr, uval, this);
@@ -2316,6 +2426,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
         * code while we sleep on uaddr.
         */
        debug_rt_mutex_init_waiter(&rt_waiter);
+        RB_CLEAR_NODE(&rt_waiter.pi_tree_entry);
+        RB_CLEAR_NODE(&rt_waiter.tree_entry);
        rt_waiter.task = NULL;
        ret = get_futex_key(uaddr2, flags & FLAGS_SHARED, &key2, VERIFY_WRITE);
@@ -2734,8 +2846,21 @@ SYSCALL_DEFINE6(futex, u32 __user *, uaddr, int, op, u32, val,
 static int __init futex_init(void)
 {
        u32 curval;
-        int i;
+        unsigned int futex_shift;
+        unsigned long i;
+#if CONFIG_BASE_SMALL
+        futex_hashsize = 16;
+#else
+        futex_hashsize = roundup_pow_of_two(256 * num_possible_cpus());
+#endif
+        futex_queues = alloc_large_system_hash("futex", sizeof(*futex_queues),
+                                               futex_hashsize, 0,
+                                               futex_hashsize < 256 ? HASH_SMALL : 0,
+                                               &futex_shift, NULL,
+                                               futex_hashsize, futex_hashsize);
+        futex_hashsize = 1UL << futex_shift;
        /*
         * This will fail and we want it. Some arch implementations do
         * runtime detection of the futex_atomic_cmpxchg_inatomic()
@@ -2749,7 +2874,7 @@ static int __init futex_init(void)
        if (cmpxchg_futex_value_locked(&curval, NULL, 0, 0) == -EFAULT)
                futex_cmpxchg_enabled = 1;
-        for (i = 0; i < ARRAY_SIZE(futex_queues); i++) {
+        for (i = 0; i < futex_hashsize; i++) {
                plist_head_init(&futex_queues[i].chain);
                spin_lock_init(&futex_queues[i].lock);
        }
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index 383319bae3f7..09094361dce5 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -46,6 +46,7 @@
 #include <linux/sched.h>
 #include <linux/sched/sysctl.h>
 #include <linux/sched/rt.h>
+#include <linux/sched/deadline.h>
 #include <linux/timer.h>
 #include <linux/freezer.h>
@@ -1610,7 +1611,7 @@ long hrtimer_nanosleep(struct timespec *rqtp, struct timespec __user *rmtp,
        unsigned long slack;
        slack = current->timer_slack_ns;
-        if (rt_task(current))
+        if (dl_task(current) || rt_task(current))
                slack = 0;
        hrtimer_init_on_stack(&t.timer, clockid, mode);
diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
index 576ba756a32d..eb8a54783fa0 100644
--- a/kernel/locking/lockdep.c
+++ b/kernel/locking/lockdep.c
@@ -590,6 +590,7 @@ static int very_verbose(struct lock_class *class)
 /*
 * Is this the address of a static object:
 */
+#ifdef __KERNEL__
 static int static_obj(void *obj)
 {
        unsigned long start = (unsigned long) &_stext,
@@ -616,6 +617,7 @@ static int static_obj(void *obj)
         */
        return is_module_address(addr) || is_module_percpu_address(addr);
 }
+#endif
 /*
 * To make lock name printouts unique, we calculate a unique
@@ -4115,6 +4117,7 @@ void debug_check_no_locks_held(void)
 }
 EXPORT_SYMBOL_GPL(debug_check_no_locks_held);
+#ifdef __KERNEL__
 void debug_show_all_locks(void)
 {
        struct task_struct *g, *p;
@@ -4172,6 +4175,7 @@ retry:
                read_unlock(&tasklist_lock);
 }
 EXPORT_SYMBOL_GPL(debug_show_all_locks);
+#endif
 /*
 * Careful: only use this function if you are sure that
diff --git a/kernel/locking/mutex-debug.c b/kernel/locking/mutex-debug.c
index 7e3443fe1f48..faf6f5b53e77 100644
--- a/kernel/locking/mutex-debug.c
+++ b/kernel/locking/mutex-debug.c
@@ -75,7 +75,12 @@ void debug_mutex_unlock(struct mutex *lock)
                return;
        DEBUG_LOCKS_WARN_ON(lock->magic != lock);
-        DEBUG_LOCKS_WARN_ON(lock->owner != current);
+        if (!lock->owner)
+                DEBUG_LOCKS_WARN_ON(!lock->owner);
+        else
+                DEBUG_LOCKS_WARN_ON(lock->owner != current);
        DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
        mutex_clear_owner(lock);
 }
diff --git a/kernel/locking/rtmutex-debug.c b/kernel/locking/rtmutex-debug.c
index 13b243a323fa..49b2ed3dced8 100644
--- a/kernel/locking/rtmutex-debug.c
+++ b/kernel/locking/rtmutex-debug.c
@@ -24,7 +24,7 @@
 #include <linux/kallsyms.h>
 #include <linux/syscalls.h>
 #include <linux/interrupt.h>
-#include <linux/plist.h>
+#include <linux/rbtree.h>
 #include <linux/fs.h>
 #include <linux/debug_locks.h>
@@ -57,7 +57,7 @@ static void printk_lock(struct rt_mutex *lock, int print_owner)
 void rt_mutex_debug_task_free(struct task_struct *task)
 {
-        DEBUG_LOCKS_WARN_ON(!plist_head_empty(&task->pi_waiters));
+        DEBUG_LOCKS_WARN_ON(!RB_EMPTY_ROOT(&task->pi_waiters));
        DEBUG_LOCKS_WARN_ON(task->pi_blocked_on);
 }
@@ -154,16 +154,12 @@ void debug_rt_mutex_proxy_unlock(struct rt_mutex *lock)
 void debug_rt_mutex_init_waiter(struct rt_mutex_waiter *waiter)
 {
        memset(waiter, 0x11, sizeof(*waiter));
-        plist_node_init(&waiter->list_entry, MAX_PRIO);
-        plist_node_init(&waiter->pi_list_entry, MAX_PRIO);
        waiter->deadlock_task_pid = NULL;
 }
 void debug_rt_mutex_free_waiter(struct rt_mutex_waiter *waiter)
 {
        put_pid(waiter->deadlock_task_pid);
-        DEBUG_LOCKS_WARN_ON(!plist_node_empty(&waiter->list_entry));
-        DEBUG_LOCKS_WARN_ON(!plist_node_empty(&waiter->pi_list_entry));
        memset(waiter, 0x22, sizeof(*waiter));
 }
diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
index 0dd6aec1cb6a..2e960a2bab81 100644
--- a/kernel/locking/rtmutex.c
+++ b/kernel/locking/rtmutex.c
@@ -14,6 +14,7 @@
 #include <linux/export.h>
 #include <linux/sched.h>
 #include <linux/sched/rt.h>
+#include <linux/sched/deadline.h>
 #include <linux/timer.h>
 #include "rtmutex_common.h"
@@ -91,10 +92,107 @@ static inline void mark_rt_mutex_waiters(struct rt_mutex *lock)
 }
 #endif
+static inline int
+rt_mutex_waiter_less(struct rt_mutex_waiter *left,
+                     struct rt_mutex_waiter *right)
+{
+        if (left->prio < right->prio)
+                return 1;
+        /*
+         * If both waiters have dl_prio(), we check the deadlines of the
+         * associated tasks.
+         * If left waiter has a dl_prio(), and we didn't return 1 above,
+         * then right waiter has a dl_prio() too.
+         */
+        if (dl_prio(left->prio))
+                return (left->task->dl.deadline < right->task->dl.deadline);
+        return 0;
+}
+static void
+rt_mutex_enqueue(struct rt_mutex *lock, struct rt_mutex_waiter *waiter)
+{
+        struct rb_node **link = &lock->waiters.rb_node;
+        struct rb_node *parent = NULL;
+        struct rt_mutex_waiter *entry;
+        int leftmost = 1;
+        while (*link) {
+                parent = *link;
+                entry = rb_entry(parent, struct rt_mutex_waiter, tree_entry);
+                if (rt_mutex_waiter_less(waiter, entry)) {
+                        link = &parent->rb_left;
+                } else {
+                        link = &parent->rb_right;
+                        leftmost = 0;
+                }
+        }
+        if (leftmost)
+                lock->waiters_leftmost = &waiter->tree_entry;
+        rb_link_node(&waiter->tree_entry, parent, link);
+        rb_insert_color(&waiter->tree_entry, &lock->waiters);
+}
+static void
+rt_mutex_dequeue(struct rt_mutex *lock, struct rt_mutex_waiter *waiter)
+{
+        if (RB_EMPTY_NODE(&waiter->tree_entry))
+                return;
+        if (lock->waiters_leftmost == &waiter->tree_entry)
+                lock->waiters_leftmost = rb_next(&waiter->tree_entry);
+        rb_erase(&waiter->tree_entry, &lock->waiters);
+        RB_CLEAR_NODE(&waiter->tree_entry);
+}
+static void
+rt_mutex_enqueue_pi(struct task_struct *task, struct rt_mutex_waiter *waiter)
+{
+        struct rb_node **link = &task->pi_waiters.rb_node;
+        struct rb_node *parent = NULL;
+        struct rt_mutex_waiter *entry;
+        int leftmost = 1;
+        while (*link) {
+                parent = *link;
+                entry = rb_entry(parent, struct rt_mutex_waiter, pi_tree_entry);
+                if (rt_mutex_waiter_less(waiter, entry)) {
+                        link = &parent->rb_left;
+                } else {
+                        link = &parent->rb_right;
+                        leftmost = 0;
+                }
+        }
+        if (leftmost)
+                task->pi_waiters_leftmost = &waiter->pi_tree_entry;
+        rb_link_node(&waiter->pi_tree_entry, parent, link);
+        rb_insert_color(&waiter->pi_tree_entry, &task->pi_waiters);
+}
+static void
+rt_mutex_dequeue_pi(struct task_struct *task, struct rt_mutex_waiter *waiter)
+{
+        if (RB_EMPTY_NODE(&waiter->pi_tree_entry))
+                return;
+        if (task->pi_waiters_leftmost == &waiter->pi_tree_entry)
+                task->pi_waiters_leftmost = rb_next(&waiter->pi_tree_entry);
+        rb_erase(&waiter->pi_tree_entry, &task->pi_waiters);
+        RB_CLEAR_NODE(&waiter->pi_tree_entry);
+}
 /*
- * Calculate task priority from the waiter list priority
+ * Calculate task priority from the waiter tree priority
 *
- * Return task->normal_prio when the waiter list is empty or when
+ * Return task->normal_prio when the waiter tree is empty or when
 * the waiter is not allowed to do priority boosting
 */
 int rt_mutex_getprio(struct task_struct *task)
@@ -102,10 +200,18 @@ int rt_mutex_getprio(struct task_struct *task)
        if (likely(!task_has_pi_waiters(task)))
                return task->normal_prio;
-        return min(task_top_pi_waiter(task)->pi_list_entry.prio,
+        return min(task_top_pi_waiter(task)->prio,
                   task->normal_prio);
 }
+struct task_struct *rt_mutex_get_top_task(struct task_struct *task)
+{
+        if (likely(!task_has_pi_waiters(task)))
+                return NULL;
+        return task_top_pi_waiter(task)->task;
+}
 /*
 * Adjust the priority of a task, after its pi_waiters got modified.
 *
@@ -115,7 +221,7 @@ static void __rt_mutex_adjust_prio(struct task_struct *task)
 {
        int prio = rt_mutex_getprio(task);
-        if (task->prio != prio)
+        if (task->prio != prio || dl_prio(prio))
                rt_mutex_setprio(task, prio);
 }
@@ -233,7 +339,7 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
         * When deadlock detection is off then we check, if further
         * priority adjustment is necessary.
         */
-        if (!detect_deadlock && waiter->list_entry.prio == task->prio)
+        if (!detect_deadlock && waiter->prio == task->prio)
                goto out_unlock_pi;
        lock = waiter->lock;
@@ -254,9 +360,9 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
        top_waiter = rt_mutex_top_waiter(lock);
        /* Requeue the waiter */
-        plist_del(&waiter->list_entry, &lock->wait_list);
+        rt_mutex_dequeue(lock, waiter);
-        waiter->list_entry.prio = task->prio;
+        waiter->prio = task->prio;
-        plist_add(&waiter->list_entry, &lock->wait_list);
+        rt_mutex_enqueue(lock, waiter);
        /* Release the task */
        raw_spin_unlock_irqrestore(&task->pi_lock, flags);
@@ -280,17 +386,15 @@ static int rt_mutex_adjust_prio_chain(struct task_struct *task,
        if (waiter == rt_mutex_top_waiter(lock)) {
                /* Boost the owner */
-                plist_del(&top_waiter->pi_list_entry, &task->pi_waiters);
+                rt_mutex_dequeue_pi(task, top_waiter);
-                waiter->pi_list_entry.prio = waiter->list_entry.prio;
+                rt_mutex_enqueue_pi(task, waiter);
-                plist_add(&waiter->pi_list_entry, &task->pi_waiters);
                __rt_mutex_adjust_prio(task);
        } else if (top_waiter == waiter) {
                /* Deboost the owner */
-                plist_del(&waiter->pi_list_entry, &task->pi_waiters);
+                rt_mutex_dequeue_pi(task, waiter);
                waiter = rt_mutex_top_waiter(lock);
-                waiter->pi_list_entry.prio = waiter->list_entry.prio;
+                rt_mutex_enqueue_pi(task, waiter);
-                plist_add(&waiter->pi_list_entry, &task->pi_waiters);
                __rt_mutex_adjust_prio(task);
        }
@@ -355,7 +459,7 @@ static int try_to_take_rt_mutex(struct rt_mutex *lock, struct task_struct *task,
         * 3) it is top waiter
         */
        if (rt_mutex_has_waiters(lock)) {
-                if (task->prio >= rt_mutex_top_waiter(lock)->list_entry.prio) {
+                if (task->prio >= rt_mutex_top_waiter(lock)->prio) {
                        if (!waiter || waiter != rt_mutex_top_waiter(lock))
                                return 0;
                }
@@ -369,7 +473,7 @@ static int try_to_take_rt_mutex(struct rt_mutex *lock, struct task_struct *task,
                /* remove the queued waiter. */
                if (waiter) {
-                        plist_del(&waiter->list_entry, &lock->wait_list);
+                        rt_mutex_dequeue(lock, waiter);
                        task->pi_blocked_on = NULL;
                }
@@ -379,8 +483,7 @@ static int try_to_take_rt_mutex(struct rt_mutex *lock, struct task_struct *task,
                 */
                if (rt_mutex_has_waiters(lock)) {
                        top = rt_mutex_top_waiter(lock);
-                        top->pi_list_entry.prio = top->list_entry.prio;
+                        rt_mutex_enqueue_pi(task, top);
-                        plist_add(&top->pi_list_entry, &task->pi_waiters);
                }
                raw_spin_unlock_irqrestore(&task->pi_lock, flags);
        }
@@ -416,13 +519,12 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
        __rt_mutex_adjust_prio(task);
        waiter->task = task;
        waiter->lock = lock;
-        plist_node_init(&waiter->list_entry, task->prio);
+        waiter->prio = task->prio;
-        plist_node_init(&waiter->pi_list_entry, task->prio);
        /* Get the top priority waiter on the lock */
        if (rt_mutex_has_waiters(lock))
                top_waiter = rt_mutex_top_waiter(lock);
-        plist_add(&waiter->list_entry, &lock->wait_list);
+        rt_mutex_enqueue(lock, waiter);
        task->pi_blocked_on = waiter;
@@ -433,8 +535,8 @@ static int task_blocks_on_rt_mutex(struct rt_mutex *lock,
        if (waiter == rt_mutex_top_waiter(lock)) {
                raw_spin_lock_irqsave(&owner->pi_lock, flags);
-                plist_del(&top_waiter->pi_list_entry, &owner->pi_waiters);
+                rt_mutex_dequeue_pi(owner, top_waiter);
-                plist_add(&waiter->pi_list_entry, &owner->pi_waiters);
+                rt_mutex_enqueue_pi(owner, waiter);
                __rt_mutex_adjust_prio(owner);
                if (owner->pi_blocked_on)
@@ -486,7 +588,7 @@ static void wakeup_next_waiter(struct rt_mutex *lock)
         * boosted mode and go back to normal after releasing
         * lock->wait_lock.
         */
-        plist_del(&waiter->pi_list_entry, &current->pi_waiters);
+        rt_mutex_dequeue_pi(current, waiter);
        rt_mutex_set_owner(lock, NULL);
@@ -510,7 +612,7 @@ static void remove_waiter(struct rt_mutex *lock,
        int chain_walk = 0;
        raw_spin_lock_irqsave(&current->pi_lock, flags);
-        plist_del(&waiter->list_entry, &lock->wait_list);
+        rt_mutex_dequeue(lock, waiter);
        current->pi_blocked_on = NULL;
        raw_spin_unlock_irqrestore(&current->pi_lock, flags);
@@ -521,13 +623,13 @@ static void remove_waiter(struct rt_mutex *lock,
                raw_spin_lock_irqsave(&owner->pi_lock, flags);
-                plist_del(&waiter->pi_list_entry, &owner->pi_waiters);
+                rt_mutex_dequeue_pi(owner, waiter);
                if (rt_mutex_has_waiters(lock)) {
                        struct rt_mutex_waiter *next;
                        next = rt_mutex_top_waiter(lock);
-                        plist_add(&next->pi_list_entry, &owner->pi_waiters);
+                        rt_mutex_enqueue_pi(owner, next);
                }
                __rt_mutex_adjust_prio(owner);
@@ -537,8 +639,6 @@ static void remove_waiter(struct rt_mutex *lock,
                raw_spin_unlock_irqrestore(&owner->pi_lock, flags);
        }
-        WARN_ON(!plist_node_empty(&waiter->pi_list_entry));
        if (!chain_walk)
                return;
@@ -565,7 +665,8 @@ void rt_mutex_adjust_pi(struct task_struct *task)
        raw_spin_lock_irqsave(&task->pi_lock, flags);
        waiter = task->pi_blocked_on;
-        if (!waiter || waiter->list_entry.prio == task->prio) {
+        if (!waiter || (waiter->prio == task->prio &&
+                        !dl_prio(task->prio))) {
                raw_spin_unlock_irqrestore(&task->pi_lock, flags);
                return;
        }
@@ -638,6 +739,8 @@ rt_mutex_slowlock(struct rt_mutex *lock, int state,
        int ret = 0;
        debug_rt_mutex_init_waiter(&waiter);
+        RB_CLEAR_NODE(&waiter.pi_tree_entry);
+        RB_CLEAR_NODE(&waiter.tree_entry);
        raw_spin_lock(&lock->wait_lock);
@@ -904,7 +1007,8 @@ void __rt_mutex_init(struct rt_mutex *lock, const char *name)
 {
        lock->owner = NULL;
        raw_spin_lock_init(&lock->wait_lock);
-        plist_head_init(&lock->wait_list);
+        lock->waiters = RB_ROOT;
+        lock->waiters_leftmost = NULL;
        debug_rt_mutex_init(lock, name);
 }
diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h
index 53a66c85261b..7431a9c86f35 100644
--- a/kernel/locking/rtmutex_common.h
+++ b/kernel/locking/rtmutex_common.h
@@ -40,13 +40,13 @@ extern void schedule_rt_mutex_test(struct rt_mutex *lock);
 * This is the control structure for tasks blocked on a rt_mutex,
 * which is allocated on the kernel stack on of the blocked task.
 *
- * @list_entry:         pi node to enqueue into the mutex waiters list
+ * @tree_entry:         pi node to enqueue into the mutex waiters tree
- * @pi_list_entry:      pi node to enqueue into the mutex owner waiters list
+ * @pi_tree_entry:      pi node to enqueue into the mutex owner waiters tree
 * @task:               task reference to the blocked task
 */
 struct rt_mutex_waiter {
-        struct plist_node       list_entry;
+        struct rb_node          tree_entry;
-        struct plist_node       pi_list_entry;
+        struct rb_node          pi_tree_entry;
        struct task_struct      *task;
        struct rt_mutex         *lock;
 #ifdef CONFIG_DEBUG_RT_MUTEXES
@@ -54,14 +54,15 @@ struct rt_mutex_waiter {
        struct pid              *deadlock_task_pid;
        struct rt_mutex         *deadlock_lock;
 #endif
+        int prio;
 };
 /*
- * Various helpers to access the waiters-plist:
+ * Various helpers to access the waiters-tree:
 */
 static inline int rt_mutex_has_waiters(struct rt_mutex *lock)
 {
-        return !plist_head_empty(&lock->wait_list);
+        return !RB_EMPTY_ROOT(&lock->waiters);
 }
 static inline struct rt_mutex_waiter *
@@ -69,8 +70,8 @@ rt_mutex_top_waiter(struct rt_mutex *lock)
 {
        struct rt_mutex_waiter *w;
-        w = plist_first_entry(&lock->wait_list, struct rt_mutex_waiter,
+        w = rb_entry(lock->waiters_leftmost, struct rt_mutex_waiter,
-                               list_entry);
+                     tree_entry);
        BUG_ON(w->lock != lock);
        return w;
@@ -78,14 +79,14 @@ rt_mutex_top_waiter(struct rt_mutex *lock)
 static inline int task_has_pi_waiters(struct task_struct *p)
 {
-        return !plist_head_empty(&p->pi_waiters);
+        return !RB_EMPTY_ROOT(&p->pi_waiters);
 }
 static inline struct rt_mutex_waiter *
 task_top_pi_waiter(struct task_struct *p)
 {
-        return plist_first_entry(&p->pi_waiters, struct rt_mutex_waiter,
+        return rb_entry(p->pi_waiters_leftmost, struct rt_mutex_waiter,
-                                  pi_list_entry);
+                        pi_tree_entry);
 }
 /*
diff --git a/kernel/panic.c b/kernel/panic.c
index c00b4ceb39e8..6d6300375090 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -33,7 +33,7 @@ static int pause_on_oops;
 static int pause_on_oops_flag;
 static DEFINE_SPINLOCK(pause_on_oops_lock);
-int panic_timeout;
+int panic_timeout = CONFIG_PANIC_TIMEOUT;
 EXPORT_SYMBOL_GPL(panic_timeout);
 ATOMIC_NOTIFIER_HEAD(panic_notifier_list);
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index c7f31aa272f7..3b8946416a5f 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -233,7 +233,8 @@ void thread_group_cputimer(struct task_struct *tsk, struct task_cputime *times)
 /*
 * Sample a process (thread group) clock for the given group_leader task.
- * Must be called with tasklist_lock held for reading.
+ * Must be called with task sighand lock held for safe while_each_thread()
+ * traversal.
 */
 static int cpu_clock_sample_group(const clockid_t which_clock,
                                  struct task_struct *p,
@@ -260,30 +261,53 @@ static int cpu_clock_sample_group(const clockid_t which_clock,
        return 0;
 }
+static int posix_cpu_clock_get_task(struct task_struct *tsk,
+                                    const clockid_t which_clock,
+                                    struct timespec *tp)
+{
+        int err = -EINVAL;
+        unsigned long long rtn;
+        if (CPUCLOCK_PERTHREAD(which_clock)) {
+                if (same_thread_group(tsk, current))
+                        err = cpu_clock_sample(which_clock, tsk, &rtn);
+        } else {
+                unsigned long flags;
+                struct sighand_struct *sighand;
+                /*
+                 * while_each_thread() is not yet entirely RCU safe,
+                 * keep locking the group while sampling process
+                 * clock for now.
+                 */
+                sighand = lock_task_sighand(tsk, &flags);
+                if (!sighand)
+                        return err;
+                if (tsk == current || thread_group_leader(tsk))
+                        err = cpu_clock_sample_group(which_clock, tsk, &rtn);
+                unlock_task_sighand(tsk, &flags);
+        }
+        if (!err)
+                sample_to_timespec(which_clock, rtn, tp);
+        return err;
+}
 static int posix_cpu_clock_get(const clockid_t which_clock, struct timespec *tp)
 {
        const pid_t pid = CPUCLOCK_PID(which_clock);
-        int error = -EINVAL;
+        int err = -EINVAL;
-        unsigned long long rtn;
        if (pid == 0) {
                /*
                 * Special case constant value for our own clocks.
                 * We don't have to do any lookup to find ourselves.
                 */
-                if (CPUCLOCK_PERTHREAD(which_clock)) {
+                err = posix_cpu_clock_get_task(current, which_clock, tp);
-                        /*
-                         * Sampling just ourselves we can do with no locking.
-                         */
-                        error = cpu_clock_sample(which_clock,
-                                                 current, &rtn);
-                } else {
-                        read_lock(&tasklist_lock);
-                        error = cpu_clock_sample_group(which_clock,
-                                                       current, &rtn);
-                        read_unlock(&tasklist_lock);
-                }
        } else {
                /*
                 * Find the given PID, and validate that the caller
@@ -292,29 +316,12 @@ static int posix_cpu_clock_get(const clockid_t which_clock, struct timespec *tp)
                struct task_struct *p;
                rcu_read_lock();
                p = find_task_by_vpid(pid);
-                if (p) {
+                if (p)
-                        if (CPUCLOCK_PERTHREAD(which_clock)) {
+                        err = posix_cpu_clock_get_task(p, which_clock, tp);
-                                if (same_thread_group(p, current)) {
-                                        error = cpu_clock_sample(which_clock,
-                                                                 p, &rtn);
-                                }
-                        } else {
-                                read_lock(&tasklist_lock);
-                                if (thread_group_leader(p) && p->sighand) {
-                                        error =
-                                            cpu_clock_sample_group(which_clock,
-                                                                   p, &rtn);
-                                }
-                                read_unlock(&tasklist_lock);
-                        }
-                }
                rcu_read_unlock();
        }
-        if (error)
+        return err;
-                return error;
-        sample_to_timespec(which_clock, rtn, tp);
-        return 0;
 }
@@ -371,36 +378,40 @@ static int posix_cpu_timer_create(struct k_itimer *new_timer)
 */
 static int posix_cpu_timer_del(struct k_itimer *timer)
 {
-        struct task_struct *p = timer->it.cpu.task;
        int ret = 0;
+        unsigned long flags;
+        struct sighand_struct *sighand;
+        struct task_struct *p = timer->it.cpu.task;
-        if (likely(p != NULL)) {
+        WARN_ON_ONCE(p == NULL);
-                read_lock(&tasklist_lock);
-                if (unlikely(p->sighand == NULL)) {
-                        /*
-                         * We raced with the reaping of the task.
-                         * The deletion should have cleared us off the list.
-                         */
-                        BUG_ON(!list_empty(&timer->it.cpu.entry));
-                } else {
-                        spin_lock(&p->sighand->siglock);
-                        if (timer->it.cpu.firing)
-                                ret = TIMER_RETRY;
-                        else
-                                list_del(&timer->it.cpu.entry);
-                        spin_unlock(&p->sighand->siglock);
-                }
-                read_unlock(&tasklist_lock);
-                if (!ret)
+        /*
-                        put_task_struct(p);
+         * Protect against sighand release/switch in exit/exec and process/
+         * thread timer list entry concurrent read/writes.
+         */
+        sighand = lock_task_sighand(p, &flags);
+        if (unlikely(sighand == NULL)) {
+                /*
+                 * We raced with the reaping of the task.
+                 * The deletion should have cleared us off the list.
+                 */
+                WARN_ON_ONCE(!list_empty(&timer->it.cpu.entry));
+        } else {
+                if (timer->it.cpu.firing)
+                        ret = TIMER_RETRY;
+                else
+                        list_del(&timer->it.cpu.entry);
+                unlock_task_sighand(p, &flags);
        }
+        if (!ret)
+                put_task_struct(p);
        return ret;
 }
-static void cleanup_timers_list(struct list_head *head,
+static void cleanup_timers_list(struct list_head *head)
-                                unsigned long long curr)
 {
        struct cpu_timer_list *timer, *next;
@@ -414,16 +425,11 @@ static void cleanup_timers_list(struct list_head *head,
 * time for later timer_gettime calls to return.
 * This must be called with the siglock held.
 */
-static void cleanup_timers(struct list_head *head,
+static void cleanup_timers(struct list_head *head)
-                           cputime_t utime, cputime_t stime,
-                           unsigned long long sum_exec_runtime)
 {
+        cleanup_timers_list(head);
-        cputime_t ptime = utime + stime;
+        cleanup_timers_list(++head);
+        cleanup_timers_list(++head);
-        cleanup_timers_list(head, cputime_to_expires(ptime));
-        cleanup_timers_list(++head, cputime_to_expires(utime));
-        cleanup_timers_list(++head, sum_exec_runtime);
 }
 /*
@@ -433,41 +439,14 @@ static void cleanup_timers(struct list_head *head,
 */
 void posix_cpu_timers_exit(struct task_struct *tsk)
 {
-        cputime_t utime, stime;
        add_device_randomness((const void*) &tsk->se.sum_exec_runtime,
                                                sizeof(unsigned long long));
-        task_cputime(tsk, &utime, &stime);
+        cleanup_timers(tsk->cpu_timers);
-        cleanup_timers(tsk->cpu_timers,
-                       utime, stime, tsk->se.sum_exec_runtime);
 }
 void posix_cpu_timers_exit_group(struct task_struct *tsk)
 {
-        struct signal_struct *const sig = tsk->signal;
+        cleanup_timers(tsk->signal->cpu_timers);
-        cputime_t utime, stime;
-        task_cputime(tsk, &utime, &stime);
-        cleanup_timers(tsk->signal->cpu_timers,
-                       utime + sig->utime, stime + sig->stime,
-                       tsk->se.sum_exec_runtime + sig->sum_sched_runtime);
-}
-static void clear_dead_task(struct k_itimer *itimer, unsigned long long now)
-{
-        struct cpu_timer_list *timer = &itimer->it.cpu;
-        /*
-         * That's all for this thread or process.
-         * We leave our residual in expires to be reported.
-         */
-        put_task_struct(timer->task);
-        timer->task = NULL;
-        if (timer->expires < now) {
-                timer->expires = 0;
-        } else {
-                timer->expires -= now;
-        }
 }
 static inline int expires_gt(cputime_t expires, cputime_t new_exp)
@@ -477,8 +456,7 @@ static inline int expires_gt(cputime_t expires, cputime_t new_exp)
 /*
 * Insert the timer on the appropriate list before any timers that
- * expire later.  This must be called with the tasklist_lock held
+ * expire later.  This must be called with the sighand lock held.
- * for reading, interrupts disabled and p->sighand->siglock taken.
 */
 static void arm_timer(struct k_itimer *timer)
 {
@@ -569,7 +547,8 @@ static void cpu_timer_fire(struct k_itimer *timer)
 /*
 * Sample a process (thread group) timer for the given group_leader task.
- * Must be called with tasklist_lock held for reading.
+ * Must be called with task sighand lock held for safe while_each_thread()
+ * traversal.
 */
 static int cpu_timer_sample_group(const clockid_t which_clock,
                                  struct task_struct *p,
@@ -608,7 +587,8 @@ static DECLARE_WORK(nohz_kick_work, nohz_kick_work_fn);
 */
 static void posix_cpu_timer_kick_nohz(void)
 {
-        schedule_work(&nohz_kick_work);
+        if (context_tracking_is_enabled())
+                schedule_work(&nohz_kick_work);
 }
 bool posix_cpu_timers_can_stop_tick(struct task_struct *tsk)
@@ -631,43 +611,39 @@ static inline void posix_cpu_timer_kick_nohz(void) { }
 * If we return TIMER_RETRY, it's necessary to release the timer's lock
 * and try again.  (This happens when the timer is in the middle of firing.)
 */
-static int posix_cpu_timer_set(struct k_itimer *timer, int flags,
+static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags,
                               struct itimerspec *new, struct itimerspec *old)
 {
+        unsigned long flags;
+        struct sighand_struct *sighand;
        struct task_struct *p = timer->it.cpu.task;
        unsigned long long old_expires, new_expires, old_incr, val;
        int ret;
-        if (unlikely(p == NULL)) {
+        WARN_ON_ONCE(p == NULL);
-                /*
-                 * Timer refers to a dead task's clock.
-                 */
-                return -ESRCH;
-        }
        new_expires = timespec_to_sample(timer->it_clock, &new->it_value);
-        read_lock(&tasklist_lock);
        /*
-         * We need the tasklist_lock to protect against reaping that
+         * Protect against sighand release/switch in exit/exec and p->cpu_timers
-         * clears p->sighand.  If p has just been reaped, we can no
+         * and p->signal->cpu_timers read/write in arm_timer()
+         */
+        sighand = lock_task_sighand(p, &flags);
+        /*
+         * If p has just been reaped, we can no
         * longer get any information about it at all.
         */
-        if (unlikely(p->sighand == NULL)) {
+        if (unlikely(sighand == NULL)) {
-                read_unlock(&tasklist_lock);
-                put_task_struct(p);
-                timer->it.cpu.task = NULL;
                return -ESRCH;
        }
        /*
         * Disarm any old timer after extracting its expiry time.
         */
-        BUG_ON(!irqs_disabled());
+        WARN_ON_ONCE(!irqs_disabled());
        ret = 0;
        old_incr = timer->it.cpu.incr;
-        spin_lock(&p->sighand->siglock);
        old_expires = timer->it.cpu.expires;
        if (unlikely(timer->it.cpu.firing)) {
                timer->it.cpu.firing = -1;
@@ -724,12 +700,11 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int flags,
                 * disable this firing since we are already reporting
                 * it as an overrun (thanks to bump_cpu_timer above).
                 */
-                spin_unlock(&p->sighand->siglock);
+                unlock_task_sighand(p, &flags);
-                read_unlock(&tasklist_lock);
                goto out;
        }
-        if (new_expires != 0 && !(flags & TIMER_ABSTIME)) {
+        if (new_expires != 0 && !(timer_flags & TIMER_ABSTIME)) {
                new_expires += val;
        }
@@ -743,9 +718,7 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int flags,
                arm_timer(timer);
        }
-        spin_unlock(&p->sighand->siglock);
+        unlock_task_sighand(p, &flags);
-        read_unlock(&tasklist_lock);
        /*
         * Install the new reload setting, and
         * set up the signal and overrun bookkeeping.
@@ -787,7 +760,8 @@ static void posix_cpu_timer_get(struct k_itimer *timer, struct itimerspec *itp)
 {
        unsigned long long now;
        struct task_struct *p = timer->it.cpu.task;
-        int clear_dead;
+        WARN_ON_ONCE(p == NULL);
        /*
         * Easy part: convert the reload time.
@@ -800,52 +774,34 @@ static void posix_cpu_timer_get(struct k_itimer *timer, struct itimerspec *itp)
                return;
        }
-        if (unlikely(p == NULL)) {
-                /*
-                 * This task already died and the timer will never fire.
-                 * In this case, expires is actually the dead value.
-                 */
-        dead:
-                sample_to_timespec(timer->it_clock, timer->it.cpu.expires,
-                                   &itp->it_value);
-                return;
-        }
        /*
         * Sample the clock to take the difference with the expiry time.
         */
        if (CPUCLOCK_PERTHREAD(timer->it_clock)) {
                cpu_clock_sample(timer->it_clock, p, &now);
-                clear_dead = p->exit_state;
        } else {
-                read_lock(&tasklist_lock);
+                struct sighand_struct *sighand;
-                if (unlikely(p->sighand == NULL)) {
+                unsigned long flags;
+                /*
+                 * Protect against sighand release/switch in exit/exec and
+                 * also make timer sampling safe if it ends up calling
+                 * thread_group_cputime().
+                 */
+                sighand = lock_task_sighand(p, &flags);
+                if (unlikely(sighand == NULL)) {
                        /*
                         * The process has been reaped.
                         * We can't even collect a sample any more.
                         * Call the timer disarmed, nothing else to do.
                         */
-                        put_task_struct(p);
-                        timer->it.cpu.task = NULL;
                        timer->it.cpu.expires = 0;
-                        read_unlock(&tasklist_lock);
+                        sample_to_timespec(timer->it_clock, timer->it.cpu.expires,
-                        goto dead;
+                                           &itp->it_value);
                } else {
                        cpu_timer_sample_group(timer->it_clock, p, &now);
-                        clear_dead = (unlikely(p->exit_state) &&
+                        unlock_task_sighand(p, &flags);
-                                      thread_group_empty(p));
                }
-                read_unlock(&tasklist_lock);
-        }
-        if (unlikely(clear_dead)) {
-                /*
-                 * We've noticed that the thread is dead, but
-                 * not yet reaped.  Take this opportunity to
-                 * drop our task ref.
-                 */
-                clear_dead_task(timer, now);
-                goto dead;
        }
        if (now < timer->it.cpu.expires) {
@@ -1059,14 +1015,12 @@ static void check_process_timers(struct task_struct *tsk,
 */
 void posix_cpu_timer_schedule(struct k_itimer *timer)
 {
+        struct sighand_struct *sighand;
+        unsigned long flags;
        struct task_struct *p = timer->it.cpu.task;
        unsigned long long now;
-        if (unlikely(p == NULL))
+        WARN_ON_ONCE(p == NULL);
-                /*
-                 * The task was cleaned up already, no future firings.
-                 */
-                goto out;
        /*
         * Fetch the current sample and update the timer's expiry time.
@@ -1074,49 +1028,45 @@ void posix_cpu_timer_schedule(struct k_itimer *timer)
        if (CPUCLOCK_PERTHREAD(timer->it_clock)) {
                cpu_clock_sample(timer->it_clock, p, &now);
                bump_cpu_timer(timer, now);
-                if (unlikely(p->exit_state)) {
+                if (unlikely(p->exit_state))
-                        clear_dead_task(timer, now);
+                        goto out;
+                /* Protect timer list r/w in arm_timer() */
+                sighand = lock_task_sighand(p, &flags);
+                if (!sighand)
                        goto out;
-                }
-                read_lock(&tasklist_lock); /* arm_timer needs it.  */
-                spin_lock(&p->sighand->siglock);
        } else {
-                read_lock(&tasklist_lock);
+                /*
-                if (unlikely(p->sighand == NULL)) {
+                 * Protect arm_timer() and timer sampling in case of call to
+                 * thread_group_cputime().
+                 */
+                sighand = lock_task_sighand(p, &flags);
+                if (unlikely(sighand == NULL)) {
                        /*
                         * The process has been reaped.
                         * We can't even collect a sample any more.
                         */
-                        put_task_struct(p);
-                        timer->it.cpu.task = p = NULL;
                        timer->it.cpu.expires = 0;
-                        goto out_unlock;
+                        goto out;
                } else if (unlikely(p->exit_state) && thread_group_empty(p)) {
-                        /*
+                        unlock_task_sighand(p, &flags);
-                         * We've noticed that the thread is dead, but
+                        /* Optimizations: if the process is dying, no need to rearm */
-                         * not yet reaped.  Take this opportunity to
+                        goto out;
-                         * drop our task ref.
-                         */
-                        cpu_timer_sample_group(timer->it_clock, p, &now);
-                        clear_dead_task(timer, now);
-                        goto out_unlock;
                }
-                spin_lock(&p->sighand->siglock);
                cpu_timer_sample_group(timer->it_clock, p, &now);
                bump_cpu_timer(timer, now);
-                /* Leave the tasklist_lock locked for the call below.  */
+                /* Leave the sighand locked for the call below.  */
        }
        /*
         * Now re-arm for the new expiry time.
         */
-        BUG_ON(!irqs_disabled());
+        WARN_ON_ONCE(!irqs_disabled());
        arm_timer(timer);
-        spin_unlock(&p->sighand->siglock);
+        unlock_task_sighand(p, &flags);
-out_unlock:
-        read_unlock(&tasklist_lock);
+        /* Kick full dynticks CPUs in case they need to tick on the new timer */
+        posix_cpu_timer_kick_nohz();
 out:
        timer->it_overrun_last = timer->it_overrun;
        timer->it_overrun = -1;
@@ -1200,7 +1150,7 @@ void run_posix_cpu_timers(struct task_struct *tsk)
        struct k_itimer *timer, *next;
        unsigned long flags;
-        BUG_ON(!irqs_disabled());
+        WARN_ON_ONCE(!irqs_disabled());
        /*
         * The fast path checks that there are no expired thread or thread
@@ -1256,13 +1206,6 @@ void run_posix_cpu_timers(struct task_struct *tsk)
                        cpu_timer_fire(timer);
                spin_unlock(&timer->it_lock);
        }
-        /*
-         * In case some timers were rescheduled after the queue got emptied,
-         * wake up full dynticks CPUs.
-         */
-        if (tsk->signal->cputimer.running)
-                posix_cpu_timer_kick_nohz();
 }
 /*
@@ -1274,7 +1217,7 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clock_idx,
 {
        unsigned long long now;
-        BUG_ON(clock_idx == CPUCLOCK_SCHED);
+        WARN_ON_ONCE(clock_idx == CPUCLOCK_SCHED);
        cpu_timer_sample_group(clock_idx, tsk, &now);
        if (oldval) {
diff --git a/kernel/power/console.c b/kernel/power/console.c
index 463aa6736751..eacb8bd8cab4 100644
--- a/kernel/power/console.c
+++ b/kernel/power/console.c
@@ -81,6 +81,7 @@ void pm_vt_switch_unregister(struct device *dev)
        list_for_each_entry(tmp, &pm_vt_switch_list, head) {
                if (tmp->dev == dev) {
                        list_del(&tmp->head);
+                        kfree(tmp);
                        break;
                }
        }
diff --git a/kernel/rcu/rcu.h b/kernel/rcu/rcu.h
index 7859a0a3951e..79c3877e9c5b 100644
--- a/kernel/rcu/rcu.h
+++ b/kernel/rcu/rcu.h
@@ -96,19 +96,22 @@ static inline void debug_rcu_head_unqueue(struct rcu_head *head)
 }
 #endif  /* #else !CONFIG_DEBUG_OBJECTS_RCU_HEAD */
-extern void kfree(const void *);
+void kfree(const void *);
 static inline bool __rcu_reclaim(const char *rn, struct rcu_head *head)
 {
        unsigned long offset = (unsigned long)head->func;
+        rcu_lock_acquire(&rcu_callback_map);
        if (__is_kfree_rcu_offset(offset)) {
                RCU_TRACE(trace_rcu_invoke_kfree_callback(rn, head, offset));
                kfree((void *)head - offset);
+                rcu_lock_release(&rcu_callback_map);
                return 1;
        } else {
                RCU_TRACE(trace_rcu_invoke_callback(rn, head));
                head->func(head);
+                rcu_lock_release(&rcu_callback_map);
                return 0;
        }
 }
diff --git a/kernel/rcu/srcu.c b/kernel/rcu/srcu.c
index 01d5ccb8bfe3..3318d8284384 100644
--- a/kernel/rcu/srcu.c
+++ b/kernel/rcu/srcu.c
@@ -363,6 +363,29 @@ static void srcu_flip(struct srcu_struct *sp)
 /*
 * Enqueue an SRCU callback on the specified srcu_struct structure,
 * initiating grace-period processing if it is not already running.
+ *
+ * Note that all CPUs must agree that the grace period extended beyond
+ * all pre-existing SRCU read-side critical section.  On systems with
+ * more than one CPU, this means that when "func()" is invoked, each CPU
+ * is guaranteed to have executed a full memory barrier since the end of
+ * its last corresponding SRCU read-side critical section whose beginning
+ * preceded the call to call_rcu().  It also means that each CPU executing
+ * an SRCU read-side critical section that continues beyond the start of
+ * "func()" must have executed a memory barrier after the call_rcu()
+ * but before the beginning of that SRCU read-side critical section.
+ * Note that these guarantees include CPUs that are offline, idle, or
+ * executing in user mode, as well as CPUs that are executing in the kernel.
+ *
+ * Furthermore, if CPU A invoked call_rcu() and CPU B invoked the
+ * resulting SRCU callback function "func()", then both CPU A and CPU
+ * B are guaranteed to execute a full memory barrier during the time
+ * interval between the call to call_rcu() and the invocation of "func()".
+ * This guarantee applies even if CPU A and CPU B are the same CPU (but
+ * again only if the system has more than one CPU).
+ *
+ * Of course, these guarantees apply only for invocations of call_srcu(),
+ * srcu_read_lock(), and srcu_read_unlock() that are all passed the same
+ * srcu_struct structure.
 */
 void call_srcu(struct srcu_struct *sp, struct rcu_head *head,
                void (*func)(struct rcu_head *head))
@@ -459,7 +482,30 @@ static void __synchronize_srcu(struct srcu_struct *sp, int trycount)
 * Note that it is illegal to call synchronize_srcu() from the corresponding
 * SRCU read-side critical section; doing so will result in deadlock.
 * However, it is perfectly legal to call synchronize_srcu() on one
- * srcu_struct from some other srcu_struct's read-side critical section.
+ * srcu_struct from some other srcu_struct's read-side critical section,
+ * as long as the resulting graph of srcu_structs is acyclic.
+ *
+ * There are memory-ordering constraints implied by synchronize_srcu().
+ * On systems with more than one CPU, when synchronize_srcu() returns,
+ * each CPU is guaranteed to have executed a full memory barrier since
+ * the end of its last corresponding SRCU-sched read-side critical section
+ * whose beginning preceded the call to synchronize_srcu().  In addition,
+ * each CPU having an SRCU read-side critical section that extends beyond
+ * the return from synchronize_srcu() is guaranteed to have executed a
+ * full memory barrier after the beginning of synchronize_srcu() and before
+ * the beginning of that SRCU read-side critical section.  Note that these
+ * guarantees include CPUs that are offline, idle, or executing in user mode,
+ * as well as CPUs that are executing in the kernel.
+ *
+ * Furthermore, if CPU A invoked synchronize_srcu(), which returned
+ * to its caller on CPU B, then both CPU A and CPU B are guaranteed
+ * to have executed a full memory barrier during the execution of
+ * synchronize_srcu().  This guarantee applies even if CPU A and CPU B
+ * are the same CPU, but again only if the system has more than one CPU.
+ *
+ * Of course, these memory-ordering guarantees apply only when
+ * synchronize_srcu(), srcu_read_lock(), and srcu_read_unlock() are
+ * passed the same srcu_struct structure.
 */
 void synchronize_srcu(struct srcu_struct *sp)
 {
@@ -476,12 +522,8 @@ EXPORT_SYMBOL_GPL(synchronize_srcu);
 * Wait for an SRCU grace period to elapse, but be more aggressive about
 * spinning rather than blocking when waiting.
 *
- * Note that it is also illegal to call synchronize_srcu_expedited()
+ * Note that synchronize_srcu_expedited() has the same deadlock and
- * from the corresponding SRCU read-side critical section;
+ * memory-ordering properties as does synchronize_srcu().
- * doing so will result in deadlock.  However, it is perfectly legal
- * to call synchronize_srcu_expedited() on one srcu_struct from some
- * other srcu_struct's read-side critical section, as long as
- * the resulting graph of srcu_structs is acyclic.
 */
 void synchronize_srcu_expedited(struct srcu_struct *sp)
 {
@@ -491,6 +533,7 @@ EXPORT_SYMBOL_GPL(synchronize_srcu_expedited);
 /**
 * srcu_barrier - Wait until all in-flight call_srcu() callbacks complete.
+ * @sp: srcu_struct on which to wait for in-flight callbacks.
 */
 void srcu_barrier(struct srcu_struct *sp)
 {
diff --git a/kernel/rcu/torture.c b/kernel/rcu/torture.c
index 3929cd451511..732f8ae3086a 100644
--- a/kernel/rcu/torture.c
+++ b/kernel/rcu/torture.c
@@ -139,8 +139,6 @@ MODULE_PARM_DESC(verbose, "Enable verbose debugging printk()s");
 #define VERBOSE_PRINTK_ERRSTRING(s) \
        do { if (verbose) pr_alert("%s" TORTURE_FLAG "!!! " s "\n", torture_type); } while (0)
-static char printk_buf[4096];
 static int nrealreaders;
 static struct task_struct *writer_task;
 static struct task_struct **fakewriter_tasks;
@@ -376,7 +374,7 @@ struct rcu_torture_ops {
        void (*call)(struct rcu_head *head, void (*func)(struct rcu_head *rcu));
        void (*cb_barrier)(void);
        void (*fqs)(void);
-        int (*stats)(char *page);
+        void (*stats)(char *page);
        int irq_capable;
        int can_boost;
        const char *name;
@@ -578,21 +576,19 @@ static void srcu_torture_barrier(void)
        srcu_barrier(&srcu_ctl);
 }
-static int srcu_torture_stats(char *page)
+static void srcu_torture_stats(char *page)
 {
-        int cnt = 0;
        int cpu;
        int idx = srcu_ctl.completed & 0x1;
-        cnt += sprintf(&page[cnt], "%s%s per-CPU(idx=%d):",
+        page += sprintf(page, "%s%s per-CPU(idx=%d):",
                       torture_type, TORTURE_FLAG, idx);
        for_each_possible_cpu(cpu) {
-                cnt += sprintf(&page[cnt], " %d(%lu,%lu)", cpu,
+                page += sprintf(page, " %d(%lu,%lu)", cpu,
                               per_cpu_ptr(srcu_ctl.per_cpu_ref, cpu)->c[!idx],
                               per_cpu_ptr(srcu_ctl.per_cpu_ref, cpu)->c[idx]);
        }
-        cnt += sprintf(&page[cnt], "\n");
+        sprintf(page, "\n");
-        return cnt;
 }
 static void srcu_torture_synchronize_expedited(void)
@@ -1052,10 +1048,9 @@ rcu_torture_reader(void *arg)
 /*
 * Create an RCU-torture statistics message in the specified buffer.
 */
-static int
+static void
 rcu_torture_printk(char *page)
 {
-        int cnt = 0;
        int cpu;
        int i;
        long pipesummary[RCU_TORTURE_PIPE_LEN + 1] = { 0 };
@@ -1071,8 +1066,8 @@ rcu_torture_printk(char *page)
                if (pipesummary[i] != 0)
                        break;
        }
-        cnt += sprintf(&page[cnt], "%s%s ", torture_type, TORTURE_FLAG);
+        page += sprintf(page, "%s%s ", torture_type, TORTURE_FLAG);
-        cnt += sprintf(&page[cnt],
+        page += sprintf(page,
                       "rtc: %p ver: %lu tfle: %d rta: %d rtaf: %d rtf: %d ",
                       rcu_torture_current,
                       rcu_torture_current_version,
@@ -1080,53 +1075,52 @@ rcu_torture_printk(char *page)
                       atomic_read(&n_rcu_torture_alloc),
                       atomic_read(&n_rcu_torture_alloc_fail),
                       atomic_read(&n_rcu_torture_free));
-        cnt += sprintf(&page[cnt], "rtmbe: %d rtbke: %ld rtbre: %ld ",
+        page += sprintf(page, "rtmbe: %d rtbke: %ld rtbre: %ld ",
                       atomic_read(&n_rcu_torture_mberror),
                       n_rcu_torture_boost_ktrerror,
                       n_rcu_torture_boost_rterror);
-        cnt += sprintf(&page[cnt], "rtbf: %ld rtb: %ld nt: %ld ",
+        page += sprintf(page, "rtbf: %ld rtb: %ld nt: %ld ",
                       n_rcu_torture_boost_failure,
                       n_rcu_torture_boosts,
                       n_rcu_torture_timers);
-        cnt += sprintf(&page[cnt],
+        page += sprintf(page,
                       "onoff: %ld/%ld:%ld/%ld %d,%d:%d,%d %lu:%lu (HZ=%d) ",
                       n_online_successes, n_online_attempts,
                       n_offline_successes, n_offline_attempts,
                       min_online, max_online,
                       min_offline, max_offline,
                       sum_online, sum_offline, HZ);
-        cnt += sprintf(&page[cnt], "barrier: %ld/%ld:%ld",
+        page += sprintf(page, "barrier: %ld/%ld:%ld",
                       n_barrier_successes,
                       n_barrier_attempts,
                       n_rcu_torture_barrier_error);
-        cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
+        page += sprintf(page, "\n%s%s ", torture_type, TORTURE_FLAG);
        if (atomic_read(&n_rcu_torture_mberror) != 0 ||
            n_rcu_torture_barrier_error != 0 ||
            n_rcu_torture_boost_ktrerror != 0 ||
            n_rcu_torture_boost_rterror != 0 ||
            n_rcu_torture_boost_failure != 0 ||
            i > 1) {
-                cnt += sprintf(&page[cnt], "!!! ");
+                page += sprintf(page, "!!! ");
                atomic_inc(&n_rcu_torture_error);
                WARN_ON_ONCE(1);
        }
-        cnt += sprintf(&page[cnt], "Reader Pipe: ");
+        page += sprintf(page, "Reader Pipe: ");
        for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
-                cnt += sprintf(&page[cnt], " %ld", pipesummary[i]);
+                page += sprintf(page, " %ld", pipesummary[i]);
-        cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
+        page += sprintf(page, "\n%s%s ", torture_type, TORTURE_FLAG);
-        cnt += sprintf(&page[cnt], "Reader Batch: ");
+        page += sprintf(page, "Reader Batch: ");
        for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
-                cnt += sprintf(&page[cnt], " %ld", batchsummary[i]);
+                page += sprintf(page, " %ld", batchsummary[i]);
-        cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
+        page += sprintf(page, "\n%s%s ", torture_type, TORTURE_FLAG);
-        cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
+        page += sprintf(page, "Free-Block Circulation: ");
        for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
-                cnt += sprintf(&page[cnt], " %d",
+                page += sprintf(page, " %d",
                               atomic_read(&rcu_torture_wcount[i]));
        }
-        cnt += sprintf(&page[cnt], "\n");
+        page += sprintf(page, "\n");
        if (cur_ops->stats)
-                cnt += cur_ops->stats(&page[cnt]);
+                cur_ops->stats(page);
-        return cnt;
 }
 /*
@@ -1140,10 +1134,17 @@ rcu_torture_printk(char *page)
 static void
 rcu_torture_stats_print(void)
 {
-        int cnt;
+        int size = nr_cpu_ids * 200 + 8192;
+        char *buf;
-        cnt = rcu_torture_printk(printk_buf);
+        buf = kmalloc(size, GFP_KERNEL);
-        pr_alert("%s", printk_buf);
+        if (!buf) {
+                pr_err("rcu-torture: Out of memory, need: %d", size);
+                return;
+        }
+        rcu_torture_printk(buf);
+        pr_alert("%s", buf);
+        kfree(buf);
 }
 /*
@@ -1578,6 +1579,7 @@ static int rcu_torture_barrier_cbs(void *arg)
 {
        long myid = (long)arg;
        bool lastphase = 0;
+        bool newphase;
        struct rcu_head rcu;
        init_rcu_head_on_stack(&rcu);
@@ -1585,10 +1587,11 @@ static int rcu_torture_barrier_cbs(void *arg)
        set_user_nice(current, 19);
        do {
                wait_event(barrier_cbs_wq[myid],
-                           barrier_phase != lastphase ||
+                           (newphase =
+                            ACCESS_ONCE(barrier_phase)) != lastphase ||
                           kthread_should_stop() ||
                           fullstop != FULLSTOP_DONTSTOP);
-                lastphase = barrier_phase;
+                lastphase = newphase;
                smp_mb(); /* ensure barrier_phase load before ->call(). */
                if (kthread_should_stop() || fullstop != FULLSTOP_DONTSTOP)
                        break;
@@ -1625,7 +1628,7 @@ static int rcu_torture_barrier(void *arg)
                if (kthread_should_stop() || fullstop != FULLSTOP_DONTSTOP)
                        break;
                n_barrier_attempts++;
-                cur_ops->cb_barrier();
+                cur_ops->cb_barrier(); /* Implies smp_mb() for wait_event(). */
                if (atomic_read(&barrier_cbs_invoked) != n_barrier_cbs) {
                        n_rcu_torture_barrier_error++;
                        WARN_ON_ONCE(1);
diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c
index dd081987a8ec..b3d116cd072d 100644
--- a/kernel/rcu/tree.c
+++ b/kernel/rcu/tree.c
@@ -369,6 +369,9 @@ static struct rcu_node *rcu_get_root(struct rcu_state *rsp)
 static void rcu_eqs_enter_common(struct rcu_dynticks *rdtp, long long oldval,
                                bool user)
 {
+        struct rcu_state *rsp;
+        struct rcu_data *rdp;
        trace_rcu_dyntick(TPS("Start"), oldval, rdtp->dynticks_nesting);
        if (!user && !is_idle_task(current)) {
                struct task_struct *idle __maybe_unused =
@@ -380,6 +383,10 @@ static void rcu_eqs_enter_common(struct rcu_dynticks *rdtp, long long oldval,
                          current->pid, current->comm,
                          idle->pid, idle->comm); /* must be idle task! */
        }
+        for_each_rcu_flavor(rsp) {
+                rdp = this_cpu_ptr(rsp->rda);
+                do_nocb_deferred_wakeup(rdp);
+        }
        rcu_prepare_for_idle(smp_processor_id());
        /* CPUs seeing atomic_inc() must see prior RCU read-side crit sects */
        smp_mb__before_atomic_inc();  /* See above. */
@@ -411,11 +418,12 @@ static void rcu_eqs_enter(bool user)
        rdtp = this_cpu_ptr(&rcu_dynticks);
        oldval = rdtp->dynticks_nesting;
        WARN_ON_ONCE((oldval & DYNTICK_TASK_NEST_MASK) == 0);
-        if ((oldval & DYNTICK_TASK_NEST_MASK) == DYNTICK_TASK_NEST_VALUE)
+        if ((oldval & DYNTICK_TASK_NEST_MASK) == DYNTICK_TASK_NEST_VALUE) {
                rdtp->dynticks_nesting = 0;
-        else
+                rcu_eqs_enter_common(rdtp, oldval, user);
+        } else {
                rdtp->dynticks_nesting -= DYNTICK_TASK_NEST_VALUE;
-        rcu_eqs_enter_common(rdtp, oldval, user);
+        }
 }
 /**
@@ -533,11 +541,12 @@ static void rcu_eqs_exit(bool user)
        rdtp = this_cpu_ptr(&rcu_dynticks);
        oldval = rdtp->dynticks_nesting;
        WARN_ON_ONCE(oldval < 0);
-        if (oldval & DYNTICK_TASK_NEST_MASK)
+        if (oldval & DYNTICK_TASK_NEST_MASK) {
                rdtp->dynticks_nesting += DYNTICK_TASK_NEST_VALUE;
-        else
+        } else {
                rdtp->dynticks_nesting = DYNTICK_TASK_EXIT_IDLE;
-        rcu_eqs_exit_common(rdtp, oldval, user);
+                rcu_eqs_exit_common(rdtp, oldval, user);
+        }
 }
 /**
@@ -716,7 +725,7 @@ bool rcu_lockdep_current_cpu_online(void)
        bool ret;
        if (in_nmi())
-                return 1;
+                return true;
        preempt_disable();
        rdp = this_cpu_ptr(&rcu_sched_data);
        rnp = rdp->mynode;
@@ -755,6 +764,12 @@ static int dyntick_save_progress_counter(struct rcu_data *rdp,
 }
 /*
+ * This function really isn't for public consumption, but RCU is special in
+ * that context switches can allow the state machine to make progress.
+ */
+extern void resched_cpu(int cpu);
+/*
 * Return true if the specified CPU has passed through a quiescent
 * state by virtue of being in or having passed through an dynticks
 * idle state since the last call to dyntick_save_progress_counter()
@@ -812,16 +827,34 @@ static int rcu_implicit_dynticks_qs(struct rcu_data *rdp,
         */
        rcu_kick_nohz_cpu(rdp->cpu);
+        /*
+         * Alternatively, the CPU might be running in the kernel
+         * for an extended period of time without a quiescent state.
+         * Attempt to force the CPU through the scheduler to gain the
+         * needed quiescent state, but only if the grace period has gone
+         * on for an uncommonly long time.  If there are many stuck CPUs,
+         * we will beat on the first one until it gets unstuck, then move
+         * to the next.  Only do this for the primary flavor of RCU.
+         */
+        if (rdp->rsp == rcu_state &&
+            ULONG_CMP_GE(ACCESS_ONCE(jiffies), rdp->rsp->jiffies_resched)) {
+                rdp->rsp->jiffies_resched += 5;
+                resched_cpu(rdp->cpu);
+        }
        return 0;
 }
 static void record_gp_stall_check_time(struct rcu_state *rsp)
 {
        unsigned long j = ACCESS_ONCE(jiffies);
+        unsigned long j1;
        rsp->gp_start = j;
        smp_wmb(); /* Record start time before stall time. */
-        rsp->jiffies_stall = j + rcu_jiffies_till_stall_check();
+        j1 = rcu_jiffies_till_stall_check();
+        rsp->jiffies_stall = j + j1;
+        rsp->jiffies_resched = j + j1 / 2;
 }
 /*
@@ -1133,8 +1166,10 @@ rcu_start_future_gp(struct rcu_node *rnp, struct rcu_data *rdp)
         * hold it, acquire the root rcu_node structure's lock in order to
         * start one (if needed).
         */
-        if (rnp != rnp_root)
+        if (rnp != rnp_root) {
                raw_spin_lock(&rnp_root->lock);
+                smp_mb__after_unlock_lock();
+        }
        /*
         * Get a new grace-period number.  If there really is no grace
@@ -1354,6 +1389,7 @@ static void note_gp_changes(struct rcu_state *rsp, struct rcu_data *rdp)
                local_irq_restore(flags);
                return;
        }
+        smp_mb__after_unlock_lock();
        __note_gp_changes(rsp, rnp, rdp);
        raw_spin_unlock_irqrestore(&rnp->lock, flags);
 }
@@ -1368,6 +1404,7 @@ static int rcu_gp_init(struct rcu_state *rsp)
        rcu_bind_gp_kthread();
        raw_spin_lock_irq(&rnp->lock);
+        smp_mb__after_unlock_lock();
        if (rsp->gp_flags == 0) {
                /* Spurious wakeup, tell caller to go back to sleep.  */
                raw_spin_unlock_irq(&rnp->lock);
@@ -1409,6 +1446,7 @@ static int rcu_gp_init(struct rcu_state *rsp)
         */
        rcu_for_each_node_breadth_first(rsp, rnp) {
                raw_spin_lock_irq(&rnp->lock);
+                smp_mb__after_unlock_lock();
                rdp = this_cpu_ptr(rsp->rda);
                rcu_preempt_check_blocked_tasks(rnp);
                rnp->qsmask = rnp->qsmaskinit;
@@ -1463,6 +1501,7 @@ static int rcu_gp_fqs(struct rcu_state *rsp, int fqs_state_in)
        /* Clear flag to prevent immediate re-entry. */
        if (ACCESS_ONCE(rsp->gp_flags) & RCU_GP_FLAG_FQS) {
                raw_spin_lock_irq(&rnp->lock);
+                smp_mb__after_unlock_lock();
                rsp->gp_flags &= ~RCU_GP_FLAG_FQS;
                raw_spin_unlock_irq(&rnp->lock);
        }
@@ -1480,6 +1519,7 @@ static void rcu_gp_cleanup(struct rcu_state *rsp)
        struct rcu_node *rnp = rcu_get_root(rsp);
        raw_spin_lock_irq(&rnp->lock);
+        smp_mb__after_unlock_lock();
        gp_duration = jiffies - rsp->gp_start;
        if (gp_duration > rsp->gp_max)
                rsp->gp_max = gp_duration;
@@ -1505,16 +1545,19 @@ static void rcu_gp_cleanup(struct rcu_state *rsp)
         */
        rcu_for_each_node_breadth_first(rsp, rnp) {
                raw_spin_lock_irq(&rnp->lock);
+                smp_mb__after_unlock_lock();
                ACCESS_ONCE(rnp->completed) = rsp->gpnum;
                rdp = this_cpu_ptr(rsp->rda);
                if (rnp == rdp->mynode)
                        __note_gp_changes(rsp, rnp, rdp);
+                /* smp_mb() provided by prior unlock-lock pair. */
                nocb += rcu_future_gp_cleanup(rsp, rnp);
                raw_spin_unlock_irq(&rnp->lock);
                cond_resched();
        }
        rnp = rcu_get_root(rsp);
        raw_spin_lock_irq(&rnp->lock);
+        smp_mb__after_unlock_lock();
        rcu_nocb_gp_set(rnp, nocb);
        rsp->completed = rsp->gpnum; /* Declare grace period done. */
@@ -1553,6 +1596,7 @@ static int __noreturn rcu_gp_kthread(void *arg)
                        wait_event_interruptible(rsp->gp_wq,
                                                 ACCESS_ONCE(rsp->gp_flags) &
                                                 RCU_GP_FLAG_INIT);
+                        /* Locking provides needed memory barrier. */
                        if (rcu_gp_init(rsp))
                                break;
                        cond_resched();
@@ -1582,6 +1626,7 @@ static int __noreturn rcu_gp_kthread(void *arg)
                                        (!ACCESS_ONCE(rnp->qsmask) &&
                                         !rcu_preempt_blocked_readers_cgp(rnp)),
                                        j);
+                        /* Locking provides needed memory barriers. */
                        /* If grace period done, leave loop. */
                        if (!ACCESS_ONCE(rnp->qsmask) &&
                            !rcu_preempt_blocked_readers_cgp(rnp))
@@ -1749,6 +1794,7 @@ rcu_report_qs_rnp(unsigned long mask, struct rcu_state *rsp,
                rnp_c = rnp;
                rnp = rnp->parent;
                raw_spin_lock_irqsave(&rnp->lock, flags);
+                smp_mb__after_unlock_lock();
                WARN_ON_ONCE(rnp_c->qsmask);
        }
@@ -1778,6 +1824,7 @@ rcu_report_qs_rdp(int cpu, struct rcu_state *rsp, struct rcu_data *rdp)
        rnp = rdp->mynode;
        raw_spin_lock_irqsave(&rnp->lock, flags);
+        smp_mb__after_unlock_lock();
        if (rdp->passed_quiesce == 0 || rdp->gpnum != rnp->gpnum ||
            rnp->completed == rnp->gpnum) {
@@ -1901,13 +1948,13 @@ rcu_send_cbs_to_orphanage(int cpu, struct rcu_state *rsp,
 * Adopt the RCU callbacks from the specified rcu_state structure's
 * orphanage.  The caller must hold the ->orphan_lock.
 */
-static void rcu_adopt_orphan_cbs(struct rcu_state *rsp)
+static void rcu_adopt_orphan_cbs(struct rcu_state *rsp, unsigned long flags)
 {
        int i;
        struct rcu_data *rdp = __this_cpu_ptr(rsp->rda);
        /* No-CBs CPUs are handled specially. */
-        if (rcu_nocb_adopt_orphan_cbs(rsp, rdp))
+        if (rcu_nocb_adopt_orphan_cbs(rsp, rdp, flags))
                return;
        /* Do the accounting first. */
@@ -1986,12 +2033,13 @@ static void rcu_cleanup_dead_cpu(int cpu, struct rcu_state *rsp)
        /* Orphan the dead CPU's callbacks, and adopt them if appropriate. */
        rcu_send_cbs_to_orphanage(cpu, rsp, rnp, rdp);
-        rcu_adopt_orphan_cbs(rsp);
+        rcu_adopt_orphan_cbs(rsp, flags);
        /* Remove the outgoing CPU from the masks in the rcu_node hierarchy. */
        mask = rdp->grpmask;    /* rnp->grplo is constant. */
        do {
                raw_spin_lock(&rnp->lock);      /* irqs already disabled. */
+                smp_mb__after_unlock_lock();
                rnp->qsmaskinit &= ~mask;
                if (rnp->qsmaskinit != 0) {
                        if (rnp != rdp->mynode)
@@ -2202,6 +2250,7 @@ static void force_qs_rnp(struct rcu_state *rsp,
                cond_resched();
                mask = 0;
                raw_spin_lock_irqsave(&rnp->lock, flags);
+                smp_mb__after_unlock_lock();
                if (!rcu_gp_in_progress(rsp)) {
                        raw_spin_unlock_irqrestore(&rnp->lock, flags);
                        return;
@@ -2231,6 +2280,7 @@ static void force_qs_rnp(struct rcu_state *rsp,
        rnp = rcu_get_root(rsp);
        if (rnp->qsmask == 0) {
                raw_spin_lock_irqsave(&rnp->lock, flags);
+                smp_mb__after_unlock_lock();
                rcu_initiate_boost(rnp, flags); /* releases rnp->lock. */
        }
 }
@@ -2263,6 +2313,7 @@ static void force_quiescent_state(struct rcu_state *rsp)
        /* Reached the root of the rcu_node tree, acquire lock. */
        raw_spin_lock_irqsave(&rnp_old->lock, flags);
+        smp_mb__after_unlock_lock();
        raw_spin_unlock(&rnp_old->fqslock);
        if (ACCESS_ONCE(rsp->gp_flags) & RCU_GP_FLAG_FQS) {
                rsp->n_force_qs_lh++;
@@ -2303,6 +2354,9 @@ __rcu_process_callbacks(struct rcu_state *rsp)
        /* If there are callbacks ready, invoke them. */
        if (cpu_has_callbacks_ready_to_invoke(rdp))
                invoke_rcu_callbacks(rsp, rdp);
+        /* Do any needed deferred wakeups of rcuo kthreads. */
+        do_nocb_deferred_wakeup(rdp);
 }
 /*
@@ -2378,6 +2432,7 @@ static void __call_rcu_core(struct rcu_state *rsp, struct rcu_data *rdp,
                        struct rcu_node *rnp_root = rcu_get_root(rsp);
                        raw_spin_lock(&rnp_root->lock);
+                        smp_mb__after_unlock_lock();
                        rcu_start_gp(rsp);
                        raw_spin_unlock(&rnp_root->lock);
                } else {
@@ -2437,7 +2492,7 @@ __call_rcu(struct rcu_head *head, void (*func)(struct rcu_head *rcu),
                if (cpu != -1)
                        rdp = per_cpu_ptr(rsp->rda, cpu);
-                offline = !__call_rcu_nocb(rdp, head, lazy);
+                offline = !__call_rcu_nocb(rdp, head, lazy, flags);
                WARN_ON_ONCE(offline);
                /* _call_rcu() is illegal on offline CPU; leak the callback. */
                local_irq_restore(flags);
@@ -2757,6 +2812,10 @@ static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp)
        /* Check for CPU stalls, if enabled. */
        check_cpu_stall(rsp, rdp);
+        /* Is this CPU a NO_HZ_FULL CPU that should ignore RCU? */
+        if (rcu_nohz_full_cpu(rsp))
+                return 0;
        /* Is the RCU core waiting for a quiescent state from this CPU? */
        if (rcu_scheduler_fully_active &&
            rdp->qs_pending && !rdp->passed_quiesce) {
@@ -2790,6 +2849,12 @@ static int __rcu_pending(struct rcu_state *rsp, struct rcu_data *rdp)
                return 1;
        }
+        /* Does this CPU need a deferred NOCB wakeup? */
+        if (rcu_nocb_need_deferred_wakeup(rdp)) {
+                rdp->n_rp_nocb_defer_wakeup++;
+                return 1;
+        }
        /* nothing to do */
        rdp->n_rp_need_nothing++;
        return 0;
@@ -3214,9 +3279,9 @@ static void __init rcu_init_levelspread(struct rcu_state *rsp)
 {
        int i;
-        for (i = rcu_num_lvls - 1; i > 0; i--)
+        rsp->levelspread[rcu_num_lvls - 1] = rcu_fanout_leaf;
+        for (i = rcu_num_lvls - 2; i >= 0; i--)
                rsp->levelspread[i] = CONFIG_RCU_FANOUT;
-        rsp->levelspread[0] = rcu_fanout_leaf;
 }
 #else /* #ifdef CONFIG_RCU_FANOUT_EXACT */
 static void __init rcu_init_levelspread(struct rcu_state *rsp)
@@ -3346,6 +3411,8 @@ static void __init rcu_init_geometry(void)
        if (rcu_fanout_leaf == CONFIG_RCU_FANOUT_LEAF &&
            nr_cpu_ids == NR_CPUS)
                return;
+        pr_info("RCU: Adjusting geometry for rcu_fanout_leaf=%d, nr_cpu_ids=%d\n",
+                rcu_fanout_leaf, nr_cpu_ids);
        /*
         * Compute number of nodes that can be handled an rcu_node tree
diff --git a/kernel/rcu/tree.h b/kernel/rcu/tree.h
index 52be957c9fe2..8c19873f1ac9 100644
--- a/kernel/rcu/tree.h
+++ b/kernel/rcu/tree.h
@@ -317,6 +317,7 @@ struct rcu_data {
        unsigned long n_rp_cpu_needs_gp;
        unsigned long n_rp_gp_completed;
        unsigned long n_rp_gp_started;
+        unsigned long n_rp_nocb_defer_wakeup;
        unsigned long n_rp_need_nothing;
        /* 6) _rcu_barrier() and OOM callbacks. */
@@ -335,6 +336,7 @@ struct rcu_data {
        int nocb_p_count_lazy;          /*  (approximate). */
        wait_queue_head_t nocb_wq;      /* For nocb kthreads to sleep on. */
        struct task_struct *nocb_kthread;
+        bool nocb_defer_wakeup;         /* Defer wakeup of nocb_kthread. */
 #endif /* #ifdef CONFIG_RCU_NOCB_CPU */
        /* 8) RCU CPU stall data. */
@@ -453,6 +455,8 @@ struct rcu_state {
                                                /*  but in jiffies. */
        unsigned long jiffies_stall;            /* Time at which to check */
                                                /*  for CPU stalls. */
+        unsigned long jiffies_resched;          /* Time at which to resched */
+                                                /*  a reluctant CPU. */
        unsigned long gp_max;                   /* Maximum GP duration in */
                                                /*  jiffies. */
        const char *name;                       /* Name of structure. */
@@ -548,9 +552,12 @@ static void rcu_nocb_gp_set(struct rcu_node *rnp, int nrq);
 static void rcu_nocb_gp_cleanup(struct rcu_state *rsp, struct rcu_node *rnp);
 static void rcu_init_one_nocb(struct rcu_node *rnp);
 static bool __call_rcu_nocb(struct rcu_data *rdp, struct rcu_head *rhp,
-                            bool lazy);
+                            bool lazy, unsigned long flags);
 static bool rcu_nocb_adopt_orphan_cbs(struct rcu_state *rsp,
-                                      struct rcu_data *rdp);
+                                      struct rcu_data *rdp,
+                                      unsigned long flags);
+static bool rcu_nocb_need_deferred_wakeup(struct rcu_data *rdp);
+static void do_nocb_deferred_wakeup(struct rcu_data *rdp);
 static void rcu_boot_init_nocb_percpu_data(struct rcu_data *rdp);
 static void rcu_spawn_nocb_kthreads(struct rcu_state *rsp);
 static void rcu_kick_nohz_cpu(int cpu);
@@ -564,6 +571,7 @@ static void rcu_sysidle_report_gp(struct rcu_state *rsp, int isidle,
                                  unsigned long maxj);
 static void rcu_bind_gp_kthread(void);
 static void rcu_sysidle_init_percpu_data(struct rcu_dynticks *rdtp);
+static bool rcu_nohz_full_cpu(struct rcu_state *rsp);
 #endif /* #ifndef RCU_TREE_NONCORE */
diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h
index 08a765232432..6e2ef4b2b920 100644
--- a/kernel/rcu/tree_plugin.h
+++ b/kernel/rcu/tree_plugin.h
@@ -204,6 +204,7 @@ static void rcu_preempt_note_context_switch(int cpu)
                rdp = per_cpu_ptr(rcu_preempt_state.rda, cpu);
                rnp = rdp->mynode;
                raw_spin_lock_irqsave(&rnp->lock, flags);
+                smp_mb__after_unlock_lock();
                t->rcu_read_unlock_special |= RCU_READ_UNLOCK_BLOCKED;
                t->rcu_blocked_node = rnp;
@@ -312,6 +313,7 @@ static void rcu_report_unblock_qs_rnp(struct rcu_node *rnp, unsigned long flags)
        mask = rnp->grpmask;
        raw_spin_unlock(&rnp->lock);    /* irqs remain disabled. */
        raw_spin_lock(&rnp_p->lock);    /* irqs already disabled. */
+        smp_mb__after_unlock_lock();
        rcu_report_qs_rnp(mask, &rcu_preempt_state, rnp_p, flags);
 }
@@ -361,10 +363,14 @@ void rcu_read_unlock_special(struct task_struct *t)
        special = t->rcu_read_unlock_special;
        if (special & RCU_READ_UNLOCK_NEED_QS) {
                rcu_preempt_qs(smp_processor_id());
+                if (!t->rcu_read_unlock_special) {
+                        local_irq_restore(flags);
+                        return;
+                }
        }
-        /* Hardware IRQ handlers cannot block. */
+        /* Hardware IRQ handlers cannot block, complain if they get here. */
-        if (in_irq() || in_serving_softirq()) {
+        if (WARN_ON_ONCE(in_irq() || in_serving_softirq())) {
                local_irq_restore(flags);
                return;
        }
@@ -381,6 +387,7 @@ void rcu_read_unlock_special(struct task_struct *t)
                for (;;) {
                        rnp = t->rcu_blocked_node;
                        raw_spin_lock(&rnp->lock);  /* irqs already disabled. */
+                        smp_mb__after_unlock_lock();
                        if (rnp == t->rcu_blocked_node)
                                break;
                        raw_spin_unlock(&rnp->lock); /* irqs remain disabled. */
@@ -605,6 +612,7 @@ static int rcu_preempt_offline_tasks(struct rcu_state *rsp,
        while (!list_empty(lp)) {
                t = list_entry(lp->next, typeof(*t), rcu_node_entry);
                raw_spin_lock(&rnp_root->lock); /* irqs already disabled */
+                smp_mb__after_unlock_lock();
                list_del(&t->rcu_node_entry);
                t->rcu_blocked_node = rnp_root;
                list_add(&t->rcu_node_entry, lp_root);
@@ -629,6 +637,7 @@ static int rcu_preempt_offline_tasks(struct rcu_state *rsp,
         * in this case.
         */
        raw_spin_lock(&rnp_root->lock); /* irqs already disabled */
+        smp_mb__after_unlock_lock();
        if (rnp_root->boost_tasks != NULL &&
            rnp_root->boost_tasks != rnp_root->gp_tasks &&
            rnp_root->boost_tasks != rnp_root->exp_tasks)
@@ -772,6 +781,7 @@ static void rcu_report_exp_rnp(struct rcu_state *rsp, struct rcu_node *rnp,
        unsigned long mask;
        raw_spin_lock_irqsave(&rnp->lock, flags);
+        smp_mb__after_unlock_lock();
        for (;;) {
                if (!sync_rcu_preempt_exp_done(rnp)) {
                        raw_spin_unlock_irqrestore(&rnp->lock, flags);
@@ -779,14 +789,17 @@ static void rcu_report_exp_rnp(struct rcu_state *rsp, struct rcu_node *rnp,
                }
                if (rnp->parent == NULL) {
                        raw_spin_unlock_irqrestore(&rnp->lock, flags);
-                        if (wake)
+                        if (wake) {
+                                smp_mb(); /* EGP done before wake_up(). */
                                wake_up(&sync_rcu_preempt_exp_wq);
+                        }
                        break;
                }
                mask = rnp->grpmask;
                raw_spin_unlock(&rnp->lock); /* irqs remain disabled */
                rnp = rnp->parent;
                raw_spin_lock(&rnp->lock); /* irqs already disabled */
+                smp_mb__after_unlock_lock();
                rnp->expmask &= ~mask;
        }
 }
@@ -806,6 +819,7 @@ sync_rcu_preempt_exp_init(struct rcu_state *rsp, struct rcu_node *rnp)
        int must_wait = 0;
        raw_spin_lock_irqsave(&rnp->lock, flags);
+        smp_mb__after_unlock_lock();
        if (list_empty(&rnp->blkd_tasks)) {
                raw_spin_unlock_irqrestore(&rnp->lock, flags);
        } else {
@@ -886,6 +900,7 @@ void synchronize_rcu_expedited(void)
        /* Initialize ->expmask for all non-leaf rcu_node structures. */
        rcu_for_each_nonleaf_node_breadth_first(rsp, rnp) {
                raw_spin_lock_irqsave(&rnp->lock, flags);
+                smp_mb__after_unlock_lock();
                rnp->expmask = rnp->qsmaskinit;
                raw_spin_unlock_irqrestore(&rnp->lock, flags);
        }
@@ -1191,6 +1206,7 @@ static int rcu_boost(struct rcu_node *rnp)
                return 0;  /* Nothing left to boost. */
        raw_spin_lock_irqsave(&rnp->lock, flags);
+        smp_mb__after_unlock_lock();
        /*
         * Recheck under the lock: all tasks in need of boosting
@@ -1377,6 +1393,7 @@ static int rcu_spawn_one_boost_kthread(struct rcu_state *rsp,
        if (IS_ERR(t))
                return PTR_ERR(t);
        raw_spin_lock_irqsave(&rnp->lock, flags);
+        smp_mb__after_unlock_lock();
        rnp->boost_kthread_task = t;
        raw_spin_unlock_irqrestore(&rnp->lock, flags);
        sp.sched_priority = RCU_BOOST_PRIO;
@@ -1769,6 +1786,7 @@ static void rcu_prepare_for_idle(int cpu)
                        continue;
                rnp = rdp->mynode;
                raw_spin_lock(&rnp->lock); /* irqs already disabled. */
+                smp_mb__after_unlock_lock();
                rcu_accelerate_cbs(rsp, rnp, rdp);
                raw_spin_unlock(&rnp->lock); /* irqs remain disabled. */
        }
@@ -1852,6 +1870,7 @@ static int rcu_oom_notify(struct notifier_block *self,
        /* Wait for callbacks from earlier instance to complete. */
        wait_event(oom_callback_wq, atomic_read(&oom_callback_count) == 0);
+        smp_mb(); /* Ensure callback reuse happens after callback invocation. */
        /*
         * Prevent premature wakeup: ensure that all increments happen
@@ -2101,7 +2120,8 @@ bool rcu_is_nocb_cpu(int cpu)
 static void __call_rcu_nocb_enqueue(struct rcu_data *rdp,
                                    struct rcu_head *rhp,
                                    struct rcu_head **rhtp,
-                                    int rhcount, int rhcount_lazy)
+                                    int rhcount, int rhcount_lazy,
+                                    unsigned long flags)
 {
        int len;
        struct rcu_head **old_rhpp;
@@ -2122,9 +2142,16 @@ static void __call_rcu_nocb_enqueue(struct rcu_data *rdp,
        }
        len = atomic_long_read(&rdp->nocb_q_count);
        if (old_rhpp == &rdp->nocb_head) {
-                wake_up(&rdp->nocb_wq); /* ... only if queue was empty ... */
+                if (!irqs_disabled_flags(flags)) {
+                        wake_up(&rdp->nocb_wq); /* ... if queue was empty ... */
+                        trace_rcu_nocb_wake(rdp->rsp->name, rdp->cpu,
+                                            TPS("WakeEmpty"));
+                } else {
+                        rdp->nocb_defer_wakeup = true;
+                        trace_rcu_nocb_wake(rdp->rsp->name, rdp->cpu,
+                                            TPS("WakeEmptyIsDeferred"));
+                }
                rdp->qlen_last_fqs_check = 0;
-                trace_rcu_nocb_wake(rdp->rsp->name, rdp->cpu, TPS("WakeEmpty"));
        } else if (len > rdp->qlen_last_fqs_check + qhimark) {
                wake_up_process(t); /* ... or if many callbacks queued. */
                rdp->qlen_last_fqs_check = LONG_MAX / 2;
@@ -2145,12 +2172,12 @@ static void __call_rcu_nocb_enqueue(struct rcu_data *rdp,
 * "rcuo" kthread can find it.
 */
 static bool __call_rcu_nocb(struct rcu_data *rdp, struct rcu_head *rhp,
-                            bool lazy)
+                            bool lazy, unsigned long flags)
 {
        if (!rcu_is_nocb_cpu(rdp->cpu))
                return 0;
-        __call_rcu_nocb_enqueue(rdp, rhp, &rhp->next, 1, lazy);
+        __call_rcu_nocb_enqueue(rdp, rhp, &rhp->next, 1, lazy, flags);
        if (__is_kfree_rcu_offset((unsigned long)rhp->func))
                trace_rcu_kfree_callback(rdp->rsp->name, rhp,
                                         (unsigned long)rhp->func,
@@ -2168,7 +2195,8 @@ static bool __call_rcu_nocb(struct rcu_data *rdp, struct rcu_head *rhp,
 * not a no-CBs CPU.
 */
 static bool __maybe_unused rcu_nocb_adopt_orphan_cbs(struct rcu_state *rsp,
-                                                     struct rcu_data *rdp)
+                                                     struct rcu_data *rdp,
+                                                     unsigned long flags)
 {
        long ql = rsp->qlen;
        long qll = rsp->qlen_lazy;
@@ -2182,14 +2210,14 @@ static bool __maybe_unused rcu_nocb_adopt_orphan_cbs(struct rcu_state *rsp,
        /* First, enqueue the donelist, if any.  This preserves CB ordering. */
        if (rsp->orphan_donelist != NULL) {
                __call_rcu_nocb_enqueue(rdp, rsp->orphan_donelist,
-                                        rsp->orphan_donetail, ql, qll);
+                                        rsp->orphan_donetail, ql, qll, flags);
                ql = qll = 0;
                rsp->orphan_donelist = NULL;
                rsp->orphan_donetail = &rsp->orphan_donelist;
        }
        if (rsp->orphan_nxtlist != NULL) {
                __call_rcu_nocb_enqueue(rdp, rsp->orphan_nxtlist,
-                                        rsp->orphan_nxttail, ql, qll);
+                                        rsp->orphan_nxttail, ql, qll, flags);
                ql = qll = 0;
                rsp->orphan_nxtlist = NULL;
                rsp->orphan_nxttail = &rsp->orphan_nxtlist;
@@ -2209,6 +2237,7 @@ static void rcu_nocb_wait_gp(struct rcu_data *rdp)
        struct rcu_node *rnp = rdp->mynode;
        raw_spin_lock_irqsave(&rnp->lock, flags);
+        smp_mb__after_unlock_lock();
        c = rcu_start_future_gp(rnp, rdp);
        raw_spin_unlock_irqrestore(&rnp->lock, flags);
@@ -2250,6 +2279,7 @@ static int rcu_nocb_kthread(void *arg)
                        trace_rcu_nocb_wake(rdp->rsp->name, rdp->cpu,
                                            TPS("Sleep"));
                        wait_event_interruptible(rdp->nocb_wq, rdp->nocb_head);
+                        /* Memory barrier provide by xchg() below. */
                } else if (firsttime) {
                        firsttime = 0;
                        trace_rcu_nocb_wake(rdp->rsp->name, rdp->cpu,
@@ -2310,6 +2340,22 @@ static int rcu_nocb_kthread(void *arg)
        return 0;
 }
+/* Is a deferred wakeup of rcu_nocb_kthread() required? */
+static bool rcu_nocb_need_deferred_wakeup(struct rcu_data *rdp)
+{
+        return ACCESS_ONCE(rdp->nocb_defer_wakeup);
+}
+/* Do a deferred wakeup of rcu_nocb_kthread(). */
+static void do_nocb_deferred_wakeup(struct rcu_data *rdp)
+{
+        if (!rcu_nocb_need_deferred_wakeup(rdp))
+                return;
+        ACCESS_ONCE(rdp->nocb_defer_wakeup) = false;
+        wake_up(&rdp->nocb_wq);
+        trace_rcu_nocb_wake(rdp->rsp->name, rdp->cpu, TPS("DeferredWakeEmpty"));
+}
 /* Initialize per-rcu_data variables for no-CBs CPUs. */
 static void __init rcu_boot_init_nocb_percpu_data(struct rcu_data *rdp)
 {
@@ -2365,13 +2411,14 @@ static void rcu_init_one_nocb(struct rcu_node *rnp)
 }
 static bool __call_rcu_nocb(struct rcu_data *rdp, struct rcu_head *rhp,
-                            bool lazy)
+                            bool lazy, unsigned long flags)
 {
        return 0;
 }
 static bool __maybe_unused rcu_nocb_adopt_orphan_cbs(struct rcu_state *rsp,
-                                                     struct rcu_data *rdp)
+                                                     struct rcu_data *rdp,
+                                                     unsigned long flags)
 {
        return 0;
 }
@@ -2380,6 +2427,15 @@ static void __init rcu_boot_init_nocb_percpu_data(struct rcu_data *rdp)
 {
 }
+static bool rcu_nocb_need_deferred_wakeup(struct rcu_data *rdp)
+{
+        return false;
+}
+static void do_nocb_deferred_wakeup(struct rcu_data *rdp)
+{
+}
 static void __init rcu_spawn_nocb_kthreads(struct rcu_state *rsp)
 {
 }
@@ -2829,3 +2885,23 @@ static void rcu_sysidle_init_percpu_data(struct rcu_dynticks *rdtp)
 }
 #endif /* #else #ifdef CONFIG_NO_HZ_FULL_SYSIDLE */
+/*
+ * Is this CPU a NO_HZ_FULL CPU that should ignore RCU so that the
+ * grace-period kthread will do force_quiescent_state() processing?
+ * The idea is to avoid waking up RCU core processing on such a
+ * CPU unless the grace period has extended for too long.
+ *
+ * This code relies on the fact that all NO_HZ_FULL CPUs are also
+ * CONFIG_RCU_NOCB_CPUs.
+ */
+static bool rcu_nohz_full_cpu(struct rcu_state *rsp)
+{
+#ifdef CONFIG_NO_HZ_FULL
+        if (tick_nohz_full_cpu(smp_processor_id()) &&
+            (!rcu_gp_in_progress(rsp) ||
+             ULONG_CMP_LT(jiffies, ACCESS_ONCE(rsp->gp_start) + HZ)))
+                return 1;
+#endif /* #ifdef CONFIG_NO_HZ_FULL */
+        return 0;
+}
diff --git a/kernel/rcu/tree_trace.c b/kernel/rcu/tree_trace.c
index 3596797b7e46..4def475336d4 100644
--- a/kernel/rcu/tree_trace.c
+++ b/kernel/rcu/tree_trace.c
@@ -364,9 +364,10 @@ static void print_one_rcu_pending(struct seq_file *m, struct rcu_data *rdp)
                   rdp->n_rp_report_qs,
                   rdp->n_rp_cb_ready,
                   rdp->n_rp_cpu_needs_gp);
-        seq_printf(m, "gpc=%ld gps=%ld nn=%ld\n",
+        seq_printf(m, "gpc=%ld gps=%ld nn=%ld ndw%ld\n",
                   rdp->n_rp_gp_completed,
                   rdp->n_rp_gp_started,
+                   rdp->n_rp_nocb_defer_wakeup,
                   rdp->n_rp_need_nothing);
 }
diff --git a/kernel/rcu/update.c b/kernel/rcu/update.c
index 6cb3dff89e2b..802365ccd591 100644
--- a/kernel/rcu/update.c
+++ b/kernel/rcu/update.c
@@ -128,6 +128,11 @@ struct lockdep_map rcu_sched_lock_map =
        STATIC_LOCKDEP_MAP_INIT("rcu_read_lock_sched", &rcu_sched_lock_key);
 EXPORT_SYMBOL_GPL(rcu_sched_lock_map);
+static struct lock_class_key rcu_callback_key;
+struct lockdep_map rcu_callback_map =
+        STATIC_LOCKDEP_MAP_INIT("rcu_callback", &rcu_callback_key);
+EXPORT_SYMBOL_GPL(rcu_callback_map);
 int notrace debug_lockdep_rcu_enabled(void)
 {
        return rcu_scheduler_active && debug_locks &&
diff --git a/kernel/sched/Makefile b/kernel/sched/Makefile
index 7b621409cf15..9a95c8c2af2a 100644
--- a/kernel/sched/Makefile
+++ b/kernel/sched/Makefile
@@ -11,9 +11,10 @@ ifneq ($(CONFIG_SCHED_OMIT_FRAME_POINTER),y)
 CFLAGS_core.o := $(PROFILING) -fno-omit-frame-pointer
 endif
-obj-y += core.o proc.o clock.o cputime.o idle_task.o fair.o rt.o stop_task.o
+obj-y += core.o proc.o clock.o cputime.o
+obj-y += idle_task.o fair.o rt.o deadline.o stop_task.o
 obj-y += wait.o completion.o
-obj-$(CONFIG_SMP) += cpupri.o
+obj-$(CONFIG_SMP) += cpupri.o cpudeadline.o
 obj-$(CONFIG_SCHED_AUTOGROUP) += auto_group.o
 obj-$(CONFIG_SCHEDSTATS) += stats.o
 obj-$(CONFIG_SCHED_DEBUG) += debug.o
diff --git a/kernel/sched/clock.c b/kernel/sched/clock.c
index c3ae1446461c..6bd6a6731b21 100644
--- a/kernel/sched/clock.c
+++ b/kernel/sched/clock.c
@@ -26,9 +26,10 @@
 * at 0 on boot (but people really shouldn't rely on that).
 *
 * cpu_clock(i)       -- can be used from any context, including NMI.
- * sched_clock_cpu(i) -- must be used with local IRQs disabled (implied by NMI)
 * local_clock()      -- is cpu_clock() on the current cpu.
 *
+ * sched_clock_cpu(i)
+ *
 * How:
 *
 * The implementation either uses sched_clock() when
@@ -50,15 +51,6 @@
 * Furthermore, explicit sleep and wakeup hooks allow us to account for time
 * that is otherwise invisible (TSC gets stopped).
 *
- *
- * Notes:
- *
- * The !IRQ-safetly of sched_clock() and sched_clock_cpu() comes from things
- * like cpufreq interrupts that can change the base clock (TSC) multiplier
- * and cause funny jumps in time -- although the filtering provided by
- * sched_clock_cpu() should mitigate serious artifacts we cannot rely on it
- * in general since for !CONFIG_HAVE_UNSTABLE_SCHED_CLOCK we fully rely on
- * sched_clock().
 */
 #include <linux/spinlock.h>
 #include <linux/hardirq.h>
@@ -66,6 +58,8 @@
 #include <linux/percpu.h>
 #include <linux/ktime.h>
 #include <linux/sched.h>
+#include <linux/static_key.h>
+#include <linux/workqueue.h>
 /*
 * Scheduler clock - returns current time in nanosec units.
@@ -82,7 +76,37 @@ EXPORT_SYMBOL_GPL(sched_clock);
 __read_mostly int sched_clock_running;
 #ifdef CONFIG_HAVE_UNSTABLE_SCHED_CLOCK
-__read_mostly int sched_clock_stable;
+static struct static_key __sched_clock_stable = STATIC_KEY_INIT;
+int sched_clock_stable(void)
+{
+        if (static_key_false(&__sched_clock_stable))
+                return false;
+        return true;
+}
+void set_sched_clock_stable(void)
+{
+        if (!sched_clock_stable())
+                static_key_slow_dec(&__sched_clock_stable);
+}
+static void __clear_sched_clock_stable(struct work_struct *work)
+{
+        /* XXX worry about clock continuity */
+        if (sched_clock_stable())
+                static_key_slow_inc(&__sched_clock_stable);
+}
+static DECLARE_WORK(sched_clock_work, __clear_sched_clock_stable);
+void clear_sched_clock_stable(void)
+{
+        if (keventd_up())
+                schedule_work(&sched_clock_work);
+        else
+                __clear_sched_clock_stable(&sched_clock_work);
+}
 struct sched_clock_data {
        u64                     tick_raw;
@@ -242,20 +266,20 @@ u64 sched_clock_cpu(int cpu)
        struct sched_clock_data *scd;
        u64 clock;
-        WARN_ON_ONCE(!irqs_disabled());
+        if (sched_clock_stable())
-        if (sched_clock_stable)
                return sched_clock();
        if (unlikely(!sched_clock_running))
                return 0ull;
+        preempt_disable();
        scd = cpu_sdc(cpu);
        if (cpu != smp_processor_id())
                clock = sched_clock_remote(scd);
        else
                clock = sched_clock_local(scd);
+        preempt_enable();
        return clock;
 }
@@ -265,7 +289,7 @@ void sched_clock_tick(void)
        struct sched_clock_data *scd;
        u64 now, now_gtod;
-        if (sched_clock_stable)
+        if (sched_clock_stable())
                return;
        if (unlikely(!sched_clock_running))
@@ -316,14 +340,10 @@ EXPORT_SYMBOL_GPL(sched_clock_idle_wakeup_event);
 */
 u64 cpu_clock(int cpu)
 {
-        u64 clock;
+        if (static_key_false(&__sched_clock_stable))
-        unsigned long flags;
+                return sched_clock_cpu(cpu);
-        local_irq_save(flags);
-        clock = sched_clock_cpu(cpu);
-        local_irq_restore(flags);
-        return clock;
+        return sched_clock();
 }
 /*
@@ -335,14 +355,10 @@ u64 cpu_clock(int cpu)
 */
 u64 local_clock(void)
 {
-        u64 clock;
+        if (static_key_false(&__sched_clock_stable))
-        unsigned long flags;
+                return sched_clock_cpu(raw_smp_processor_id());
-        local_irq_save(flags);
+        return sched_clock();
-        clock = sched_clock_cpu(smp_processor_id());
-        local_irq_restore(flags);
-        return clock;
 }
 #else /* CONFIG_HAVE_UNSTABLE_SCHED_CLOCK */
@@ -362,12 +378,12 @@ u64 sched_clock_cpu(int cpu)
 u64 cpu_clock(int cpu)
 {
-        return sched_clock_cpu(cpu);
+        return sched_clock();
 }
 u64 local_clock(void)
 {
-        return sched_clock_cpu(0);
+        return sched_clock();
 }
 #endif /* CONFIG_HAVE_UNSTABLE_SCHED_CLOCK */
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index a88f4a485c5e..36c951b7eef8 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -296,8 +296,6 @@ __read_mostly int scheduler_running;
 */
 int sysctl_sched_rt_runtime = 950000;
 /*
 * __task_rq_lock - lock the rq @p resides on.
 */
@@ -899,7 +897,9 @@ static inline int normal_prio(struct task_struct *p)
 {
        int prio;
-        if (task_has_rt_policy(p))
+        if (task_has_dl_policy(p))
+                prio = MAX_DL_PRIO-1;
+        else if (task_has_rt_policy(p))
                prio = MAX_RT_PRIO-1 - p->rt_priority;
        else
                prio = __normal_prio(p);
@@ -945,7 +945,7 @@ static inline void check_class_changed(struct rq *rq, struct task_struct *p,
                if (prev_class->switched_from)
                        prev_class->switched_from(rq, p);
                p->sched_class->switched_to(rq, p);
-        } else if (oldprio != p->prio)
+        } else if (oldprio != p->prio || dl_task(p))
                p->sched_class->prio_changed(rq, p, oldprio);
 }
@@ -1499,8 +1499,7 @@ void scheduler_ipi(void)
         * TIF_NEED_RESCHED remotely (for the first time) will also send
         * this IPI.
         */
-        if (tif_need_resched())
+        preempt_fold_need_resched();
-                set_preempt_need_resched();
        if (llist_empty(&this_rq()->wake_list)
                        && !tick_nohz_full_cpu(smp_processor_id())
@@ -1717,6 +1716,13 @@ static void __sched_fork(unsigned long clone_flags, struct task_struct *p)
        memset(&p->se.statistics, 0, sizeof(p->se.statistics));
 #endif
+        RB_CLEAR_NODE(&p->dl.rb_node);
+        hrtimer_init(&p->dl.dl_timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        p->dl.dl_runtime = p->dl.runtime = 0;
+        p->dl.dl_deadline = p->dl.deadline = 0;
+        p->dl.dl_period = 0;
+        p->dl.flags = 0;
        INIT_LIST_HEAD(&p->rt.run_list);
 #ifdef CONFIG_PREEMPT_NOTIFIERS
@@ -1768,7 +1774,7 @@ void set_numabalancing_state(bool enabled)
 /*
 * fork()/clone()-time setup:
 */
-void sched_fork(unsigned long clone_flags, struct task_struct *p)
+int sched_fork(unsigned long clone_flags, struct task_struct *p)
 {
        unsigned long flags;
        int cpu = get_cpu();
@@ -1790,7 +1796,7 @@ void sched_fork(unsigned long clone_flags, struct task_struct *p)
         * Revert to default priority/policy on fork if requested.
         */
        if (unlikely(p->sched_reset_on_fork)) {
-                if (task_has_rt_policy(p)) {
+                if (task_has_dl_policy(p) || task_has_rt_policy(p)) {
                        p->policy = SCHED_NORMAL;
                        p->static_prio = NICE_TO_PRIO(0);
                        p->rt_priority = 0;
@@ -1807,8 +1813,14 @@ void sched_fork(unsigned long clone_flags, struct task_struct *p)
                p->sched_reset_on_fork = 0;
        }
-        if (!rt_prio(p->prio))
+        if (dl_prio(p->prio)) {
+                put_cpu();
+                return -EAGAIN;
+        } else if (rt_prio(p->prio)) {
+                p->sched_class = &rt_sched_class;
+        } else {
                p->sched_class = &fair_sched_class;
+        }
        if (p->sched_class->task_fork)
                p->sched_class->task_fork(p);
@@ -1834,11 +1846,124 @@ void sched_fork(unsigned long clone_flags, struct task_struct *p)
        init_task_preempt_count(p);
 #ifdef CONFIG_SMP
        plist_node_init(&p->pushable_tasks, MAX_PRIO);
+        RB_CLEAR_NODE(&p->pushable_dl_tasks);
 #endif
        put_cpu();
+        return 0;
+}
+unsigned long to_ratio(u64 period, u64 runtime)
+{
+        if (runtime == RUNTIME_INF)
+                return 1ULL << 20;
+        /*
+         * Doing this here saves a lot of checks in all
+         * the calling paths, and returning zero seems
+         * safe for them anyway.
+         */
+        if (period == 0)
+                return 0;
+        return div64_u64(runtime << 20, period);
+}
+#ifdef CONFIG_SMP
+inline struct dl_bw *dl_bw_of(int i)
+{
+        return &cpu_rq(i)->rd->dl_bw;
 }
+static inline int dl_bw_cpus(int i)
+{
+        struct root_domain *rd = cpu_rq(i)->rd;
+        int cpus = 0;
+        for_each_cpu_and(i, rd->span, cpu_active_mask)
+                cpus++;
+        return cpus;
+}
+#else
+inline struct dl_bw *dl_bw_of(int i)
+{
+        return &cpu_rq(i)->dl.dl_bw;
+}
+static inline int dl_bw_cpus(int i)
+{
+        return 1;
+}
+#endif
+static inline
+void __dl_clear(struct dl_bw *dl_b, u64 tsk_bw)
+{
+        dl_b->total_bw -= tsk_bw;
+}
+static inline
+void __dl_add(struct dl_bw *dl_b, u64 tsk_bw)
+{
+        dl_b->total_bw += tsk_bw;
+}
+static inline
+bool __dl_overflow(struct dl_bw *dl_b, int cpus, u64 old_bw, u64 new_bw)
+{
+        return dl_b->bw != -1 &&
+               dl_b->bw * cpus < dl_b->total_bw - old_bw + new_bw;
+}
+/*
+ * We must be sure that accepting a new task (or allowing changing the
+ * parameters of an existing one) is consistent with the bandwidth
+ * constraints. If yes, this function also accordingly updates the currently
+ * allocated bandwidth to reflect the new situation.
+ *
+ * This function is called while holding p's rq->lock.
+ */
+static int dl_overflow(struct task_struct *p, int policy,
+                       const struct sched_attr *attr)
+{
+        struct dl_bw *dl_b = dl_bw_of(task_cpu(p));
+        u64 period = attr->sched_period;
+        u64 runtime = attr->sched_runtime;
+        u64 new_bw = dl_policy(policy) ? to_ratio(period, runtime) : 0;
+        int cpus, err = -1;
+        if (new_bw == p->dl.dl_bw)
+                return 0;
+        /*
+         * Either if a task, enters, leave, or stays -deadline but changes
+         * its parameters, we may need to update accordingly the total
+         * allocated bandwidth of the container.
+         */
+        raw_spin_lock(&dl_b->lock);
+        cpus = dl_bw_cpus(task_cpu(p));
+        if (dl_policy(policy) && !task_has_dl_policy(p) &&
+            !__dl_overflow(dl_b, cpus, 0, new_bw)) {
+                __dl_add(dl_b, new_bw);
+                err = 0;
+        } else if (dl_policy(policy) && task_has_dl_policy(p) &&
+                   !__dl_overflow(dl_b, cpus, p->dl.dl_bw, new_bw)) {
+                __dl_clear(dl_b, p->dl.dl_bw);
+                __dl_add(dl_b, new_bw);
+                err = 0;
+        } else if (!dl_policy(policy) && task_has_dl_policy(p)) {
+                __dl_clear(dl_b, p->dl.dl_bw);
+                err = 0;
+        }
+        raw_spin_unlock(&dl_b->lock);
+        return err;
+}
+extern void init_dl_bw(struct dl_bw *dl_b);
 /*
 * wake_up_new_task - wake up a newly created task for the first time.
 *
@@ -2003,6 +2128,9 @@ static void finish_task_switch(struct rq *rq, struct task_struct *prev)
        if (unlikely(prev_state == TASK_DEAD)) {
                task_numa_free(prev);
+                if (prev->sched_class->task_dead)
+                        prev->sched_class->task_dead(prev);
                /*
                 * Remove function-return probe instances associated with this
                 * task and put them back on the free list.
@@ -2296,7 +2424,7 @@ void scheduler_tick(void)
 #ifdef CONFIG_SMP
        rq->idle_balance = idle_cpu(cpu);
-        trigger_load_balance(rq, cpu);
+        trigger_load_balance(rq);
 #endif
        rq_last_tick_reset(rq);
 }
@@ -2414,10 +2542,10 @@ static inline void schedule_debug(struct task_struct *prev)
 {
        /*
         * Test if we are atomic. Since do_exit() needs to call into
-         * schedule() atomically, we ignore that path for now.
+         * schedule() atomically, we ignore that path. Otherwise whine
-         * Otherwise, whine if we are scheduling when we should not be.
+         * if we are scheduling when we should not.
         */
-        if (unlikely(in_atomic_preempt_off() && !prev->exit_state))
+        if (unlikely(in_atomic_preempt_off() && prev->state != TASK_DEAD))
                __schedule_bug(prev);
        rcu_sleep_check();
@@ -2761,11 +2889,11 @@ EXPORT_SYMBOL(sleep_on_timeout);
 */
 void rt_mutex_setprio(struct task_struct *p, int prio)
 {
-        int oldprio, on_rq, running;
+        int oldprio, on_rq, running, enqueue_flag = 0;
        struct rq *rq;
        const struct sched_class *prev_class;
-        BUG_ON(prio < 0 || prio > MAX_PRIO);
+        BUG_ON(prio > MAX_PRIO);
        rq = __task_rq_lock(p);
@@ -2788,6 +2916,7 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
        }
        trace_sched_pi_setprio(p, prio);
+        p->pi_top_task = rt_mutex_get_top_task(p);
        oldprio = p->prio;
        prev_class = p->sched_class;
        on_rq = p->on_rq;
@@ -2797,23 +2926,49 @@ void rt_mutex_setprio(struct task_struct *p, int prio)
        if (running)
                p->sched_class->put_prev_task(rq, p);
-        if (rt_prio(prio))
+        /*
+         * Boosting condition are:
+         * 1. -rt task is running and holds mutex A
+         *      --> -dl task blocks on mutex A
+         *
+         * 2. -dl task is running and holds mutex A
+         *      --> -dl task blocks on mutex A and could preempt the
+         *          running task
+         */
+        if (dl_prio(prio)) {
+                if (!dl_prio(p->normal_prio) || (p->pi_top_task &&
+                        dl_entity_preempt(&p->pi_top_task->dl, &p->dl))) {
+                        p->dl.dl_boosted = 1;
+                        p->dl.dl_throttled = 0;
+                        enqueue_flag = ENQUEUE_REPLENISH;
+                } else
+                        p->dl.dl_boosted = 0;
+                p->sched_class = &dl_sched_class;
+        } else if (rt_prio(prio)) {
+                if (dl_prio(oldprio))
+                        p->dl.dl_boosted = 0;
+                if (oldprio < prio)
+                        enqueue_flag = ENQUEUE_HEAD;
                p->sched_class = &rt_sched_class;
-        else
+        } else {
+                if (dl_prio(oldprio))
+                        p->dl.dl_boosted = 0;
                p->sched_class = &fair_sched_class;
+        }
        p->prio = prio;
        if (running)
                p->sched_class->set_curr_task(rq);
        if (on_rq)
-                enqueue_task(rq, p, oldprio < prio ? ENQUEUE_HEAD : 0);
+                enqueue_task(rq, p, enqueue_flag);
        check_class_changed(rq, p, prev_class, oldprio);
 out_unlock:
        __task_rq_unlock(rq);
 }
 #endif
 void set_user_nice(struct task_struct *p, long nice)
 {
        int old_prio, delta, on_rq;
@@ -2831,9 +2986,9 @@ void set_user_nice(struct task_struct *p, long nice)
         * The RT priorities are set via sched_setscheduler(), but we still
         * allow the 'normal' nice value to be set - but as expected
         * it wont have any effect on scheduling until the task is
-         * SCHED_FIFO/SCHED_RR:
+         * SCHED_DEADLINE, SCHED_FIFO or SCHED_RR:
         */
-        if (task_has_rt_policy(p)) {
+        if (task_has_dl_policy(p) || task_has_rt_policy(p)) {
                p->static_prio = NICE_TO_PRIO(nice);
                goto out_unlock;
        }
@@ -2988,22 +3143,95 @@ static struct task_struct *find_process_by_pid(pid_t pid)
        return pid ? find_task_by_vpid(pid) : current;
 }
-/* Actually do priority change: must hold rq lock. */
+/*
+ * This function initializes the sched_dl_entity of a newly becoming
+ * SCHED_DEADLINE task.
+ *
+ * Only the static values are considered here, the actual runtime and the
+ * absolute deadline will be properly calculated when the task is enqueued
+ * for the first time with its new policy.
+ */
 static void
-__setscheduler(struct rq *rq, struct task_struct *p, int policy, int prio)
+__setparam_dl(struct task_struct *p, const struct sched_attr *attr)
+{
+        struct sched_dl_entity *dl_se = &p->dl;
+        init_dl_task_timer(dl_se);
+        dl_se->dl_runtime = attr->sched_runtime;
+        dl_se->dl_deadline = attr->sched_deadline;
+        dl_se->dl_period = attr->sched_period ?: dl_se->dl_deadline;
+        dl_se->flags = attr->sched_flags;
+        dl_se->dl_bw = to_ratio(dl_se->dl_period, dl_se->dl_runtime);
+        dl_se->dl_throttled = 0;
+        dl_se->dl_new = 1;
+}
+/* Actually do priority change: must hold pi & rq lock. */
+static void __setscheduler(struct rq *rq, struct task_struct *p,
+                           const struct sched_attr *attr)
 {
+        int policy = attr->sched_policy;
+        if (policy == -1) /* setparam */
+                policy = p->policy;
        p->policy = policy;
-        p->rt_priority = prio;
+        if (dl_policy(policy))
+                __setparam_dl(p, attr);
+        else if (fair_policy(policy))
+                p->static_prio = NICE_TO_PRIO(attr->sched_nice);
+        /*
+         * __sched_setscheduler() ensures attr->sched_priority == 0 when
+         * !rt_policy. Always setting this ensures that things like
+         * getparam()/getattr() don't report silly values for !rt tasks.
+         */
+        p->rt_priority = attr->sched_priority;
        p->normal_prio = normal_prio(p);
-        /* we are holding p->pi_lock already */
        p->prio = rt_mutex_getprio(p);
-        if (rt_prio(p->prio))
+        if (dl_prio(p->prio))
+                p->sched_class = &dl_sched_class;
+        else if (rt_prio(p->prio))
                p->sched_class = &rt_sched_class;
        else
                p->sched_class = &fair_sched_class;
        set_load_weight(p);
 }
+static void
+__getparam_dl(struct task_struct *p, struct sched_attr *attr)
+{
+        struct sched_dl_entity *dl_se = &p->dl;
+        attr->sched_priority = p->rt_priority;
+        attr->sched_runtime = dl_se->dl_runtime;
+        attr->sched_deadline = dl_se->dl_deadline;
+        attr->sched_period = dl_se->dl_period;
+        attr->sched_flags = dl_se->flags;
+}
+/*
+ * This function validates the new parameters of a -deadline task.
+ * We ask for the deadline not being zero, and greater or equal
+ * than the runtime, as well as the period of being zero or
+ * greater than deadline. Furthermore, we have to be sure that
+ * user parameters are above the internal resolution (1us); we
+ * check sched_runtime only since it is always the smaller one.
+ */
+static bool
+__checkparam_dl(const struct sched_attr *attr)
+{
+        return attr && attr->sched_deadline != 0 &&
+                (attr->sched_period == 0 ||
+                (s64)(attr->sched_period   - attr->sched_deadline) >= 0) &&
+                (s64)(attr->sched_deadline - attr->sched_runtime ) >= 0  &&
+                attr->sched_runtime >= (2 << (DL_SCALE - 1));
+}
 /*
 * check the target process has a UID that matches the current process's
 */
@@ -3020,10 +3248,12 @@ static bool check_same_owner(struct task_struct *p)
        return match;
 }
-static int __sched_setscheduler(struct task_struct *p, int policy,
+static int __sched_setscheduler(struct task_struct *p,
-                                const struct sched_param *param, bool user)
+                                const struct sched_attr *attr,
+                                bool user)
 {
        int retval, oldprio, oldpolicy = -1, on_rq, running;
+        int policy = attr->sched_policy;
        unsigned long flags;
        const struct sched_class *prev_class;
        struct rq *rq;
@@ -3037,31 +3267,40 @@ recheck:
                reset_on_fork = p->sched_reset_on_fork;
                policy = oldpolicy = p->policy;
        } else {
-                reset_on_fork = !!(policy & SCHED_RESET_ON_FORK);
+                reset_on_fork = !!(attr->sched_flags & SCHED_FLAG_RESET_ON_FORK);
-                policy &= ~SCHED_RESET_ON_FORK;
-                if (policy != SCHED_FIFO && policy != SCHED_RR &&
+                if (policy != SCHED_DEADLINE &&
+                                policy != SCHED_FIFO && policy != SCHED_RR &&
                                policy != SCHED_NORMAL && policy != SCHED_BATCH &&
                                policy != SCHED_IDLE)
                        return -EINVAL;
        }
+        if (attr->sched_flags & ~(SCHED_FLAG_RESET_ON_FORK))
+                return -EINVAL;
        /*
         * Valid priorities for SCHED_FIFO and SCHED_RR are
         * 1..MAX_USER_RT_PRIO-1, valid priority for SCHED_NORMAL,
         * SCHED_BATCH and SCHED_IDLE is 0.
         */
-        if (param->sched_priority < 0 ||
+        if ((p->mm && attr->sched_priority > MAX_USER_RT_PRIO-1) ||
-            (p->mm && param->sched_priority > MAX_USER_RT_PRIO-1) ||
+            (!p->mm && attr->sched_priority > MAX_RT_PRIO-1))
-            (!p->mm && param->sched_priority > MAX_RT_PRIO-1))
                return -EINVAL;
-        if (rt_policy(policy) != (param->sched_priority != 0))
+        if ((dl_policy(policy) && !__checkparam_dl(attr)) ||
+            (rt_policy(policy) != (attr->sched_priority != 0)))
                return -EINVAL;
        /*
         * Allow unprivileged RT tasks to decrease priority:
         */
        if (user && !capable(CAP_SYS_NICE)) {
+                if (fair_policy(policy)) {
+                        if (attr->sched_nice < TASK_NICE(p) &&
+                            !can_nice(p, attr->sched_nice))
+                                return -EPERM;
+                }
                if (rt_policy(policy)) {
                        unsigned long rlim_rtprio =
                                        task_rlimit(p, RLIMIT_RTPRIO);
@@ -3071,8 +3310,8 @@ recheck:
                                return -EPERM;
                        /* can't increase priority */
-                        if (param->sched_priority > p->rt_priority &&
+                        if (attr->sched_priority > p->rt_priority &&
-                            param->sched_priority > rlim_rtprio)
+                            attr->sched_priority > rlim_rtprio)
                                return -EPERM;
                }
@@ -3120,14 +3359,21 @@ recheck:
        /*
         * If not changing anything there's no need to proceed further:
         */
-        if (unlikely(policy == p->policy && (!rt_policy(policy) ||
+        if (unlikely(policy == p->policy)) {
-                        param->sched_priority == p->rt_priority))) {
+                if (fair_policy(policy) && attr->sched_nice != TASK_NICE(p))
+                        goto change;
+                if (rt_policy(policy) && attr->sched_priority != p->rt_priority)
+                        goto change;
+                if (dl_policy(policy))
+                        goto change;
                task_rq_unlock(rq, p, &flags);
                return 0;
        }
+change:
-#ifdef CONFIG_RT_GROUP_SCHED
        if (user) {
+#ifdef CONFIG_RT_GROUP_SCHED
                /*
                 * Do not allow realtime tasks into groups that have no runtime
                 * assigned.
@@ -3138,8 +3384,24 @@ recheck:
                        task_rq_unlock(rq, p, &flags);
                        return -EPERM;
                }
-        }
 #endif
+#ifdef CONFIG_SMP
+                if (dl_bandwidth_enabled() && dl_policy(policy)) {
+                        cpumask_t *span = rq->rd->span;
+                        /*
+                         * Don't allow tasks with an affinity mask smaller than
+                         * the entire root_domain to become SCHED_DEADLINE. We
+                         * will also fail if there's no bandwidth available.
+                         */
+                        if (!cpumask_subset(span, &p->cpus_allowed) ||
+                            rq->rd->dl_bw.bw == 0) {
+                                task_rq_unlock(rq, p, &flags);
+                                return -EPERM;
+                        }
+                }
+#endif
+        }
        /* recheck policy now with rq lock held */
        if (unlikely(oldpolicy != -1 && oldpolicy != p->policy)) {
@@ -3147,6 +3409,17 @@ recheck:
                task_rq_unlock(rq, p, &flags);
                goto recheck;
        }
+        /*
+         * If setscheduling to SCHED_DEADLINE (or changing the parameters
+         * of a SCHED_DEADLINE task) we need to check if enough bandwidth
+         * is available.
+         */
+        if ((dl_policy(policy) || dl_task(p)) && dl_overflow(p, policy, attr)) {
+                task_rq_unlock(rq, p, &flags);
+                return -EBUSY;
+        }
        on_rq = p->on_rq;
        running = task_current(rq, p);
        if (on_rq)
@@ -3158,7 +3431,7 @@ recheck:
        oldprio = p->prio;
        prev_class = p->sched_class;
-        __setscheduler(rq, p, policy, param->sched_priority);
+        __setscheduler(rq, p, attr);
        if (running)
                p->sched_class->set_curr_task(rq);
@@ -3173,6 +3446,26 @@ recheck:
        return 0;
 }
+static int _sched_setscheduler(struct task_struct *p, int policy,
+                               const struct sched_param *param, bool check)
+{
+        struct sched_attr attr = {
+                .sched_policy   = policy,
+                .sched_priority = param->sched_priority,
+                .sched_nice     = PRIO_TO_NICE(p->static_prio),
+        };
+        /*
+         * Fixup the legacy SCHED_RESET_ON_FORK hack
+         */
+        if (policy & SCHED_RESET_ON_FORK) {
+                attr.sched_flags |= SCHED_FLAG_RESET_ON_FORK;
+                policy &= ~SCHED_RESET_ON_FORK;
+                attr.sched_policy = policy;
+        }
+        return __sched_setscheduler(p, &attr, check);
+}
 /**
 * sched_setscheduler - change the scheduling policy and/or RT priority of a thread.
 * @p: the task in question.
@@ -3186,10 +3479,16 @@ recheck:
 int sched_setscheduler(struct task_struct *p, int policy,
                       const struct sched_param *param)
 {
-        return __sched_setscheduler(p, policy, param, true);
+        return _sched_setscheduler(p, policy, param, true);
 }
 EXPORT_SYMBOL_GPL(sched_setscheduler);
+int sched_setattr(struct task_struct *p, const struct sched_attr *attr)
+{
+        return __sched_setscheduler(p, attr, true);
+}
+EXPORT_SYMBOL_GPL(sched_setattr);
 /**
 * sched_setscheduler_nocheck - change the scheduling policy and/or RT priority of a thread from kernelspace.
 * @p: the task in question.
@@ -3206,7 +3505,7 @@ EXPORT_SYMBOL_GPL(sched_setscheduler);
 int sched_setscheduler_nocheck(struct task_struct *p, int policy,
                               const struct sched_param *param)
 {
-        return __sched_setscheduler(p, policy, param, false);
+        return _sched_setscheduler(p, policy, param, false);
 }
 static int
@@ -3231,6 +3530,79 @@ do_sched_setscheduler(pid_t pid, int policy, struct sched_param __user *param)
        return retval;
 }
+/*
+ * Mimics kernel/events/core.c perf_copy_attr().
+ */
+static int sched_copy_attr(struct sched_attr __user *uattr,
+                           struct sched_attr *attr)
+{
+        u32 size;
+        int ret;
+        if (!access_ok(VERIFY_WRITE, uattr, SCHED_ATTR_SIZE_VER0))
+                return -EFAULT;
+        /*
+         * zero the full structure, so that a short copy will be nice.
+         */
+        memset(attr, 0, sizeof(*attr));
+        ret = get_user(size, &uattr->size);
+        if (ret)
+                return ret;
+        if (size > PAGE_SIZE)   /* silly large */
+                goto err_size;
+        if (!size)              /* abi compat */
+                size = SCHED_ATTR_SIZE_VER0;
+        if (size < SCHED_ATTR_SIZE_VER0)
+                goto err_size;
+        /*
+         * If we're handed a bigger struct than we know of,
+         * ensure all the unknown bits are 0 - i.e. new
+         * user-space does not rely on any kernel feature
+         * extensions we dont know about yet.
+         */
+        if (size > sizeof(*attr)) {
+                unsigned char __user *addr;
+                unsigned char __user *end;
+                unsigned char val;
+                addr = (void __user *)uattr + sizeof(*attr);
+                end  = (void __user *)uattr + size;
+                for (; addr < end; addr++) {
+                        ret = get_user(val, addr);
+                        if (ret)
+                                return ret;
+                        if (val)
+                                goto err_size;
+                }
+                size = sizeof(*attr);
+        }
+        ret = copy_from_user(attr, uattr, size);
+        if (ret)
+                return -EFAULT;
+        /*
+         * XXX: do we want to be lenient like existing syscalls; or do we want
+         * to be strict and return an error on out-of-bounds values?
+         */
+        attr->sched_nice = clamp(attr->sched_nice, -20, 19);
+out:
+        return ret;
+err_size:
+        put_user(sizeof(*attr), &uattr->size);
+        ret = -E2BIG;
+        goto out;
+}
 /**
 * sys_sched_setscheduler - set/change the scheduler policy and RT priority
 * @pid: the pid in question.
@@ -3262,6 +3634,33 @@ SYSCALL_DEFINE2(sched_setparam, pid_t, pid, struct sched_param __user *, param)
 }
 /**
+ * sys_sched_setattr - same as above, but with extended sched_attr
+ * @pid: the pid in question.
+ * @uattr: structure containing the extended parameters.
+ */
+SYSCALL_DEFINE2(sched_setattr, pid_t, pid, struct sched_attr __user *, uattr)
+{
+        struct sched_attr attr;
+        struct task_struct *p;
+        int retval;
+        if (!uattr || pid < 0)
+                return -EINVAL;
+        if (sched_copy_attr(uattr, &attr))
+                return -EFAULT;
+        rcu_read_lock();
+        retval = -ESRCH;
+        p = find_process_by_pid(pid);
+        if (p != NULL)
+                retval = sched_setattr(p, &attr);
+        rcu_read_unlock();
+        return retval;
+}
+/**
 * sys_sched_getscheduler - get the policy (scheduling class) of a thread
 * @pid: the pid in question.
 *
@@ -3316,6 +3715,10 @@ SYSCALL_DEFINE2(sched_getparam, pid_t, pid, struct sched_param __user *, param)
        if (retval)
                goto out_unlock;
+        if (task_has_dl_policy(p)) {
+                retval = -EINVAL;
+                goto out_unlock;
+        }
        lp.sched_priority = p->rt_priority;
        rcu_read_unlock();
@@ -3331,6 +3734,96 @@ out_unlock:
        return retval;
 }
+static int sched_read_attr(struct sched_attr __user *uattr,
+                           struct sched_attr *attr,
+                           unsigned int usize)
+{
+        int ret;
+        if (!access_ok(VERIFY_WRITE, uattr, usize))
+                return -EFAULT;
+        /*
+         * If we're handed a smaller struct than we know of,
+         * ensure all the unknown bits are 0 - i.e. old
+         * user-space does not get uncomplete information.
+         */
+        if (usize < sizeof(*attr)) {
+                unsigned char *addr;
+                unsigned char *end;
+                addr = (void *)attr + usize;
+                end  = (void *)attr + sizeof(*attr);
+                for (; addr < end; addr++) {
+                        if (*addr)
+                                goto err_size;
+                }
+                attr->size = usize;
+        }
+        ret = copy_to_user(uattr, attr, usize);
+        if (ret)
+                return -EFAULT;
+out:
+        return ret;
+err_size:
+        ret = -E2BIG;
+        goto out;
+}
+/**
+ * sys_sched_getattr - similar to sched_getparam, but with sched_attr
+ * @pid: the pid in question.
+ * @uattr: structure containing the extended parameters.
+ * @size: sizeof(attr) for fwd/bwd comp.
+ */
+SYSCALL_DEFINE3(sched_getattr, pid_t, pid, struct sched_attr __user *, uattr,
+                unsigned int, size)
+{
+        struct sched_attr attr = {
+                .size = sizeof(struct sched_attr),
+        };
+        struct task_struct *p;
+        int retval;
+        if (!uattr || pid < 0 || size > PAGE_SIZE ||
+            size < SCHED_ATTR_SIZE_VER0)
+                return -EINVAL;
+        rcu_read_lock();
+        p = find_process_by_pid(pid);
+        retval = -ESRCH;
+        if (!p)
+                goto out_unlock;
+        retval = security_task_getscheduler(p);
+        if (retval)
+                goto out_unlock;
+        attr.sched_policy = p->policy;
+        if (p->sched_reset_on_fork)
+                attr.sched_flags |= SCHED_FLAG_RESET_ON_FORK;
+        if (task_has_dl_policy(p))
+                __getparam_dl(p, &attr);
+        else if (task_has_rt_policy(p))
+                attr.sched_priority = p->rt_priority;
+        else
+                attr.sched_nice = TASK_NICE(p);
+        rcu_read_unlock();
+        retval = sched_read_attr(uattr, &attr, size);
+        return retval;
+out_unlock:
+        rcu_read_unlock();
+        return retval;
+}
 long sched_setaffinity(pid_t pid, const struct cpumask *in_mask)
 {
        cpumask_var_t cpus_allowed, new_mask;
@@ -3375,8 +3868,26 @@ long sched_setaffinity(pid_t pid, const struct cpumask *in_mask)
        if (retval)
                goto out_unlock;
        cpuset_cpus_allowed(p, cpus_allowed);
        cpumask_and(new_mask, in_mask, cpus_allowed);
+        /*
+         * Since bandwidth control happens on root_domain basis,
+         * if admission test is enabled, we only admit -deadline
+         * tasks allowed to run on all the CPUs in the task's
+         * root_domain.
+         */
+#ifdef CONFIG_SMP
+        if (task_has_dl_policy(p)) {
+                const struct cpumask *span = task_rq(p)->rd->span;
+                if (dl_bandwidth_enabled() && !cpumask_subset(span, new_mask)) {
+                        retval = -EBUSY;
+                        goto out_unlock;
+                }
+        }
+#endif
 again:
        retval = set_cpus_allowed_ptr(p, new_mask);
@@ -3653,7 +4164,7 @@ again:
        }
        double_rq_lock(rq, p_rq);
-        while (task_rq(p) != p_rq) {
+        if (task_rq(p) != p_rq) {
                double_rq_unlock(rq, p_rq);
                goto again;
        }
@@ -3742,6 +4253,7 @@ SYSCALL_DEFINE1(sched_get_priority_max, int, policy)
        case SCHED_RR:
                ret = MAX_USER_RT_PRIO-1;
                break;
+        case SCHED_DEADLINE:
        case SCHED_NORMAL:
        case SCHED_BATCH:
        case SCHED_IDLE:
@@ -3768,6 +4280,7 @@ SYSCALL_DEFINE1(sched_get_priority_min, int, policy)
        case SCHED_RR:
                ret = 1;
                break;
+        case SCHED_DEADLINE:
        case SCHED_NORMAL:
        case SCHED_BATCH:
        case SCHED_IDLE:
@@ -4514,13 +5027,31 @@ static int sched_cpu_active(struct notifier_block *nfb,
 static int sched_cpu_inactive(struct notifier_block *nfb,
                                        unsigned long action, void *hcpu)
 {
+        unsigned long flags;
+        long cpu = (long)hcpu;
        switch (action & ~CPU_TASKS_FROZEN) {
        case CPU_DOWN_PREPARE:
-                set_cpu_active((long)hcpu, false);
+                set_cpu_active(cpu, false);
+                /* explicitly allow suspend */
+                if (!(action & CPU_TASKS_FROZEN)) {
+                        struct dl_bw *dl_b = dl_bw_of(cpu);
+                        bool overflow;
+                        int cpus;
+                        raw_spin_lock_irqsave(&dl_b->lock, flags);
+                        cpus = dl_bw_cpus(cpu);
+                        overflow = __dl_overflow(dl_b, cpus, 0, 0);
+                        raw_spin_unlock_irqrestore(&dl_b->lock, flags);
+                        if (overflow)
+                                return notifier_from_errno(-EBUSY);
+                }
                return NOTIFY_OK;
-        default:
-                return NOTIFY_DONE;
        }
+        return NOTIFY_DONE;
 }
 static int __init migration_init(void)
@@ -4739,6 +5270,8 @@ static void free_rootdomain(struct rcu_head *rcu)
        struct root_domain *rd = container_of(rcu, struct root_domain, rcu);
        cpupri_cleanup(&rd->cpupri);
+        cpudl_cleanup(&rd->cpudl);
+        free_cpumask_var(rd->dlo_mask);
        free_cpumask_var(rd->rto_mask);
        free_cpumask_var(rd->online);
        free_cpumask_var(rd->span);
@@ -4790,8 +5323,14 @@ static int init_rootdomain(struct root_domain *rd)
                goto out;
        if (!alloc_cpumask_var(&rd->online, GFP_KERNEL))
                goto free_span;
-        if (!alloc_cpumask_var(&rd->rto_mask, GFP_KERNEL))
+        if (!alloc_cpumask_var(&rd->dlo_mask, GFP_KERNEL))
                goto free_online;
+        if (!alloc_cpumask_var(&rd->rto_mask, GFP_KERNEL))
+                goto free_dlo_mask;
+        init_dl_bw(&rd->dl_bw);
+        if (cpudl_init(&rd->cpudl) != 0)
+                goto free_dlo_mask;
        if (cpupri_init(&rd->cpupri) != 0)
                goto free_rto_mask;
@@ -4799,6 +5338,8 @@ static int init_rootdomain(struct root_domain *rd)
 free_rto_mask:
        free_cpumask_var(rd->rto_mask);
+free_dlo_mask:
+        free_cpumask_var(rd->dlo_mask);
 free_online:
        free_cpumask_var(rd->online);
 free_span:
@@ -6150,6 +6691,7 @@ void __init sched_init_smp(void)
        free_cpumask_var(non_isolated_cpus);
        init_sched_rt_class();
+        init_sched_dl_class();
 }
 #else
 void __init sched_init_smp(void)
@@ -6219,13 +6761,15 @@ void __init sched_init(void)
 #endif /* CONFIG_CPUMASK_OFFSTACK */
        }
+        init_rt_bandwidth(&def_rt_bandwidth,
+                        global_rt_period(), global_rt_runtime());
+        init_dl_bandwidth(&def_dl_bandwidth,
+                        global_rt_period(), global_rt_runtime());
 #ifdef CONFIG_SMP
        init_defrootdomain();
 #endif
-        init_rt_bandwidth(&def_rt_bandwidth,
-                        global_rt_period(), global_rt_runtime());
 #ifdef CONFIG_RT_GROUP_SCHED
        init_rt_bandwidth(&root_task_group.rt_bandwidth,
                        global_rt_period(), global_rt_runtime());
@@ -6249,6 +6793,7 @@ void __init sched_init(void)
                rq->calc_load_update = jiffies + LOAD_FREQ;
                init_cfs_rq(&rq->cfs);
                init_rt_rq(&rq->rt, rq);
+                init_dl_rq(&rq->dl, rq);
 #ifdef CONFIG_FAIR_GROUP_SCHED
                root_task_group.shares = ROOT_TASK_GROUP_LOAD;
                INIT_LIST_HEAD(&rq->leaf_cfs_rq_list);
@@ -6320,10 +6865,6 @@ void __init sched_init(void)
        INIT_HLIST_HEAD(&init_task.preempt_notifiers);
 #endif
-#ifdef CONFIG_RT_MUTEXES
-        plist_head_init(&init_task.pi_waiters);
-#endif
        /*
         * The boot idle thread does lazy MMU switching as well:
         */
@@ -6397,13 +6938,16 @@ EXPORT_SYMBOL(__might_sleep);
 static void normalize_task(struct rq *rq, struct task_struct *p)
 {
        const struct sched_class *prev_class = p->sched_class;
+        struct sched_attr attr = {
+                .sched_policy = SCHED_NORMAL,
+        };
        int old_prio = p->prio;
        int on_rq;
        on_rq = p->on_rq;
        if (on_rq)
                dequeue_task(rq, p, 0);
-        __setscheduler(rq, p, SCHED_NORMAL, 0);
+        __setscheduler(rq, p, &attr);
        if (on_rq) {
                enqueue_task(rq, p, 0);
                resched_task(rq->curr);
@@ -6433,7 +6977,7 @@ void normalize_rt_tasks(void)
                p->se.statistics.block_start    = 0;
 #endif
-                if (!rt_task(p)) {
+                if (!dl_task(p) && !rt_task(p)) {
                        /*
                         * Renice negative nice level userspace
                         * tasks back to 0:
@@ -6628,16 +7172,6 @@ void sched_move_task(struct task_struct *tsk)
 }
 #endif /* CONFIG_CGROUP_SCHED */
-#if defined(CONFIG_RT_GROUP_SCHED) || defined(CONFIG_CFS_BANDWIDTH)
-static unsigned long to_ratio(u64 period, u64 runtime)
-{
-        if (runtime == RUNTIME_INF)
-                return 1ULL << 20;
-        return div64_u64(runtime << 20, period);
-}
-#endif
 #ifdef CONFIG_RT_GROUP_SCHED
 /*
 * Ensure that the real time constraints are schedulable.
@@ -6811,24 +7345,13 @@ static long sched_group_rt_period(struct task_group *tg)
        do_div(rt_period_us, NSEC_PER_USEC);
        return rt_period_us;
 }
+#endif /* CONFIG_RT_GROUP_SCHED */
+#ifdef CONFIG_RT_GROUP_SCHED
 static int sched_rt_global_constraints(void)
 {
-        u64 runtime, period;
        int ret = 0;
-        if (sysctl_sched_rt_period <= 0)
-                return -EINVAL;
-        runtime = global_rt_runtime();
-        period = global_rt_period();
-        /*
-         * Sanity check on the sysctl variables.
-         */
-        if (runtime > period && runtime != RUNTIME_INF)
-                return -EINVAL;
        mutex_lock(&rt_constraints_mutex);
        read_lock(&tasklist_lock);
        ret = __rt_schedulable(NULL, 0, 0);
@@ -6851,17 +7374,7 @@ static int sched_rt_can_attach(struct task_group *tg, struct task_struct *tsk)
 static int sched_rt_global_constraints(void)
 {
        unsigned long flags;
-        int i;
+        int i, ret = 0;
-        if (sysctl_sched_rt_period <= 0)
-                return -EINVAL;
-        /*
-         * There's always some RT tasks in the root group
-         * -- migration, kstopmachine etc..
-         */
-        if (sysctl_sched_rt_runtime == 0)
-                return -EBUSY;
        raw_spin_lock_irqsave(&def_rt_bandwidth.rt_runtime_lock, flags);
        for_each_possible_cpu(i) {
@@ -6873,36 +7386,88 @@ static int sched_rt_global_constraints(void)
        }
        raw_spin_unlock_irqrestore(&def_rt_bandwidth.rt_runtime_lock, flags);
-        return 0;
+        return ret;
 }
 #endif /* CONFIG_RT_GROUP_SCHED */
-int sched_rr_handler(struct ctl_table *table, int write,
+static int sched_dl_global_constraints(void)
-                void __user *buffer, size_t *lenp,
-                loff_t *ppos)
 {
-        int ret;
+        u64 runtime = global_rt_runtime();
-        static DEFINE_MUTEX(mutex);
+        u64 period = global_rt_period();
+        u64 new_bw = to_ratio(period, runtime);
+        int cpu, ret = 0;
-        mutex_lock(&mutex);
+        /*
-        ret = proc_dointvec(table, write, buffer, lenp, ppos);
+         * Here we want to check the bandwidth not being set to some
-        /* make sure that internally we keep jiffies */
+         * value smaller than the currently allocated bandwidth in
-        /* also, writing zero resets timeslice to default */
+         * any of the root_domains.
-        if (!ret && write) {
+         *
-                sched_rr_timeslice = sched_rr_timeslice <= 0 ?
+         * FIXME: Cycling on all the CPUs is overdoing, but simpler than
-                        RR_TIMESLICE : msecs_to_jiffies(sched_rr_timeslice);
+         * cycling on root_domains... Discussion on different/better
+         * solutions is welcome!
+         */
+        for_each_possible_cpu(cpu) {
+                struct dl_bw *dl_b = dl_bw_of(cpu);
+                raw_spin_lock(&dl_b->lock);
+                if (new_bw < dl_b->total_bw)
+                        ret = -EBUSY;
+                raw_spin_unlock(&dl_b->lock);
+                if (ret)
+                        break;
        }
-        mutex_unlock(&mutex);
        return ret;
 }
+static void sched_dl_do_global(void)
+{
+        u64 new_bw = -1;
+        int cpu;
+        def_dl_bandwidth.dl_period = global_rt_period();
+        def_dl_bandwidth.dl_runtime = global_rt_runtime();
+        if (global_rt_runtime() != RUNTIME_INF)
+                new_bw = to_ratio(global_rt_period(), global_rt_runtime());
+        /*
+         * FIXME: As above...
+         */
+        for_each_possible_cpu(cpu) {
+                struct dl_bw *dl_b = dl_bw_of(cpu);
+                raw_spin_lock(&dl_b->lock);
+                dl_b->bw = new_bw;
+                raw_spin_unlock(&dl_b->lock);
+        }
+}
+static int sched_rt_global_validate(void)
+{
+        if (sysctl_sched_rt_period <= 0)
+                return -EINVAL;
+        if (sysctl_sched_rt_runtime > sysctl_sched_rt_period)
+                return -EINVAL;
+        return 0;
+}
+static void sched_rt_do_global(void)
+{
+        def_rt_bandwidth.rt_runtime = global_rt_runtime();
+        def_rt_bandwidth.rt_period = ns_to_ktime(global_rt_period());
+}
 int sched_rt_handler(struct ctl_table *table, int write,
                void __user *buffer, size_t *lenp,
                loff_t *ppos)
 {
-        int ret;
        int old_period, old_runtime;
        static DEFINE_MUTEX(mutex);
+        int ret;
        mutex_lock(&mutex);
        old_period = sysctl_sched_rt_period;
@@ -6911,21 +7476,50 @@ int sched_rt_handler(struct ctl_table *table, int write,
        ret = proc_dointvec(table, write, buffer, lenp, ppos);
        if (!ret && write) {
+                ret = sched_rt_global_validate();
+                if (ret)
+                        goto undo;
                ret = sched_rt_global_constraints();
-                if (ret) {
+                if (ret)
-                        sysctl_sched_rt_period = old_period;
+                        goto undo;
-                        sysctl_sched_rt_runtime = old_runtime;
-                } else {
+                ret = sched_dl_global_constraints();
-                        def_rt_bandwidth.rt_runtime = global_rt_runtime();
+                if (ret)
-                        def_rt_bandwidth.rt_period =
+                        goto undo;
-                                ns_to_ktime(global_rt_period());
-                }
+                sched_rt_do_global();
+                sched_dl_do_global();
+        }
+        if (0) {
+undo:
+                sysctl_sched_rt_period = old_period;
+                sysctl_sched_rt_runtime = old_runtime;
        }
        mutex_unlock(&mutex);
        return ret;
 }
+int sched_rr_handler(struct ctl_table *table, int write,
+                void __user *buffer, size_t *lenp,
+                loff_t *ppos)
+{
+        int ret;
+        static DEFINE_MUTEX(mutex);
+        mutex_lock(&mutex);
+        ret = proc_dointvec(table, write, buffer, lenp, ppos);
+        /* make sure that internally we keep jiffies */
+        /* also, writing zero resets timeslice to default */
+        if (!ret && write) {
+                sched_rr_timeslice = sched_rr_timeslice <= 0 ?
+                        RR_TIMESLICE : msecs_to_jiffies(sched_rr_timeslice);
+        }
+        mutex_unlock(&mutex);
+        return ret;
+}
 #ifdef CONFIG_CGROUP_SCHED
 static inline struct task_group *css_tg(struct cgroup_subsys_state *css)
diff --git a/kernel/sched/cpudeadline.c b/kernel/sched/cpudeadline.c
new file mode 100644
index 000000000000..045fc74e3f09
--- /dev/null
+++ b/kernel/sched/cpudeadline.c
@@ -0,0 +1,216 @@
+/*
+ *  kernel/sched/cpudl.c
+ *
+ *  Global CPU deadline management
+ *
+ *  Author: Juri Lelli <j.lelli@sssup.it>
+ *
+ *  This program is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU General Public License
+ *  as published by the Free Software Foundation; version 2
+ *  of the License.
+ */
+#include <linux/gfp.h>
+#include <linux/kernel.h>
+#include "cpudeadline.h"
+static inline int parent(int i)
+{
+        return (i - 1) >> 1;
+}
+static inline int left_child(int i)
+{
+        return (i << 1) + 1;
+}
+static inline int right_child(int i)
+{
+        return (i << 1) + 2;
+}
+static inline int dl_time_before(u64 a, u64 b)
+{
+        return (s64)(a - b) < 0;
+}
+static void cpudl_exchange(struct cpudl *cp, int a, int b)
+{
+        int cpu_a = cp->elements[a].cpu, cpu_b = cp->elements[b].cpu;
+        swap(cp->elements[a], cp->elements[b]);
+        swap(cp->cpu_to_idx[cpu_a], cp->cpu_to_idx[cpu_b]);
+}
+static void cpudl_heapify(struct cpudl *cp, int idx)
+{
+        int l, r, largest;
+        /* adapted from lib/prio_heap.c */
+        while(1) {
+                l = left_child(idx);
+                r = right_child(idx);
+                largest = idx;
+                if ((l < cp->size) && dl_time_before(cp->elements[idx].dl,
+                                                        cp->elements[l].dl))
+                        largest = l;
+                if ((r < cp->size) && dl_time_before(cp->elements[largest].dl,
+                                                        cp->elements[r].dl))
+                        largest = r;
+                if (largest == idx)
+                        break;
+                /* Push idx down the heap one level and bump one up */
+                cpudl_exchange(cp, largest, idx);
+                idx = largest;
+        }
+}
+static void cpudl_change_key(struct cpudl *cp, int idx, u64 new_dl)
+{
+        WARN_ON(idx > num_present_cpus() || idx == IDX_INVALID);
+        if (dl_time_before(new_dl, cp->elements[idx].dl)) {
+                cp->elements[idx].dl = new_dl;
+                cpudl_heapify(cp, idx);
+        } else {
+                cp->elements[idx].dl = new_dl;
+                while (idx > 0 && dl_time_before(cp->elements[parent(idx)].dl,
+                                        cp->elements[idx].dl)) {
+                        cpudl_exchange(cp, idx, parent(idx));
+                        idx = parent(idx);
+                }
+        }
+}
+static inline int cpudl_maximum(struct cpudl *cp)
+{
+        return cp->elements[0].cpu;
+}
+/*
+ * cpudl_find - find the best (later-dl) CPU in the system
+ * @cp: the cpudl max-heap context
+ * @p: the task
+ * @later_mask: a mask to fill in with the selected CPUs (or NULL)
+ *
+ * Returns: int - best CPU (heap maximum if suitable)
+ */
+int cpudl_find(struct cpudl *cp, struct task_struct *p,
+               struct cpumask *later_mask)
+{
+        int best_cpu = -1;
+        const struct sched_dl_entity *dl_se = &p->dl;
+        if (later_mask && cpumask_and(later_mask, cp->free_cpus,
+                        &p->cpus_allowed) && cpumask_and(later_mask,
+                        later_mask, cpu_active_mask)) {
+                best_cpu = cpumask_any(later_mask);
+                goto out;
+        } else if (cpumask_test_cpu(cpudl_maximum(cp), &p->cpus_allowed) &&
+                        dl_time_before(dl_se->deadline, cp->elements[0].dl)) {
+                best_cpu = cpudl_maximum(cp);
+                if (later_mask)
+                        cpumask_set_cpu(best_cpu, later_mask);
+        }
+out:
+        WARN_ON(best_cpu > num_present_cpus() && best_cpu != -1);
+        return best_cpu;
+}
+/*
+ * cpudl_set - update the cpudl max-heap
+ * @cp: the cpudl max-heap context
+ * @cpu: the target cpu
+ * @dl: the new earliest deadline for this cpu
+ *
+ * Notes: assumes cpu_rq(cpu)->lock is locked
+ *
+ * Returns: (void)
+ */
+void cpudl_set(struct cpudl *cp, int cpu, u64 dl, int is_valid)
+{
+        int old_idx, new_cpu;
+        unsigned long flags;
+        WARN_ON(cpu > num_present_cpus());
+        raw_spin_lock_irqsave(&cp->lock, flags);
+        old_idx = cp->cpu_to_idx[cpu];
+        if (!is_valid) {
+                /* remove item */
+                if (old_idx == IDX_INVALID) {
+                        /*
+                         * Nothing to remove if old_idx was invalid.
+                         * This could happen if a rq_offline_dl is
+                         * called for a CPU without -dl tasks running.
+                         */
+                        goto out;
+                }
+                new_cpu = cp->elements[cp->size - 1].cpu;
+                cp->elements[old_idx].dl = cp->elements[cp->size - 1].dl;
+                cp->elements[old_idx].cpu = new_cpu;
+                cp->size--;
+                cp->cpu_to_idx[new_cpu] = old_idx;
+                cp->cpu_to_idx[cpu] = IDX_INVALID;
+                while (old_idx > 0 && dl_time_before(
+                                cp->elements[parent(old_idx)].dl,
+                                cp->elements[old_idx].dl)) {
+                        cpudl_exchange(cp, old_idx, parent(old_idx));
+                        old_idx = parent(old_idx);
+                }
+                cpumask_set_cpu(cpu, cp->free_cpus);
+                cpudl_heapify(cp, old_idx);
+                goto out;
+        }
+        if (old_idx == IDX_INVALID) {
+                cp->size++;
+                cp->elements[cp->size - 1].dl = 0;
+                cp->elements[cp->size - 1].cpu = cpu;
+                cp->cpu_to_idx[cpu] = cp->size - 1;
+                cpudl_change_key(cp, cp->size - 1, dl);
+                cpumask_clear_cpu(cpu, cp->free_cpus);
+        } else {
+                cpudl_change_key(cp, old_idx, dl);
+        }
+out:
+        raw_spin_unlock_irqrestore(&cp->lock, flags);
+}
+/*
+ * cpudl_init - initialize the cpudl structure
+ * @cp: the cpudl max-heap context
+ */
+int cpudl_init(struct cpudl *cp)
+{
+        int i;
+        memset(cp, 0, sizeof(*cp));
+        raw_spin_lock_init(&cp->lock);
+        cp->size = 0;
+        for (i = 0; i < NR_CPUS; i++)
+                cp->cpu_to_idx[i] = IDX_INVALID;
+        if (!alloc_cpumask_var(&cp->free_cpus, GFP_KERNEL))
+                return -ENOMEM;
+        cpumask_setall(cp->free_cpus);
+        return 0;
+}
+/*
+ * cpudl_cleanup - clean up the cpudl structure
+ * @cp: the cpudl max-heap context
+ */
+void cpudl_cleanup(struct cpudl *cp)
+{
+        /*
+         * nothing to do for the moment
+         */
+}
diff --git a/kernel/sched/cpudeadline.h b/kernel/sched/cpudeadline.h
new file mode 100644
index 000000000000..a202789a412c
--- /dev/null
+++ b/kernel/sched/cpudeadline.h
@@ -0,0 +1,33 @@
+#ifndef _LINUX_CPUDL_H
+#define _LINUX_CPUDL_H
+#include <linux/sched.h>
+#define IDX_INVALID     -1
+struct array_item {
+        u64 dl;
+        int cpu;
+};
+struct cpudl {
+        raw_spinlock_t lock;
+        int size;
+        int cpu_to_idx[NR_CPUS];
+        struct array_item elements[NR_CPUS];
+        cpumask_var_t free_cpus;
+};
+#ifdef CONFIG_SMP
+int cpudl_find(struct cpudl *cp, struct task_struct *p,
+               struct cpumask *later_mask);
+void cpudl_set(struct cpudl *cp, int cpu, u64 dl, int is_valid);
+int cpudl_init(struct cpudl *cp);
+void cpudl_cleanup(struct cpudl *cp);
+#else
+#define cpudl_set(cp, cpu, dl) do { } while (0)
+#define cpudl_init() do { } while (0)
+#endif /* CONFIG_SMP */
+#endif /* _LINUX_CPUDL_H */
diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c
new file mode 100644
index 000000000000..0de248202879
--- /dev/null
+++ b/kernel/sched/deadline.c
@@ -0,0 +1,1640 @@
+/*
+ * Deadline Scheduling Class (SCHED_DEADLINE)
+ *
+ * Earliest Deadline First (EDF) + Constant Bandwidth Server (CBS).
+ *
+ * Tasks that periodically executes their instances for less than their
+ * runtime won't miss any of their deadlines.
+ * Tasks that are not periodic or sporadic or that tries to execute more
+ * than their reserved bandwidth will be slowed down (and may potentially
+ * miss some of their deadlines), and won't affect any other task.
+ *
+ * Copyright (C) 2012 Dario Faggioli <raistlin@linux.it>,
+ *                    Juri Lelli <juri.lelli@gmail.com>,
+ *                    Michael Trimarchi <michael@amarulasolutions.com>,
+ *                    Fabio Checconi <fchecconi@gmail.com>
+ */
+#include "sched.h"
+#include <linux/slab.h>
+struct dl_bandwidth def_dl_bandwidth;
+static inline struct task_struct *dl_task_of(struct sched_dl_entity *dl_se)
+{
+        return container_of(dl_se, struct task_struct, dl);
+}
+static inline struct rq *rq_of_dl_rq(struct dl_rq *dl_rq)
+{
+        return container_of(dl_rq, struct rq, dl);
+}
+static inline struct dl_rq *dl_rq_of_se(struct sched_dl_entity *dl_se)
+{
+        struct task_struct *p = dl_task_of(dl_se);
+        struct rq *rq = task_rq(p);
+        return &rq->dl;
+}
+static inline int on_dl_rq(struct sched_dl_entity *dl_se)
+{
+        return !RB_EMPTY_NODE(&dl_se->rb_node);
+}
+static inline int is_leftmost(struct task_struct *p, struct dl_rq *dl_rq)
+{
+        struct sched_dl_entity *dl_se = &p->dl;
+        return dl_rq->rb_leftmost == &dl_se->rb_node;
+}
+void init_dl_bandwidth(struct dl_bandwidth *dl_b, u64 period, u64 runtime)
+{
+        raw_spin_lock_init(&dl_b->dl_runtime_lock);
+        dl_b->dl_period = period;
+        dl_b->dl_runtime = runtime;
+}
+extern unsigned long to_ratio(u64 period, u64 runtime);
+void init_dl_bw(struct dl_bw *dl_b)
+{
+        raw_spin_lock_init(&dl_b->lock);
+        raw_spin_lock(&def_dl_bandwidth.dl_runtime_lock);
+        if (global_rt_runtime() == RUNTIME_INF)
+                dl_b->bw = -1;
+        else
+                dl_b->bw = to_ratio(global_rt_period(), global_rt_runtime());
+        raw_spin_unlock(&def_dl_bandwidth.dl_runtime_lock);
+        dl_b->total_bw = 0;
+}
+void init_dl_rq(struct dl_rq *dl_rq, struct rq *rq)
+{
+        dl_rq->rb_root = RB_ROOT;
+#ifdef CONFIG_SMP
+        /* zero means no -deadline tasks */
+        dl_rq->earliest_dl.curr = dl_rq->earliest_dl.next = 0;
+        dl_rq->dl_nr_migratory = 0;
+        dl_rq->overloaded = 0;
+        dl_rq->pushable_dl_tasks_root = RB_ROOT;
+#else
+        init_dl_bw(&dl_rq->dl_bw);
+#endif
+}
+#ifdef CONFIG_SMP
+static inline int dl_overloaded(struct rq *rq)
+{
+        return atomic_read(&rq->rd->dlo_count);
+}
+static inline void dl_set_overload(struct rq *rq)
+{
+        if (!rq->online)
+                return;
+        cpumask_set_cpu(rq->cpu, rq->rd->dlo_mask);
+        /*
+         * Must be visible before the overload count is
+         * set (as in sched_rt.c).
+         *
+         * Matched by the barrier in pull_dl_task().
+         */
+        smp_wmb();
+        atomic_inc(&rq->rd->dlo_count);
+}
+static inline void dl_clear_overload(struct rq *rq)
+{
+        if (!rq->online)
+                return;
+        atomic_dec(&rq->rd->dlo_count);
+        cpumask_clear_cpu(rq->cpu, rq->rd->dlo_mask);
+}
+static void update_dl_migration(struct dl_rq *dl_rq)
+{
+        if (dl_rq->dl_nr_migratory && dl_rq->dl_nr_total > 1) {
+                if (!dl_rq->overloaded) {
+                        dl_set_overload(rq_of_dl_rq(dl_rq));
+                        dl_rq->overloaded = 1;
+                }
+        } else if (dl_rq->overloaded) {
+                dl_clear_overload(rq_of_dl_rq(dl_rq));
+                dl_rq->overloaded = 0;
+        }
+}
+static void inc_dl_migration(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
+{
+        struct task_struct *p = dl_task_of(dl_se);
+        dl_rq = &rq_of_dl_rq(dl_rq)->dl;
+        dl_rq->dl_nr_total++;
+        if (p->nr_cpus_allowed > 1)
+                dl_rq->dl_nr_migratory++;
+        update_dl_migration(dl_rq);
+}
+static void dec_dl_migration(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
+{
+        struct task_struct *p = dl_task_of(dl_se);
+        dl_rq = &rq_of_dl_rq(dl_rq)->dl;
+        dl_rq->dl_nr_total--;
+        if (p->nr_cpus_allowed > 1)
+                dl_rq->dl_nr_migratory--;
+        update_dl_migration(dl_rq);
+}
+/*
+ * The list of pushable -deadline task is not a plist, like in
+ * sched_rt.c, it is an rb-tree with tasks ordered by deadline.
+ */
+static void enqueue_pushable_dl_task(struct rq *rq, struct task_struct *p)
+{
+        struct dl_rq *dl_rq = &rq->dl;
+        struct rb_node **link = &dl_rq->pushable_dl_tasks_root.rb_node;
+        struct rb_node *parent = NULL;
+        struct task_struct *entry;
+        int leftmost = 1;
+        BUG_ON(!RB_EMPTY_NODE(&p->pushable_dl_tasks));
+        while (*link) {
+                parent = *link;
+                entry = rb_entry(parent, struct task_struct,
+                                 pushable_dl_tasks);
+                if (dl_entity_preempt(&p->dl, &entry->dl))
+                        link = &parent->rb_left;
+                else {
+                        link = &parent->rb_right;
+                        leftmost = 0;
+                }
+        }
+        if (leftmost)
+                dl_rq->pushable_dl_tasks_leftmost = &p->pushable_dl_tasks;
+        rb_link_node(&p->pushable_dl_tasks, parent, link);
+        rb_insert_color(&p->pushable_dl_tasks, &dl_rq->pushable_dl_tasks_root);
+}
+static void dequeue_pushable_dl_task(struct rq *rq, struct task_struct *p)
+{
+        struct dl_rq *dl_rq = &rq->dl;
+        if (RB_EMPTY_NODE(&p->pushable_dl_tasks))
+                return;
+        if (dl_rq->pushable_dl_tasks_leftmost == &p->pushable_dl_tasks) {
+                struct rb_node *next_node;
+                next_node = rb_next(&p->pushable_dl_tasks);
+                dl_rq->pushable_dl_tasks_leftmost = next_node;
+        }
+        rb_erase(&p->pushable_dl_tasks, &dl_rq->pushable_dl_tasks_root);
+        RB_CLEAR_NODE(&p->pushable_dl_tasks);
+}
+static inline int has_pushable_dl_tasks(struct rq *rq)
+{
+        return !RB_EMPTY_ROOT(&rq->dl.pushable_dl_tasks_root);
+}
+static int push_dl_task(struct rq *rq);
+#else
+static inline
+void enqueue_pushable_dl_task(struct rq *rq, struct task_struct *p)
+{
+}
+static inline
+void dequeue_pushable_dl_task(struct rq *rq, struct task_struct *p)
+{
+}
+static inline
+void inc_dl_migration(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
+{
+}
+static inline
+void dec_dl_migration(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
+{
+}
+#endif /* CONFIG_SMP */
+static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags);
+static void __dequeue_task_dl(struct rq *rq, struct task_struct *p, int flags);
+static void check_preempt_curr_dl(struct rq *rq, struct task_struct *p,
+                                  int flags);
+/*
+ * We are being explicitly informed that a new instance is starting,
+ * and this means that:
+ *  - the absolute deadline of the entity has to be placed at
+ *    current time + relative deadline;
+ *  - the runtime of the entity has to be set to the maximum value.
+ *
+ * The capability of specifying such event is useful whenever a -deadline
+ * entity wants to (try to!) synchronize its behaviour with the scheduler's
+ * one, and to (try to!) reconcile itself with its own scheduling
+ * parameters.
+ */
+static inline void setup_new_dl_entity(struct sched_dl_entity *dl_se,
+                                       struct sched_dl_entity *pi_se)
+{
+        struct dl_rq *dl_rq = dl_rq_of_se(dl_se);
+        struct rq *rq = rq_of_dl_rq(dl_rq);
+        WARN_ON(!dl_se->dl_new || dl_se->dl_throttled);
+        /*
+         * We use the regular wall clock time to set deadlines in the
+         * future; in fact, we must consider execution overheads (time
+         * spent on hardirq context, etc.).
+         */
+        dl_se->deadline = rq_clock(rq) + pi_se->dl_deadline;
+        dl_se->runtime = pi_se->dl_runtime;
+        dl_se->dl_new = 0;
+}
+/*
+ * Pure Earliest Deadline First (EDF) scheduling does not deal with the
+ * possibility of a entity lasting more than what it declared, and thus
+ * exhausting its runtime.
+ *
+ * Here we are interested in making runtime overrun possible, but we do
+ * not want a entity which is misbehaving to affect the scheduling of all
+ * other entities.
+ * Therefore, a budgeting strategy called Constant Bandwidth Server (CBS)
+ * is used, in order to confine each entity within its own bandwidth.
+ *
+ * This function deals exactly with that, and ensures that when the runtime
+ * of a entity is replenished, its deadline is also postponed. That ensures
+ * the overrunning entity can't interfere with other entity in the system and
+ * can't make them miss their deadlines. Reasons why this kind of overruns
+ * could happen are, typically, a entity voluntarily trying to overcome its
+ * runtime, or it just underestimated it during sched_setscheduler_ex().
+ */
+static void replenish_dl_entity(struct sched_dl_entity *dl_se,
+                                struct sched_dl_entity *pi_se)
+{
+        struct dl_rq *dl_rq = dl_rq_of_se(dl_se);
+        struct rq *rq = rq_of_dl_rq(dl_rq);
+        BUG_ON(pi_se->dl_runtime <= 0);
+        /*
+         * This could be the case for a !-dl task that is boosted.
+         * Just go with full inherited parameters.
+         */
+        if (dl_se->dl_deadline == 0) {
+                dl_se->deadline = rq_clock(rq) + pi_se->dl_deadline;
+                dl_se->runtime = pi_se->dl_runtime;
+        }
+        /*
+         * We keep moving the deadline away until we get some
+         * available runtime for the entity. This ensures correct
+         * handling of situations where the runtime overrun is
+         * arbitrary large.
+         */
+        while (dl_se->runtime <= 0) {
+                dl_se->deadline += pi_se->dl_period;
+                dl_se->runtime += pi_se->dl_runtime;
+        }
+        /*
+         * At this point, the deadline really should be "in
+         * the future" with respect to rq->clock. If it's
+         * not, we are, for some reason, lagging too much!
+         * Anyway, after having warn userspace abut that,
+         * we still try to keep the things running by
+         * resetting the deadline and the budget of the
+         * entity.
+         */
+        if (dl_time_before(dl_se->deadline, rq_clock(rq))) {
+                static bool lag_once = false;
+                if (!lag_once) {
+                        lag_once = true;
+                        printk_sched("sched: DL replenish lagged to much\n");
+                }
+                dl_se->deadline = rq_clock(rq) + pi_se->dl_deadline;
+                dl_se->runtime = pi_se->dl_runtime;
+        }
+}
+/*
+ * Here we check if --at time t-- an entity (which is probably being
+ * [re]activated or, in general, enqueued) can use its remaining runtime
+ * and its current deadline _without_ exceeding the bandwidth it is
+ * assigned (function returns true if it can't). We are in fact applying
+ * one of the CBS rules: when a task wakes up, if the residual runtime
+ * over residual deadline fits within the allocated bandwidth, then we
+ * can keep the current (absolute) deadline and residual budget without
+ * disrupting the schedulability of the system. Otherwise, we should
+ * refill the runtime and set the deadline a period in the future,
+ * because keeping the current (absolute) deadline of the task would
+ * result in breaking guarantees promised to other tasks.
+ *
+ * This function returns true if:
+ *
+ *   runtime / (deadline - t) > dl_runtime / dl_period ,
+ *
+ * IOW we can't recycle current parameters.
+ *
+ * Notice that the bandwidth check is done against the period. For
+ * task with deadline equal to period this is the same of using
+ * dl_deadline instead of dl_period in the equation above.
+ */
+static bool dl_entity_overflow(struct sched_dl_entity *dl_se,
+                               struct sched_dl_entity *pi_se, u64 t)
+{
+        u64 left, right;
+        /*
+         * left and right are the two sides of the equation above,
+         * after a bit of shuffling to use multiplications instead
+         * of divisions.
+         *
+         * Note that none of the time values involved in the two
+         * multiplications are absolute: dl_deadline and dl_runtime
+         * are the relative deadline and the maximum runtime of each
+         * instance, runtime is the runtime left for the last instance
+         * and (deadline - t), since t is rq->clock, is the time left
+         * to the (absolute) deadline. Even if overflowing the u64 type
+         * is very unlikely to occur in both cases, here we scale down
+         * as we want to avoid that risk at all. Scaling down by 10
+         * means that we reduce granularity to 1us. We are fine with it,
+         * since this is only a true/false check and, anyway, thinking
+         * of anything below microseconds resolution is actually fiction
+         * (but still we want to give the user that illusion >;).
+         */
+        left = (pi_se->dl_period >> DL_SCALE) * (dl_se->runtime >> DL_SCALE);
+        right = ((dl_se->deadline - t) >> DL_SCALE) *
+                (pi_se->dl_runtime >> DL_SCALE);
+        return dl_time_before(right, left);
+}
+/*
+ * When a -deadline entity is queued back on the runqueue, its runtime and
+ * deadline might need updating.
+ *
+ * The policy here is that we update the deadline of the entity only if:
+ *  - the current deadline is in the past,
+ *  - using the remaining runtime with the current deadline would make
+ *    the entity exceed its bandwidth.
+ */
+static void update_dl_entity(struct sched_dl_entity *dl_se,
+                             struct sched_dl_entity *pi_se)
+{
+        struct dl_rq *dl_rq = dl_rq_of_se(dl_se);
+        struct rq *rq = rq_of_dl_rq(dl_rq);
+        /*
+         * The arrival of a new instance needs special treatment, i.e.,
+         * the actual scheduling parameters have to be "renewed".
+         */
+        if (dl_se->dl_new) {
+                setup_new_dl_entity(dl_se, pi_se);
+                return;
+        }
+        if (dl_time_before(dl_se->deadline, rq_clock(rq)) ||
+            dl_entity_overflow(dl_se, pi_se, rq_clock(rq))) {
+                dl_se->deadline = rq_clock(rq) + pi_se->dl_deadline;
+                dl_se->runtime = pi_se->dl_runtime;
+        }
+}
+/*
+ * If the entity depleted all its runtime, and if we want it to sleep
+ * while waiting for some new execution time to become available, we
+ * set the bandwidth enforcement timer to the replenishment instant
+ * and try to activate it.
+ *
+ * Notice that it is important for the caller to know if the timer
+ * actually started or not (i.e., the replenishment instant is in
+ * the future or in the past).
+ */
+static int start_dl_timer(struct sched_dl_entity *dl_se, bool boosted)
+{
+        struct dl_rq *dl_rq = dl_rq_of_se(dl_se);
+        struct rq *rq = rq_of_dl_rq(dl_rq);
+        ktime_t now, act;
+        ktime_t soft, hard;
+        unsigned long range;
+        s64 delta;
+        if (boosted)
+                return 0;
+        /*
+         * We want the timer to fire at the deadline, but considering
+         * that it is actually coming from rq->clock and not from
+         * hrtimer's time base reading.
+         */
+        act = ns_to_ktime(dl_se->deadline);
+        now = hrtimer_cb_get_time(&dl_se->dl_timer);
+        delta = ktime_to_ns(now) - rq_clock(rq);
+        act = ktime_add_ns(act, delta);
+        /*
+         * If the expiry time already passed, e.g., because the value
+         * chosen as the deadline is too small, don't even try to
+         * start the timer in the past!
+         */
+        if (ktime_us_delta(act, now) < 0)
+                return 0;
+        hrtimer_set_expires(&dl_se->dl_timer, act);
+        soft = hrtimer_get_softexpires(&dl_se->dl_timer);
+        hard = hrtimer_get_expires(&dl_se->dl_timer);
+        range = ktime_to_ns(ktime_sub(hard, soft));
+        __hrtimer_start_range_ns(&dl_se->dl_timer, soft,
+                                 range, HRTIMER_MODE_ABS, 0);
+        return hrtimer_active(&dl_se->dl_timer);
+}
+/*
+ * This is the bandwidth enforcement timer callback. If here, we know
+ * a task is not on its dl_rq, since the fact that the timer was running
+ * means the task is throttled and needs a runtime replenishment.
+ *
+ * However, what we actually do depends on the fact the task is active,
+ * (it is on its rq) or has been removed from there by a call to
+ * dequeue_task_dl(). In the former case we must issue the runtime
+ * replenishment and add the task back to the dl_rq; in the latter, we just
+ * do nothing but clearing dl_throttled, so that runtime and deadline
+ * updating (and the queueing back to dl_rq) will be done by the
+ * next call to enqueue_task_dl().
+ */
+static enum hrtimer_restart dl_task_timer(struct hrtimer *timer)
+{
+        struct sched_dl_entity *dl_se = container_of(timer,
+                                                     struct sched_dl_entity,
+                                                     dl_timer);
+        struct task_struct *p = dl_task_of(dl_se);
+        struct rq *rq = task_rq(p);
+        raw_spin_lock(&rq->lock);
+        /*
+         * We need to take care of a possible races here. In fact, the
+         * task might have changed its scheduling policy to something
+         * different from SCHED_DEADLINE or changed its reservation
+         * parameters (through sched_setscheduler()).
+         */
+        if (!dl_task(p) || dl_se->dl_new)
+                goto unlock;
+        sched_clock_tick();
+        update_rq_clock(rq);
+        dl_se->dl_throttled = 0;
+        if (p->on_rq) {
+                enqueue_task_dl(rq, p, ENQUEUE_REPLENISH);
+                if (task_has_dl_policy(rq->curr))
+                        check_preempt_curr_dl(rq, p, 0);
+                else
+                        resched_task(rq->curr);
+#ifdef CONFIG_SMP
+                /*
+                 * Queueing this task back might have overloaded rq,
+                 * check if we need to kick someone away.
+                 */
+                if (has_pushable_dl_tasks(rq))
+                        push_dl_task(rq);
+#endif
+        }
+unlock:
+        raw_spin_unlock(&rq->lock);
+        return HRTIMER_NORESTART;
+}
+void init_dl_task_timer(struct sched_dl_entity *dl_se)
+{
+        struct hrtimer *timer = &dl_se->dl_timer;
+        if (hrtimer_active(timer)) {
+                hrtimer_try_to_cancel(timer);
+                return;
+        }
+        hrtimer_init(timer, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+        timer->function = dl_task_timer;
+}
+static
+int dl_runtime_exceeded(struct rq *rq, struct sched_dl_entity *dl_se)
+{
+        int dmiss = dl_time_before(dl_se->deadline, rq_clock(rq));
+        int rorun = dl_se->runtime <= 0;
+        if (!rorun && !dmiss)
+                return 0;
+        /*
+         * If we are beyond our current deadline and we are still
+         * executing, then we have already used some of the runtime of
+         * the next instance. Thus, if we do not account that, we are
+         * stealing bandwidth from the system at each deadline miss!
+         */
+        if (dmiss) {
+                dl_se->runtime = rorun ? dl_se->runtime : 0;
+                dl_se->runtime -= rq_clock(rq) - dl_se->deadline;
+        }
+        return 1;
+}
+/*
+ * Update the current task's runtime statistics (provided it is still
+ * a -deadline task and has not been removed from the dl_rq).
+ */
+static void update_curr_dl(struct rq *rq)
+{
+        struct task_struct *curr = rq->curr;
+        struct sched_dl_entity *dl_se = &curr->dl;
+        u64 delta_exec;
+        if (!dl_task(curr) || !on_dl_rq(dl_se))
+                return;
+        /*
+         * Consumed budget is computed considering the time as
+         * observed by schedulable tasks (excluding time spent
+         * in hardirq context, etc.). Deadlines are instead
+         * computed using hard walltime. This seems to be the more
+         * natural solution, but the full ramifications of this
+         * approach need further study.
+         */
+        delta_exec = rq_clock_task(rq) - curr->se.exec_start;
+        if (unlikely((s64)delta_exec < 0))
+                delta_exec = 0;
+        schedstat_set(curr->se.statistics.exec_max,
+                      max(curr->se.statistics.exec_max, delta_exec));
+        curr->se.sum_exec_runtime += delta_exec;
+        account_group_exec_runtime(curr, delta_exec);
+        curr->se.exec_start = rq_clock_task(rq);
+        cpuacct_charge(curr, delta_exec);
+        sched_rt_avg_update(rq, delta_exec);
+        dl_se->runtime -= delta_exec;
+        if (dl_runtime_exceeded(rq, dl_se)) {
+                __dequeue_task_dl(rq, curr, 0);
+                if (likely(start_dl_timer(dl_se, curr->dl.dl_boosted)))
+                        dl_se->dl_throttled = 1;
+                else
+                        enqueue_task_dl(rq, curr, ENQUEUE_REPLENISH);
+                if (!is_leftmost(curr, &rq->dl))
+                        resched_task(curr);
+        }
+        /*
+         * Because -- for now -- we share the rt bandwidth, we need to
+         * account our runtime there too, otherwise actual rt tasks
+         * would be able to exceed the shared quota.
+         *
+         * Account to the root rt group for now.
+         *
+         * The solution we're working towards is having the RT groups scheduled
+         * using deadline servers -- however there's a few nasties to figure
+         * out before that can happen.
+         */
+        if (rt_bandwidth_enabled()) {
+                struct rt_rq *rt_rq = &rq->rt;
+                raw_spin_lock(&rt_rq->rt_runtime_lock);
+                rt_rq->rt_time += delta_exec;
+                /*
+                 * We'll let actual RT tasks worry about the overflow here, we
+                 * have our own CBS to keep us inline -- see above.
+                 */
+                raw_spin_unlock(&rt_rq->rt_runtime_lock);
+        }
+}
+#ifdef CONFIG_SMP
+static struct task_struct *pick_next_earliest_dl_task(struct rq *rq, int cpu);
+static inline u64 next_deadline(struct rq *rq)
+{
+        struct task_struct *next = pick_next_earliest_dl_task(rq, rq->cpu);
+        if (next && dl_prio(next->prio))
+                return next->dl.deadline;
+        else
+                return 0;
+}
+static void inc_dl_deadline(struct dl_rq *dl_rq, u64 deadline)
+{
+        struct rq *rq = rq_of_dl_rq(dl_rq);
+        if (dl_rq->earliest_dl.curr == 0 ||
+            dl_time_before(deadline, dl_rq->earliest_dl.curr)) {
+                /*
+                 * If the dl_rq had no -deadline tasks, or if the new task
+                 * has shorter deadline than the current one on dl_rq, we
+                 * know that the previous earliest becomes our next earliest,
+                 * as the new task becomes the earliest itself.
+                 */
+                dl_rq->earliest_dl.next = dl_rq->earliest_dl.curr;
+                dl_rq->earliest_dl.curr = deadline;
+                cpudl_set(&rq->rd->cpudl, rq->cpu, deadline, 1);
+        } else if (dl_rq->earliest_dl.next == 0 ||
+                   dl_time_before(deadline, dl_rq->earliest_dl.next)) {
+                /*
+                 * On the other hand, if the new -deadline task has a
+                 * a later deadline than the earliest one on dl_rq, but
+                 * it is earlier than the next (if any), we must
+                 * recompute the next-earliest.
+                 */
+                dl_rq->earliest_dl.next = next_deadline(rq);
+        }
+}
+static void dec_dl_deadline(struct dl_rq *dl_rq, u64 deadline)
+{
+        struct rq *rq = rq_of_dl_rq(dl_rq);
+        /*
+         * Since we may have removed our earliest (and/or next earliest)
+         * task we must recompute them.
+         */
+        if (!dl_rq->dl_nr_running) {
+                dl_rq->earliest_dl.curr = 0;
+                dl_rq->earliest_dl.next = 0;
+                cpudl_set(&rq->rd->cpudl, rq->cpu, 0, 0);
+        } else {
+                struct rb_node *leftmost = dl_rq->rb_leftmost;
+                struct sched_dl_entity *entry;
+                entry = rb_entry(leftmost, struct sched_dl_entity, rb_node);
+                dl_rq->earliest_dl.curr = entry->deadline;
+                dl_rq->earliest_dl.next = next_deadline(rq);
+                cpudl_set(&rq->rd->cpudl, rq->cpu, entry->deadline, 1);
+        }
+}
+#else
+static inline void inc_dl_deadline(struct dl_rq *dl_rq, u64 deadline) {}
+static inline void dec_dl_deadline(struct dl_rq *dl_rq, u64 deadline) {}
+#endif /* CONFIG_SMP */
+static inline
+void inc_dl_tasks(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
+{
+        int prio = dl_task_of(dl_se)->prio;
+        u64 deadline = dl_se->deadline;
+        WARN_ON(!dl_prio(prio));
+        dl_rq->dl_nr_running++;
+        inc_dl_deadline(dl_rq, deadline);
+        inc_dl_migration(dl_se, dl_rq);
+}
+static inline
+void dec_dl_tasks(struct sched_dl_entity *dl_se, struct dl_rq *dl_rq)
+{
+        int prio = dl_task_of(dl_se)->prio;
+        WARN_ON(!dl_prio(prio));
+        WARN_ON(!dl_rq->dl_nr_running);
+        dl_rq->dl_nr_running--;
+        dec_dl_deadline(dl_rq, dl_se->deadline);
+        dec_dl_migration(dl_se, dl_rq);
+}
+static void __enqueue_dl_entity(struct sched_dl_entity *dl_se)
+{
+        struct dl_rq *dl_rq = dl_rq_of_se(dl_se);
+        struct rb_node **link = &dl_rq->rb_root.rb_node;
+        struct rb_node *parent = NULL;
+        struct sched_dl_entity *entry;
+        int leftmost = 1;
+        BUG_ON(!RB_EMPTY_NODE(&dl_se->rb_node));
+        while (*link) {
+                parent = *link;
+                entry = rb_entry(parent, struct sched_dl_entity, rb_node);
+                if (dl_time_before(dl_se->deadline, entry->deadline))
+                        link = &parent->rb_left;
+                else {
+                        link = &parent->rb_right;
+                        leftmost = 0;
+                }
+        }
+        if (leftmost)
+                dl_rq->rb_leftmost = &dl_se->rb_node;
+        rb_link_node(&dl_se->rb_node, parent, link);
+        rb_insert_color(&dl_se->rb_node, &dl_rq->rb_root);
+        inc_dl_tasks(dl_se, dl_rq);
+}
+static void __dequeue_dl_entity(struct sched_dl_entity *dl_se)
+{
+        struct dl_rq *dl_rq = dl_rq_of_se(dl_se);
+        if (RB_EMPTY_NODE(&dl_se->rb_node))
+                return;
+        if (dl_rq->rb_leftmost == &dl_se->rb_node) {
+                struct rb_node *next_node;
+                next_node = rb_next(&dl_se->rb_node);
+                dl_rq->rb_leftmost = next_node;
+        }
+        rb_erase(&dl_se->rb_node, &dl_rq->rb_root);
+        RB_CLEAR_NODE(&dl_se->rb_node);
+        dec_dl_tasks(dl_se, dl_rq);
+}
+static void
+enqueue_dl_entity(struct sched_dl_entity *dl_se,
+                  struct sched_dl_entity *pi_se, int flags)
+{
+        BUG_ON(on_dl_rq(dl_se));
+        /*
+         * If this is a wakeup or a new instance, the scheduling
+         * parameters of the task might need updating. Otherwise,
+         * we want a replenishment of its runtime.
+         */
+        if (!dl_se->dl_new && flags & ENQUEUE_REPLENISH)
+                replenish_dl_entity(dl_se, pi_se);
+        else
+                update_dl_entity(dl_se, pi_se);
+        __enqueue_dl_entity(dl_se);
+}
+static void dequeue_dl_entity(struct sched_dl_entity *dl_se)
+{
+        __dequeue_dl_entity(dl_se);
+}
+static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags)
+{
+        struct task_struct *pi_task = rt_mutex_get_top_task(p);
+        struct sched_dl_entity *pi_se = &p->dl;
+        /*
+         * Use the scheduling parameters of the top pi-waiter
+         * task if we have one and its (relative) deadline is
+         * smaller than our one... OTW we keep our runtime and
+         * deadline.
+         */
+        if (pi_task && p->dl.dl_boosted && dl_prio(pi_task->normal_prio))
+                pi_se = &pi_task->dl;
+        /*
+         * If p is throttled, we do nothing. In fact, if it exhausted
+         * its budget it needs a replenishment and, since it now is on
+         * its rq, the bandwidth timer callback (which clearly has not
+         * run yet) will take care of this.
+         */
+        if (p->dl.dl_throttled)
+                return;
+        enqueue_dl_entity(&p->dl, pi_se, flags);
+        if (!task_current(rq, p) && p->nr_cpus_allowed > 1)
+                enqueue_pushable_dl_task(rq, p);
+        inc_nr_running(rq);
+}
+static void __dequeue_task_dl(struct rq *rq, struct task_struct *p, int flags)
+{
+        dequeue_dl_entity(&p->dl);
+        dequeue_pushable_dl_task(rq, p);
+}
+static void dequeue_task_dl(struct rq *rq, struct task_struct *p, int flags)
+{
+        update_curr_dl(rq);
+        __dequeue_task_dl(rq, p, flags);
+        dec_nr_running(rq);
+}
+/*
+ * Yield task semantic for -deadline tasks is:
+ *
+ *   get off from the CPU until our next instance, with
+ *   a new runtime. This is of little use now, since we
+ *   don't have a bandwidth reclaiming mechanism. Anyway,
+ *   bandwidth reclaiming is planned for the future, and
+ *   yield_task_dl will indicate that some spare budget
+ *   is available for other task instances to use it.
+ */
+static void yield_task_dl(struct rq *rq)
+{
+        struct task_struct *p = rq->curr;
+        /*
+         * We make the task go to sleep until its current deadline by
+         * forcing its runtime to zero. This way, update_curr_dl() stops
+         * it and the bandwidth timer will wake it up and will give it
+         * new scheduling parameters (thanks to dl_new=1).
+         */
+        if (p->dl.runtime > 0) {
+                rq->curr->dl.dl_new = 1;
+                p->dl.runtime = 0;
+        }
+        update_curr_dl(rq);
+}
+#ifdef CONFIG_SMP
+static int find_later_rq(struct task_struct *task);
+static int
+select_task_rq_dl(struct task_struct *p, int cpu, int sd_flag, int flags)
+{
+        struct task_struct *curr;
+        struct rq *rq;
+        if (sd_flag != SD_BALANCE_WAKE && sd_flag != SD_BALANCE_FORK)
+                goto out;
+        rq = cpu_rq(cpu);
+        rcu_read_lock();
+        curr = ACCESS_ONCE(rq->curr); /* unlocked access */
+        /*
+         * If we are dealing with a -deadline task, we must
+         * decide where to wake it up.
+         * If it has a later deadline and the current task
+         * on this rq can't move (provided the waking task
+         * can!) we prefer to send it somewhere else. On the
+         * other hand, if it has a shorter deadline, we
+         * try to make it stay here, it might be important.
+         */
+        if (unlikely(dl_task(curr)) &&
+            (curr->nr_cpus_allowed < 2 ||
+             !dl_entity_preempt(&p->dl, &curr->dl)) &&
+            (p->nr_cpus_allowed > 1)) {
+                int target = find_later_rq(p);
+                if (target != -1)
+                        cpu = target;
+        }
+        rcu_read_unlock();
+out:
+        return cpu;
+}
+static void check_preempt_equal_dl(struct rq *rq, struct task_struct *p)
+{
+        /*
+         * Current can't be migrated, useless to reschedule,
+         * let's hope p can move out.
+         */
+        if (rq->curr->nr_cpus_allowed == 1 ||
+            cpudl_find(&rq->rd->cpudl, rq->curr, NULL) == -1)
+                return;
+        /*
+         * p is migratable, so let's not schedule it and
+         * see if it is pushed or pulled somewhere else.
+         */
+        if (p->nr_cpus_allowed != 1 &&
+            cpudl_find(&rq->rd->cpudl, p, NULL) != -1)
+                return;
+        resched_task(rq->curr);
+}
+#endif /* CONFIG_SMP */
+/*
+ * Only called when both the current and waking task are -deadline
+ * tasks.
+ */
+static void check_preempt_curr_dl(struct rq *rq, struct task_struct *p,
+                                  int flags)
+{
+        if (dl_entity_preempt(&p->dl, &rq->curr->dl)) {
+                resched_task(rq->curr);
+                return;
+        }
+#ifdef CONFIG_SMP
+        /*
+         * In the unlikely case current and p have the same deadline
+         * let us try to decide what's the best thing to do...
+         */
+        if ((p->dl.deadline == rq->curr->dl.deadline) &&
+            !test_tsk_need_resched(rq->curr))
+                check_preempt_equal_dl(rq, p);
+#endif /* CONFIG_SMP */
+}
+#ifdef CONFIG_SCHED_HRTICK
+static void start_hrtick_dl(struct rq *rq, struct task_struct *p)
+{
+        s64 delta = p->dl.dl_runtime - p->dl.runtime;
+        if (delta > 10000)
+                hrtick_start(rq, p->dl.runtime);
+}
+#endif
+static struct sched_dl_entity *pick_next_dl_entity(struct rq *rq,
+                                                   struct dl_rq *dl_rq)
+{
+        struct rb_node *left = dl_rq->rb_leftmost;
+        if (!left)
+                return NULL;
+        return rb_entry(left, struct sched_dl_entity, rb_node);
+}
+struct task_struct *pick_next_task_dl(struct rq *rq)
+{
+        struct sched_dl_entity *dl_se;
+        struct task_struct *p;
+        struct dl_rq *dl_rq;
+        dl_rq = &rq->dl;
+        if (unlikely(!dl_rq->dl_nr_running))
+                return NULL;
+        dl_se = pick_next_dl_entity(rq, dl_rq);
+        BUG_ON(!dl_se);
+        p = dl_task_of(dl_se);
+        p->se.exec_start = rq_clock_task(rq);
+        /* Running task will never be pushed. */
+       dequeue_pushable_dl_task(rq, p);
+#ifdef CONFIG_SCHED_HRTICK
+        if (hrtick_enabled(rq))
+                start_hrtick_dl(rq, p);
+#endif
+#ifdef CONFIG_SMP
+        rq->post_schedule = has_pushable_dl_tasks(rq);
+#endif /* CONFIG_SMP */
+        return p;
+}
+static void put_prev_task_dl(struct rq *rq, struct task_struct *p)
+{
+        update_curr_dl(rq);
+        if (on_dl_rq(&p->dl) && p->nr_cpus_allowed > 1)
+                enqueue_pushable_dl_task(rq, p);
+}
+static void task_tick_dl(struct rq *rq, struct task_struct *p, int queued)
+{
+        update_curr_dl(rq);
+#ifdef CONFIG_SCHED_HRTICK
+        if (hrtick_enabled(rq) && queued && p->dl.runtime > 0)
+                start_hrtick_dl(rq, p);
+#endif
+}
+static void task_fork_dl(struct task_struct *p)
+{
+        /*
+         * SCHED_DEADLINE tasks cannot fork and this is achieved through
+         * sched_fork()
+         */
+}
+static void task_dead_dl(struct task_struct *p)
+{
+        struct hrtimer *timer = &p->dl.dl_timer;
+        struct dl_bw *dl_b = dl_bw_of(task_cpu(p));
+        /*
+         * Since we are TASK_DEAD we won't slip out of the domain!
+         */
+        raw_spin_lock_irq(&dl_b->lock);
+        dl_b->total_bw -= p->dl.dl_bw;
+        raw_spin_unlock_irq(&dl_b->lock);
+        hrtimer_cancel(timer);
+}
+static void set_curr_task_dl(struct rq *rq)
+{
+        struct task_struct *p = rq->curr;
+        p->se.exec_start = rq_clock_task(rq);
+        /* You can't push away the running task */
+        dequeue_pushable_dl_task(rq, p);
+}
+#ifdef CONFIG_SMP
+/* Only try algorithms three times */
+#define DL_MAX_TRIES 3
+static int pick_dl_task(struct rq *rq, struct task_struct *p, int cpu)
+{
+        if (!task_running(rq, p) &&
+            (cpu < 0 || cpumask_test_cpu(cpu, &p->cpus_allowed)) &&
+            (p->nr_cpus_allowed > 1))
+                return 1;
+        return 0;
+}
+/* Returns the second earliest -deadline task, NULL otherwise */
+static struct task_struct *pick_next_earliest_dl_task(struct rq *rq, int cpu)
+{
+        struct rb_node *next_node = rq->dl.rb_leftmost;
+        struct sched_dl_entity *dl_se;
+        struct task_struct *p = NULL;
+next_node:
+        next_node = rb_next(next_node);
+        if (next_node) {
+                dl_se = rb_entry(next_node, struct sched_dl_entity, rb_node);
+                p = dl_task_of(dl_se);
+                if (pick_dl_task(rq, p, cpu))
+                        return p;
+                goto next_node;
+        }
+        return NULL;
+}
+static DEFINE_PER_CPU(cpumask_var_t, local_cpu_mask_dl);
+static int find_later_rq(struct task_struct *task)
+{
+        struct sched_domain *sd;
+        struct cpumask *later_mask = __get_cpu_var(local_cpu_mask_dl);
+        int this_cpu = smp_processor_id();
+        int best_cpu, cpu = task_cpu(task);
+        /* Make sure the mask is initialized first */
+        if (unlikely(!later_mask))
+                return -1;
+        if (task->nr_cpus_allowed == 1)
+                return -1;
+        best_cpu = cpudl_find(&task_rq(task)->rd->cpudl,
+                        task, later_mask);
+        if (best_cpu == -1)
+                return -1;
+        /*
+         * If we are here, some target has been found,
+         * the most suitable of which is cached in best_cpu.
+         * This is, among the runqueues where the current tasks
+         * have later deadlines than the task's one, the rq
+         * with the latest possible one.
+         *
+         * Now we check how well this matches with task's
+         * affinity and system topology.
+         *
+         * The last cpu where the task run is our first
+         * guess, since it is most likely cache-hot there.
+         */
+        if (cpumask_test_cpu(cpu, later_mask))
+                return cpu;
+        /*
+         * Check if this_cpu is to be skipped (i.e., it is
+         * not in the mask) or not.
+         */
+        if (!cpumask_test_cpu(this_cpu, later_mask))
+                this_cpu = -1;
+        rcu_read_lock();
+        for_each_domain(cpu, sd) {
+                if (sd->flags & SD_WAKE_AFFINE) {
+                        /*
+                         * If possible, preempting this_cpu is
+                         * cheaper than migrating.
+                         */
+                        if (this_cpu != -1 &&
+                            cpumask_test_cpu(this_cpu, sched_domain_span(sd))) {
+                                rcu_read_unlock();
+                                return this_cpu;
+                        }
+                        /*
+                         * Last chance: if best_cpu is valid and is
+                         * in the mask, that becomes our choice.
+                         */
+                        if (best_cpu < nr_cpu_ids &&
+                            cpumask_test_cpu(best_cpu, sched_domain_span(sd))) {
+                                rcu_read_unlock();
+                                return best_cpu;
+                        }
+                }
+        }
+        rcu_read_unlock();
+        /*
+         * At this point, all our guesses failed, we just return
+         * 'something', and let the caller sort the things out.
+         */
+        if (this_cpu != -1)
+                return this_cpu;
+        cpu = cpumask_any(later_mask);
+        if (cpu < nr_cpu_ids)
+                return cpu;
+        return -1;
+}
+/* Locks the rq it finds */
+static struct rq *find_lock_later_rq(struct task_struct *task, struct rq *rq)
+{
+        struct rq *later_rq = NULL;
+        int tries;
+        int cpu;
+        for (tries = 0; tries < DL_MAX_TRIES; tries++) {
+                cpu = find_later_rq(task);
+                if ((cpu == -1) || (cpu == rq->cpu))
+                        break;
+                later_rq = cpu_rq(cpu);
+                /* Retry if something changed. */
+                if (double_lock_balance(rq, later_rq)) {
+                        if (unlikely(task_rq(task) != rq ||
+                                     !cpumask_test_cpu(later_rq->cpu,
+                                                       &task->cpus_allowed) ||
+                                     task_running(rq, task) || !task->on_rq)) {
+                                double_unlock_balance(rq, later_rq);
+                                later_rq = NULL;
+                                break;
+                        }
+                }
+                /*
+                 * If the rq we found has no -deadline task, or
+                 * its earliest one has a later deadline than our
+                 * task, the rq is a good one.
+                 */
+                if (!later_rq->dl.dl_nr_running ||
+                    dl_time_before(task->dl.deadline,
+                                   later_rq->dl.earliest_dl.curr))
+                        break;
+                /* Otherwise we try again. */
+                double_unlock_balance(rq, later_rq);
+                later_rq = NULL;
+        }
+        return later_rq;
+}
+static struct task_struct *pick_next_pushable_dl_task(struct rq *rq)
+{
+        struct task_struct *p;
+        if (!has_pushable_dl_tasks(rq))
+                return NULL;
+        p = rb_entry(rq->dl.pushable_dl_tasks_leftmost,
+                     struct task_struct, pushable_dl_tasks);
+        BUG_ON(rq->cpu != task_cpu(p));
+        BUG_ON(task_current(rq, p));
+        BUG_ON(p->nr_cpus_allowed <= 1);
+        BUG_ON(!p->on_rq);
+        BUG_ON(!dl_task(p));
+        return p;
+}
+/*
+ * See if the non running -deadline tasks on this rq
+ * can be sent to some other CPU where they can preempt
+ * and start executing.
+ */
+static int push_dl_task(struct rq *rq)
+{
+        struct task_struct *next_task;
+        struct rq *later_rq;
+        if (!rq->dl.overloaded)
+                return 0;
+        next_task = pick_next_pushable_dl_task(rq);
+        if (!next_task)
+                return 0;
+retry:
+        if (unlikely(next_task == rq->curr)) {
+                WARN_ON(1);
+                return 0;
+        }
+        /*
+         * If next_task preempts rq->curr, and rq->curr
+         * can move away, it makes sense to just reschedule
+         * without going further in pushing next_task.
+         */
+        if (dl_task(rq->curr) &&
+            dl_time_before(next_task->dl.deadline, rq->curr->dl.deadline) &&
+            rq->curr->nr_cpus_allowed > 1) {
+                resched_task(rq->curr);
+                return 0;
+        }
+        /* We might release rq lock */
+        get_task_struct(next_task);
+        /* Will lock the rq it'll find */
+        later_rq = find_lock_later_rq(next_task, rq);
+        if (!later_rq) {
+                struct task_struct *task;
+                /*
+                 * We must check all this again, since
+                 * find_lock_later_rq releases rq->lock and it is
+                 * then possible that next_task has migrated.
+                 */
+                task = pick_next_pushable_dl_task(rq);
+                if (task_cpu(next_task) == rq->cpu && task == next_task) {
+                        /*
+                         * The task is still there. We don't try
+                         * again, some other cpu will pull it when ready.
+                         */
+                        dequeue_pushable_dl_task(rq, next_task);
+                        goto out;
+                }
+                if (!task)
+                        /* No more tasks */
+                        goto out;
+                put_task_struct(next_task);
+                next_task = task;
+                goto retry;
+        }
+        deactivate_task(rq, next_task, 0);
+        set_task_cpu(next_task, later_rq->cpu);
+        activate_task(later_rq, next_task, 0);
+        resched_task(later_rq->curr);
+        double_unlock_balance(rq, later_rq);
+out:
+        put_task_struct(next_task);
+        return 1;
+}
+static void push_dl_tasks(struct rq *rq)
+{
+        /* Terminates as it moves a -deadline task */
+        while (push_dl_task(rq))
+                ;
+}
+static int pull_dl_task(struct rq *this_rq)
+{
+        int this_cpu = this_rq->cpu, ret = 0, cpu;
+        struct task_struct *p;
+        struct rq *src_rq;
+        u64 dmin = LONG_MAX;
+        if (likely(!dl_overloaded(this_rq)))
+                return 0;
+        /*
+         * Match the barrier from dl_set_overloaded; this guarantees that if we
+         * see overloaded we must also see the dlo_mask bit.
+         */
+        smp_rmb();
+        for_each_cpu(cpu, this_rq->rd->dlo_mask) {
+                if (this_cpu == cpu)
+                        continue;
+                src_rq = cpu_rq(cpu);
+                /*
+                 * It looks racy, abd it is! However, as in sched_rt.c,
+                 * we are fine with this.
+                 */
+                if (this_rq->dl.dl_nr_running &&
+                    dl_time_before(this_rq->dl.earliest_dl.curr,
+                                   src_rq->dl.earliest_dl.next))
+                        continue;
+                /* Might drop this_rq->lock */
+                double_lock_balance(this_rq, src_rq);
+                /*
+                 * If there are no more pullable tasks on the
+                 * rq, we're done with it.
+                 */
+                if (src_rq->dl.dl_nr_running <= 1)
+                        goto skip;
+                p = pick_next_earliest_dl_task(src_rq, this_cpu);
+                /*
+                 * We found a task to be pulled if:
+                 *  - it preempts our current (if there's one),
+                 *  - it will preempt the last one we pulled (if any).
+                 */
+                if (p && dl_time_before(p->dl.deadline, dmin) &&
+                    (!this_rq->dl.dl_nr_running ||
+                     dl_time_before(p->dl.deadline,
+                                    this_rq->dl.earliest_dl.curr))) {
+                        WARN_ON(p == src_rq->curr);
+                        WARN_ON(!p->on_rq);
+                        /*
+                         * Then we pull iff p has actually an earlier
+                         * deadline than the current task of its runqueue.
+                         */
+                        if (dl_time_before(p->dl.deadline,
+                                           src_rq->curr->dl.deadline))
+                                goto skip;
+                        ret = 1;
+                        deactivate_task(src_rq, p, 0);
+                        set_task_cpu(p, this_cpu);
+                        activate_task(this_rq, p, 0);
+                        dmin = p->dl.deadline;
+                        /* Is there any other task even earlier? */
+                }
+skip:
+                double_unlock_balance(this_rq, src_rq);
+        }
+        return ret;
+}
+static void pre_schedule_dl(struct rq *rq, struct task_struct *prev)
+{
+        /* Try to pull other tasks here */
+        if (dl_task(prev))
+                pull_dl_task(rq);
+}
+static void post_schedule_dl(struct rq *rq)
+{
+        push_dl_tasks(rq);
+}
+/*
+ * Since the task is not running and a reschedule is not going to happen
+ * anytime soon on its runqueue, we try pushing it away now.
+ */
+static void task_woken_dl(struct rq *rq, struct task_struct *p)
+{
+        if (!task_running(rq, p) &&
+            !test_tsk_need_resched(rq->curr) &&
+            has_pushable_dl_tasks(rq) &&
+            p->nr_cpus_allowed > 1 &&
+            dl_task(rq->curr) &&
+            (rq->curr->nr_cpus_allowed < 2 ||
+             dl_entity_preempt(&rq->curr->dl, &p->dl))) {
+                push_dl_tasks(rq);
+        }
+}
+static void set_cpus_allowed_dl(struct task_struct *p,
+                                const struct cpumask *new_mask)
+{
+        struct rq *rq;
+        int weight;
+        BUG_ON(!dl_task(p));
+        /*
+         * Update only if the task is actually running (i.e.,
+         * it is on the rq AND it is not throttled).
+         */
+        if (!on_dl_rq(&p->dl))
+                return;
+        weight = cpumask_weight(new_mask);
+        /*
+         * Only update if the process changes its state from whether it
+         * can migrate or not.
+         */
+        if ((p->nr_cpus_allowed > 1) == (weight > 1))
+                return;
+        rq = task_rq(p);
+        /*
+         * The process used to be able to migrate OR it can now migrate
+         */
+        if (weight <= 1) {
+                if (!task_current(rq, p))
+                        dequeue_pushable_dl_task(rq, p);
+                BUG_ON(!rq->dl.dl_nr_migratory);
+                rq->dl.dl_nr_migratory--;
+        } else {
+                if (!task_current(rq, p))
+                        enqueue_pushable_dl_task(rq, p);
+                rq->dl.dl_nr_migratory++;
+        }
+        update_dl_migration(&rq->dl);
+}
+/* Assumes rq->lock is held */
+static void rq_online_dl(struct rq *rq)
+{
+        if (rq->dl.overloaded)
+                dl_set_overload(rq);
+        if (rq->dl.dl_nr_running > 0)
+                cpudl_set(&rq->rd->cpudl, rq->cpu, rq->dl.earliest_dl.curr, 1);
+}
+/* Assumes rq->lock is held */
+static void rq_offline_dl(struct rq *rq)
+{
+        if (rq->dl.overloaded)
+                dl_clear_overload(rq);
+        cpudl_set(&rq->rd->cpudl, rq->cpu, 0, 0);
+}
+void init_sched_dl_class(void)
+{
+        unsigned int i;
+        for_each_possible_cpu(i)
+                zalloc_cpumask_var_node(&per_cpu(local_cpu_mask_dl, i),
+                                        GFP_KERNEL, cpu_to_node(i));
+}
+#endif /* CONFIG_SMP */
+static void switched_from_dl(struct rq *rq, struct task_struct *p)
+{
+        if (hrtimer_active(&p->dl.dl_timer) && !dl_policy(p->policy))
+                hrtimer_try_to_cancel(&p->dl.dl_timer);
+#ifdef CONFIG_SMP
+        /*
+         * Since this might be the only -deadline task on the rq,
+         * this is the right place to try to pull some other one
+         * from an overloaded cpu, if any.
+         */
+        if (!rq->dl.dl_nr_running)
+                pull_dl_task(rq);
+#endif
+}
+/*
+ * When switching to -deadline, we may overload the rq, then
+ * we try to push someone off, if possible.
+ */
+static void switched_to_dl(struct rq *rq, struct task_struct *p)
+{
+        int check_resched = 1;
+        /*
+         * If p is throttled, don't consider the possibility
+         * of preempting rq->curr, the check will be done right
+         * after its runtime will get replenished.
+         */
+        if (unlikely(p->dl.dl_throttled))
+                return;
+        if (p->on_rq || rq->curr != p) {
+#ifdef CONFIG_SMP
+                if (rq->dl.overloaded && push_dl_task(rq) && rq != task_rq(p))
+                        /* Only reschedule if pushing failed */
+                        check_resched = 0;
+#endif /* CONFIG_SMP */
+                if (check_resched && task_has_dl_policy(rq->curr))
+                        check_preempt_curr_dl(rq, p, 0);
+        }
+}
+/*
+ * If the scheduling parameters of a -deadline task changed,
+ * a push or pull operation might be needed.
+ */
+static void prio_changed_dl(struct rq *rq, struct task_struct *p,
+                            int oldprio)
+{
+        if (p->on_rq || rq->curr == p) {
+#ifdef CONFIG_SMP
+                /*
+                 * This might be too much, but unfortunately
+                 * we don't have the old deadline value, and
+                 * we can't argue if the task is increasing
+                 * or lowering its prio, so...
+                 */
+                if (!rq->dl.overloaded)
+                        pull_dl_task(rq);
+                /*
+                 * If we now have a earlier deadline task than p,
+                 * then reschedule, provided p is still on this
+                 * runqueue.
+                 */
+                if (dl_time_before(rq->dl.earliest_dl.curr, p->dl.deadline) &&
+                    rq->curr == p)
+                        resched_task(p);
+#else
+                /*
+                 * Again, we don't know if p has a earlier
+                 * or later deadline, so let's blindly set a
+                 * (maybe not needed) rescheduling point.
+                 */
+                resched_task(p);
+#endif /* CONFIG_SMP */
+        } else
+                switched_to_dl(rq, p);
+}
+const struct sched_class dl_sched_class = {
+        .next                   = &rt_sched_class,
+        .enqueue_task           = enqueue_task_dl,
+        .dequeue_task           = dequeue_task_dl,
+        .yield_task             = yield_task_dl,
+        .check_preempt_curr     = check_preempt_curr_dl,
+        .pick_next_task         = pick_next_task_dl,
+        .put_prev_task          = put_prev_task_dl,
+#ifdef CONFIG_SMP
+        .select_task_rq         = select_task_rq_dl,
+        .set_cpus_allowed       = set_cpus_allowed_dl,
+        .rq_online              = rq_online_dl,
+        .rq_offline             = rq_offline_dl,
+        .pre_schedule           = pre_schedule_dl,
+        .post_schedule          = post_schedule_dl,
+        .task_woken             = task_woken_dl,
+#endif
+        .set_curr_task          = set_curr_task_dl,
+        .task_tick              = task_tick_dl,
+        .task_fork              = task_fork_dl,
+        .task_dead              = task_dead_dl,
+        .prio_changed           = prio_changed_dl,
+        .switched_from          = switched_from_dl,
+        .switched_to            = switched_to_dl,
+};
diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c
index 5c34d1817e8f..dd52e7ffb10e 100644
--- a/kernel/sched/debug.c
+++ b/kernel/sched/debug.c
@@ -139,7 +139,7 @@ print_task(struct seq_file *m, struct rq *rq, struct task_struct *p)
                0LL, 0LL, 0LL, 0L, 0LL, 0L, 0LL, 0L);
 #endif
 #ifdef CONFIG_NUMA_BALANCING
-        SEQ_printf(m, " %d", cpu_to_node(task_cpu(p)));
+        SEQ_printf(m, " %d", task_node(p));
 #endif
 #ifdef CONFIG_CGROUP_SCHED
        SEQ_printf(m, " %s", task_group_path(task_group(p)));
@@ -371,7 +371,7 @@ static void sched_debug_header(struct seq_file *m)
        PN(cpu_clk);
        P(jiffies);
 #ifdef CONFIG_HAVE_UNSTABLE_SCHED_CLOCK
-        P(sched_clock_stable);
+        P(sched_clock_stable());
 #endif
 #undef PN
 #undef P
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index c7395d97e4cb..b24b6cfde9aa 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -872,15 +872,6 @@ static unsigned int task_scan_max(struct task_struct *p)
        return max(smin, smax);
 }
-/*
- * Once a preferred node is selected the scheduler balancer will prefer moving
- * a task to that node for sysctl_numa_balancing_settle_count number of PTE
- * scans. This will give the process the chance to accumulate more faults on
- * the preferred node but still allow the scheduler to move the task again if
- * the nodes CPUs are overloaded.
- */
-unsigned int sysctl_numa_balancing_settle_count __read_mostly = 4;
 static void account_numa_enqueue(struct rq *rq, struct task_struct *p)
 {
        rq->nr_numa_running += (p->numa_preferred_nid != -1);
@@ -930,7 +921,8 @@ static inline unsigned long group_faults(struct task_struct *p, int nid)
        if (!p->numa_group)
                return 0;
-        return p->numa_group->faults[2*nid] + p->numa_group->faults[2*nid+1];
+        return p->numa_group->faults[task_faults_idx(nid, 0)] +
+                p->numa_group->faults[task_faults_idx(nid, 1)];
 }
 /*
@@ -1023,7 +1015,7 @@ struct task_numa_env {
        struct numa_stats src_stats, dst_stats;
-        int imbalance_pct, idx;
+        int imbalance_pct;
        struct task_struct *best_task;
        long best_imp;
@@ -1211,7 +1203,7 @@ static int task_numa_migrate(struct task_struct *p)
         * elsewhere, so there is no point in (re)trying.
         */
        if (unlikely(!sd)) {
-                p->numa_preferred_nid = cpu_to_node(task_cpu(p));
+                p->numa_preferred_nid = task_node(p);
                return -EINVAL;
        }
@@ -1278,7 +1270,7 @@ static void numa_migrate_preferred(struct task_struct *p)
        p->numa_migrate_retry = jiffies + HZ;
        /* Success if task is already running on preferred CPU */
-        if (cpu_to_node(task_cpu(p)) == p->numa_preferred_nid)
+        if (task_node(p) == p->numa_preferred_nid)
                return;
        /* Otherwise, try migrate to a CPU on the preferred node */
@@ -1350,7 +1342,6 @@ static void update_task_scan_period(struct task_struct *p,
                 * scanning faster if shared accesses dominate as it may
                 * simply bounce migrations uselessly
                 */
-                period_slot = DIV_ROUND_UP(diff, NUMA_PERIOD_SLOTS);
                ratio = DIV_ROUND_UP(private * NUMA_PERIOD_SLOTS, (private + shared));
                diff = (diff * ratio) / NUMA_PERIOD_SLOTS;
        }
@@ -3923,7 +3914,7 @@ static long effective_load(struct task_group *tg, int cpu, long wl, long wg)
 {
        struct sched_entity *se = tg->se[cpu];
-        if (!tg->parent || !wl) /* the trivial, non-cgroup case */
+        if (!tg->parent)        /* the trivial, non-cgroup case */
                return wl;
        for_each_sched_entity(se) {
@@ -4101,12 +4092,16 @@ static int wake_affine(struct sched_domain *sd, struct task_struct *p, int sync)
 */
 static struct sched_group *
 find_idlest_group(struct sched_domain *sd, struct task_struct *p,
-                  int this_cpu, int load_idx)
+                  int this_cpu, int sd_flag)
 {
        struct sched_group *idlest = NULL, *group = sd->groups;
        unsigned long min_load = ULONG_MAX, this_load = 0;
+        int load_idx = sd->forkexec_idx;
        int imbalance = 100 + (sd->imbalance_pct-100)/2;
+        if (sd_flag & SD_BALANCE_WAKE)
+                load_idx = sd->wake_idx;
        do {
                unsigned long load, avg_load;
                int local_group;
@@ -4274,7 +4269,6 @@ select_task_rq_fair(struct task_struct *p, int prev_cpu, int sd_flag, int wake_f
        }
        while (sd) {
-                int load_idx = sd->forkexec_idx;
                struct sched_group *group;
                int weight;
@@ -4283,10 +4277,7 @@ select_task_rq_fair(struct task_struct *p, int prev_cpu, int sd_flag, int wake_f
                        continue;
                }
-                if (sd_flag & SD_BALANCE_WAKE)
+                group = find_idlest_group(sd, p, cpu, sd_flag);
-                        load_idx = sd->wake_idx;
-                group = find_idlest_group(sd, p, cpu, load_idx);
                if (!group) {
                        sd = sd->child;
                        continue;
@@ -5512,7 +5503,6 @@ static inline void update_sg_lb_stats(struct lb_env *env,
                        struct sched_group *group, int load_idx,
                        int local_group, struct sg_lb_stats *sgs)
 {
-        unsigned long nr_running;
        unsigned long load;
        int i;
@@ -5521,8 +5511,6 @@ static inline void update_sg_lb_stats(struct lb_env *env,
        for_each_cpu_and(i, sched_group_cpus(group), env->cpus) {
                struct rq *rq = cpu_rq(i);
-                nr_running = rq->nr_running;
                /* Bias balancing toward cpus of our domain */
                if (local_group)
                        load = target_load(i, load_idx);
@@ -5530,7 +5518,7 @@ static inline void update_sg_lb_stats(struct lb_env *env,
                        load = source_load(i, load_idx);
                sgs->group_load += load;
-                sgs->sum_nr_running += nr_running;
+                sgs->sum_nr_running += rq->nr_running;
 #ifdef CONFIG_NUMA_BALANCING
                sgs->nr_numa_running += rq->nr_numa_running;
                sgs->nr_preferred_running += rq->nr_preferred_running;
@@ -6521,7 +6509,7 @@ static struct {
        unsigned long next_balance;     /* in jiffy units */
 } nohz ____cacheline_aligned;
-static inline int find_new_ilb(int call_cpu)
+static inline int find_new_ilb(void)
 {
        int ilb = cpumask_first(nohz.idle_cpus_mask);
@@ -6536,13 +6524,13 @@ static inline int find_new_ilb(int call_cpu)
 * nohz_load_balancer CPU (if there is one) otherwise fallback to any idle
 * CPU (if there is one).
 */
-static void nohz_balancer_kick(int cpu)
+static void nohz_balancer_kick(void)
 {
        int ilb_cpu;
        nohz.next_balance++;
-        ilb_cpu = find_new_ilb(cpu);
+        ilb_cpu = find_new_ilb();
        if (ilb_cpu >= nr_cpu_ids)
                return;
@@ -6652,10 +6640,10 @@ void update_max_interval(void)
 *
 * Balancing parameters are set up in init_sched_domains.
 */
-static void rebalance_domains(int cpu, enum cpu_idle_type idle)
+static void rebalance_domains(struct rq *rq, enum cpu_idle_type idle)
 {
        int continue_balancing = 1;
-        struct rq *rq = cpu_rq(cpu);
+        int cpu = rq->cpu;
        unsigned long interval;
        struct sched_domain *sd;
        /* Earliest time when we have to do rebalance again */
@@ -6752,9 +6740,9 @@ out:
 * In CONFIG_NO_HZ_COMMON case, the idle balance kickee will do the
 * rebalancing for all the cpus for whom scheduler ticks are stopped.
 */
-static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle)
+static void nohz_idle_balance(struct rq *this_rq, enum cpu_idle_type idle)
 {
-        struct rq *this_rq = cpu_rq(this_cpu);
+        int this_cpu = this_rq->cpu;
        struct rq *rq;
        int balance_cpu;
@@ -6781,7 +6769,7 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle)
                update_idle_cpu_load(rq);
                raw_spin_unlock_irq(&rq->lock);
-                rebalance_domains(balance_cpu, CPU_IDLE);
+                rebalance_domains(rq, CPU_IDLE);
                if (time_after(this_rq->next_balance, rq->next_balance))
                        this_rq->next_balance = rq->next_balance;
@@ -6800,14 +6788,14 @@ end:
 *   - For SD_ASYM_PACKING, if the lower numbered cpu's in the scheduler
 *     domain span are idle.
 */
-static inline int nohz_kick_needed(struct rq *rq, int cpu)
+static inline int nohz_kick_needed(struct rq *rq)
 {
        unsigned long now = jiffies;
        struct sched_domain *sd;
        struct sched_group_power *sgp;
-        int nr_busy;
+        int nr_busy, cpu = rq->cpu;
-        if (unlikely(idle_cpu(cpu)))
+        if (unlikely(rq->idle_balance))
                return 0;
       /*
@@ -6856,7 +6844,7 @@ need_kick:
        return 1;
 }
 #else
-static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) { }
+static void nohz_idle_balance(struct rq *this_rq, enum cpu_idle_type idle) { }
 #endif
 /*
@@ -6865,38 +6853,39 @@ static void nohz_idle_balance(int this_cpu, enum cpu_idle_type idle) { }
 */
 static void run_rebalance_domains(struct softirq_action *h)
 {
-        int this_cpu = smp_processor_id();
+        struct rq *this_rq = this_rq();
-        struct rq *this_rq = cpu_rq(this_cpu);
        enum cpu_idle_type idle = this_rq->idle_balance ?
                                                CPU_IDLE : CPU_NOT_IDLE;
-        rebalance_domains(this_cpu, idle);
+        rebalance_domains(this_rq, idle);
        /*
         * If this cpu has a pending nohz_balance_kick, then do the
         * balancing on behalf of the other idle cpus whose ticks are
         * stopped.
         */
-        nohz_idle_balance(this_cpu, idle);
+        nohz_idle_balance(this_rq, idle);
 }
-static inline int on_null_domain(int cpu)
+static inline int on_null_domain(struct rq *rq)
 {
-        return !rcu_dereference_sched(cpu_rq(cpu)->sd);
+        return !rcu_dereference_sched(rq->sd);
 }
 /*
 * Trigger the SCHED_SOFTIRQ if it is time to do periodic load balancing.
 */
-void trigger_load_balance(struct rq *rq, int cpu)
+void trigger_load_balance(struct rq *rq)
 {
        /* Don't need to rebalance while attached to NULL domain */
-        if (time_after_eq(jiffies, rq->next_balance) &&
+        if (unlikely(on_null_domain(rq)))
-            likely(!on_null_domain(cpu)))
+                return;
+        if (time_after_eq(jiffies, rq->next_balance))
                raise_softirq(SCHED_SOFTIRQ);
 #ifdef CONFIG_NO_HZ_COMMON
-        if (nohz_kick_needed(rq, cpu) && likely(!on_null_domain(cpu)))
+        if (nohz_kick_needed(rq))
-                nohz_balancer_kick(cpu);
+                nohz_balancer_kick();
 #endif
 }
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index 1c4065575fa2..a2740b775b45 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -1738,7 +1738,7 @@ static void task_woken_rt(struct rq *rq, struct task_struct *p)
            !test_tsk_need_resched(rq->curr) &&
            has_pushable_tasks(rq) &&
            p->nr_cpus_allowed > 1 &&
-            rt_task(rq->curr) &&
+            (dl_task(rq->curr) || rt_task(rq->curr)) &&
            (rq->curr->nr_cpus_allowed < 2 ||
             rq->curr->prio <= p->prio))
                push_rt_tasks(rq);
diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h
index 88c85b21d633..c2119fd20f8b 100644
--- a/kernel/sched/sched.h
+++ b/kernel/sched/sched.h
@@ -2,6 +2,7 @@
 #include <linux/sched.h>
 #include <linux/sched/sysctl.h>
 #include <linux/sched/rt.h>
+#include <linux/sched/deadline.h>
 #include <linux/mutex.h>
 #include <linux/spinlock.h>
 #include <linux/stop_machine.h>
@@ -9,6 +10,7 @@
 #include <linux/slab.h>
 #include "cpupri.h"
+#include "cpudeadline.h"
 #include "cpuacct.h"
 struct rq;
@@ -73,6 +75,13 @@ extern void update_cpu_load_active(struct rq *this_rq);
 #define NICE_0_SHIFT            SCHED_LOAD_SHIFT
 /*
+ * Single value that decides SCHED_DEADLINE internal math precision.
+ * 10 -> just above 1us
+ * 9  -> just above 0.5us
+ */
+#define DL_SCALE (10)
+/*
 * These are the 'tuning knobs' of the scheduler:
 */
@@ -81,11 +90,19 @@ extern void update_cpu_load_active(struct rq *this_rq);
 */
 #define RUNTIME_INF     ((u64)~0ULL)
+static inline int fair_policy(int policy)
+{
+        return policy == SCHED_NORMAL || policy == SCHED_BATCH;
+}
 static inline int rt_policy(int policy)
 {
-        if (policy == SCHED_FIFO || policy == SCHED_RR)
+        return policy == SCHED_FIFO || policy == SCHED_RR;
-                return 1;
+}
-        return 0;
+static inline int dl_policy(int policy)
+{
+        return policy == SCHED_DEADLINE;
 }
 static inline int task_has_rt_policy(struct task_struct *p)
@@ -93,6 +110,25 @@ static inline int task_has_rt_policy(struct task_struct *p)
        return rt_policy(p->policy);
 }
+static inline int task_has_dl_policy(struct task_struct *p)
+{
+        return dl_policy(p->policy);
+}
+static inline bool dl_time_before(u64 a, u64 b)
+{
+        return (s64)(a - b) < 0;
+}
+/*
+ * Tells if entity @a should preempt entity @b.
+ */
+static inline bool
+dl_entity_preempt(struct sched_dl_entity *a, struct sched_dl_entity *b)
+{
+        return dl_time_before(a->deadline, b->deadline);
+}
 /*
 * This is the priority-queue data structure of the RT scheduling class:
 */
@@ -108,6 +144,47 @@ struct rt_bandwidth {
        u64                     rt_runtime;
        struct hrtimer          rt_period_timer;
 };
+/*
+ * To keep the bandwidth of -deadline tasks and groups under control
+ * we need some place where:
+ *  - store the maximum -deadline bandwidth of the system (the group);
+ *  - cache the fraction of that bandwidth that is currently allocated.
+ *
+ * This is all done in the data structure below. It is similar to the
+ * one used for RT-throttling (rt_bandwidth), with the main difference
+ * that, since here we are only interested in admission control, we
+ * do not decrease any runtime while the group "executes", neither we
+ * need a timer to replenish it.
+ *
+ * With respect to SMP, the bandwidth is given on a per-CPU basis,
+ * meaning that:
+ *  - dl_bw (< 100%) is the bandwidth of the system (group) on each CPU;
+ *  - dl_total_bw array contains, in the i-eth element, the currently
+ *    allocated bandwidth on the i-eth CPU.
+ * Moreover, groups consume bandwidth on each CPU, while tasks only
+ * consume bandwidth on the CPU they're running on.
+ * Finally, dl_total_bw_cpu is used to cache the index of dl_total_bw
+ * that will be shown the next time the proc or cgroup controls will
+ * be red. It on its turn can be changed by writing on its own
+ * control.
+ */
+struct dl_bandwidth {
+        raw_spinlock_t dl_runtime_lock;
+        u64 dl_runtime;
+        u64 dl_period;
+};
+static inline int dl_bandwidth_enabled(void)
+{
+        return sysctl_sched_rt_runtime >= 0;
+}
+extern struct dl_bw *dl_bw_of(int i);
+struct dl_bw {
+        raw_spinlock_t lock;
+        u64 bw, total_bw;
+};
 extern struct mutex sched_domains_mutex;
@@ -364,6 +441,42 @@ struct rt_rq {
 #endif
 };
+/* Deadline class' related fields in a runqueue */
+struct dl_rq {
+        /* runqueue is an rbtree, ordered by deadline */
+        struct rb_root rb_root;
+        struct rb_node *rb_leftmost;
+        unsigned long dl_nr_running;
+#ifdef CONFIG_SMP
+        /*
+         * Deadline values of the currently executing and the
+         * earliest ready task on this rq. Caching these facilitates
+         * the decision wether or not a ready but not running task
+         * should migrate somewhere else.
+         */
+        struct {
+                u64 curr;
+                u64 next;
+        } earliest_dl;
+        unsigned long dl_nr_migratory;
+        unsigned long dl_nr_total;
+        int overloaded;
+        /*
+         * Tasks on this rq that can be pushed away. They are kept in
+         * an rb-tree, ordered by tasks' deadlines, with caching
+         * of the leftmost (earliest deadline) element.
+         */
+        struct rb_root pushable_dl_tasks_root;
+        struct rb_node *pushable_dl_tasks_leftmost;
+#else
+        struct dl_bw dl_bw;
+#endif
+};
 #ifdef CONFIG_SMP
 /*
@@ -382,6 +495,15 @@ struct root_domain {
        cpumask_var_t online;
        /*
+         * The bit corresponding to a CPU gets set here if such CPU has more
+         * than one runnable -deadline task (as it is below for RT tasks).
+         */
+        cpumask_var_t dlo_mask;
+        atomic_t dlo_count;
+        struct dl_bw dl_bw;
+        struct cpudl cpudl;
+        /*
         * The "RT overload" flag: it gets set if a CPU has more than
         * one runnable RT task.
         */
@@ -432,6 +554,7 @@ struct rq {
        struct cfs_rq cfs;
        struct rt_rq rt;
+        struct dl_rq dl;
 #ifdef CONFIG_FAIR_GROUP_SCHED
        /* list of leaf cfs_rq on this cpu: */
@@ -827,8 +950,6 @@ static inline u64 global_rt_runtime(void)
        return (u64)sysctl_sched_rt_runtime * NSEC_PER_USEC;
 }
 static inline int task_current(struct rq *rq, struct task_struct *p)
 {
        return rq->curr == p;
@@ -988,6 +1109,7 @@ static const u32 prio_to_wmult[40] = {
 #else
 #define ENQUEUE_WAKING          0
 #endif
+#define ENQUEUE_REPLENISH       8
 #define DEQUEUE_SLEEP           1
@@ -1023,6 +1145,7 @@ struct sched_class {
        void (*set_curr_task) (struct rq *rq);
        void (*task_tick) (struct rq *rq, struct task_struct *p, int queued);
        void (*task_fork) (struct task_struct *p);
+        void (*task_dead) (struct task_struct *p);
        void (*switched_from) (struct rq *this_rq, struct task_struct *task);
        void (*switched_to) (struct rq *this_rq, struct task_struct *task);
@@ -1042,6 +1165,7 @@ struct sched_class {
   for (class = sched_class_highest; class; class = class->next)
 extern const struct sched_class stop_sched_class;
+extern const struct sched_class dl_sched_class;
 extern const struct sched_class rt_sched_class;
 extern const struct sched_class fair_sched_class;
 extern const struct sched_class idle_sched_class;
@@ -1051,7 +1175,7 @@ extern const struct sched_class idle_sched_class;
 extern void update_group_power(struct sched_domain *sd, int cpu);
-extern void trigger_load_balance(struct rq *rq, int cpu);
+extern void trigger_load_balance(struct rq *rq);
 extern void idle_balance(int this_cpu, struct rq *this_rq);
 extern void idle_enter_fair(struct rq *this_rq);
@@ -1068,8 +1192,11 @@ static inline void idle_balance(int cpu, struct rq *rq)
 extern void sysrq_sched_debug_show(void);
 extern void sched_init_granularity(void);
 extern void update_max_interval(void);
+extern void init_sched_dl_class(void);
 extern void init_sched_rt_class(void);
 extern void init_sched_fair_class(void);
+extern void init_sched_dl_class(void);
 extern void resched_task(struct task_struct *p);
 extern void resched_cpu(int cpu);
@@ -1077,6 +1204,12 @@ extern void resched_cpu(int cpu);
 extern struct rt_bandwidth def_rt_bandwidth;
 extern void init_rt_bandwidth(struct rt_bandwidth *rt_b, u64 period, u64 runtime);
+extern struct dl_bandwidth def_dl_bandwidth;
+extern void init_dl_bandwidth(struct dl_bandwidth *dl_b, u64 period, u64 runtime);
+extern void init_dl_task_timer(struct sched_dl_entity *dl_se);
+unsigned long to_ratio(u64 period, u64 runtime);
 extern void update_idle_cpu_load(struct rq *this_rq);
 extern void init_task_runnable_average(struct task_struct *p);
@@ -1353,6 +1486,7 @@ extern void print_rt_stats(struct seq_file *m, int cpu);
 extern void init_cfs_rq(struct cfs_rq *cfs_rq);
 extern void init_rt_rq(struct rt_rq *rt_rq, struct rq *rq);
+extern void init_dl_rq(struct dl_rq *dl_rq, struct rq *rq);
 extern void cfs_bandwidth_usage_inc(void);
 extern void cfs_bandwidth_usage_dec(void);
diff --git a/kernel/sched/stop_task.c b/kernel/sched/stop_task.c
index 47197de8abd9..fdb6bb0b3356 100644
--- a/kernel/sched/stop_task.c
+++ b/kernel/sched/stop_task.c
@@ -103,7 +103,7 @@ get_rr_interval_stop(struct rq *rq, struct task_struct *task)
 * Simple, special scheduling class for the per-CPU stop tasks:
 */
 const struct sched_class stop_sched_class = {
-        .next                   = &rt_sched_class,
+        .next                   = &dl_sched_class,
        .enqueue_task           = enqueue_task_stop,
        .dequeue_task           = dequeue_task_stop,
diff --git a/kernel/softirq.c b/kernel/softirq.c
index 11025ccc06dd..8a1e6e104892 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -89,7 +89,7 @@ static void wakeup_softirqd(void)
 * where hardirqs are disabled legitimately:
 */
 #ifdef CONFIG_TRACE_IRQFLAGS
-static void __local_bh_disable(unsigned long ip, unsigned int cnt)
+void __local_bh_disable_ip(unsigned long ip, unsigned int cnt)
 {
        unsigned long flags;
@@ -107,33 +107,21 @@ static void __local_bh_disable(unsigned long ip, unsigned int cnt)
        /*
         * Were softirqs turned off above:
         */
-        if (softirq_count() == cnt)
+        if (softirq_count() == (cnt & SOFTIRQ_MASK))
                trace_softirqs_off(ip);
        raw_local_irq_restore(flags);
        if (preempt_count() == cnt)
                trace_preempt_off(CALLER_ADDR0, get_parent_ip(CALLER_ADDR1));
 }
-#else /* !CONFIG_TRACE_IRQFLAGS */
+EXPORT_SYMBOL(__local_bh_disable_ip);
-static inline void __local_bh_disable(unsigned long ip, unsigned int cnt)
-{
-        preempt_count_add(cnt);
-        barrier();
-}
 #endif /* CONFIG_TRACE_IRQFLAGS */
-void local_bh_disable(void)
-{
-        __local_bh_disable(_RET_IP_, SOFTIRQ_DISABLE_OFFSET);
-}
-EXPORT_SYMBOL(local_bh_disable);
 static void __local_bh_enable(unsigned int cnt)
 {
        WARN_ON_ONCE(!irqs_disabled());
-        if (softirq_count() == cnt)
+        if (softirq_count() == (cnt & SOFTIRQ_MASK))
                trace_softirqs_on(_RET_IP_);
        preempt_count_sub(cnt);
 }
@@ -151,7 +139,7 @@ void _local_bh_enable(void)
 EXPORT_SYMBOL(_local_bh_enable);
-static inline void _local_bh_enable_ip(unsigned long ip)
+void __local_bh_enable_ip(unsigned long ip, unsigned int cnt)
 {
        WARN_ON_ONCE(in_irq() || irqs_disabled());
 #ifdef CONFIG_TRACE_IRQFLAGS
@@ -166,7 +154,7 @@ static inline void _local_bh_enable_ip(unsigned long ip)
         * Keep preemption disabled until we are done with
         * softirq processing:
         */
-        preempt_count_sub(SOFTIRQ_DISABLE_OFFSET - 1);
+        preempt_count_sub(cnt - 1);
        if (unlikely(!in_interrupt() && local_softirq_pending())) {
                /*
@@ -182,18 +170,7 @@ static inline void _local_bh_enable_ip(unsigned long ip)
 #endif
        preempt_check_resched();
 }
+EXPORT_SYMBOL(__local_bh_enable_ip);
-void local_bh_enable(void)
-{
-        _local_bh_enable_ip(_RET_IP_);
-}
-EXPORT_SYMBOL(local_bh_enable);
-void local_bh_enable_ip(unsigned long ip)
-{
-        _local_bh_enable_ip(ip);
-}
-EXPORT_SYMBOL(local_bh_enable_ip);
 /*
 * We restart softirq processing for at most MAX_SOFTIRQ_RESTART times,
@@ -211,14 +188,48 @@ EXPORT_SYMBOL(local_bh_enable_ip);
 #define MAX_SOFTIRQ_TIME  msecs_to_jiffies(2)
 #define MAX_SOFTIRQ_RESTART 10
+#ifdef CONFIG_TRACE_IRQFLAGS
+/*
+ * When we run softirqs from irq_exit() and thus on the hardirq stack we need
+ * to keep the lockdep irq context tracking as tight as possible in order to
+ * not miss-qualify lock contexts and miss possible deadlocks.
+ */
+static inline bool lockdep_softirq_start(void)
+{
+        bool in_hardirq = false;
+        if (trace_hardirq_context(current)) {
+                in_hardirq = true;
+                trace_hardirq_exit();
+        }
+        lockdep_softirq_enter();
+        return in_hardirq;
+}
+static inline void lockdep_softirq_end(bool in_hardirq)
+{
+        lockdep_softirq_exit();
+        if (in_hardirq)
+                trace_hardirq_enter();
+}
+#else
+static inline bool lockdep_softirq_start(void) { return false; }
+static inline void lockdep_softirq_end(bool in_hardirq) { }
+#endif
 asmlinkage void __do_softirq(void)
 {
-        struct softirq_action *h;
-        __u32 pending;
        unsigned long end = jiffies + MAX_SOFTIRQ_TIME;
-        int cpu;
        unsigned long old_flags = current->flags;
        int max_restart = MAX_SOFTIRQ_RESTART;
+        struct softirq_action *h;
+        bool in_hardirq;
+        __u32 pending;
+        int cpu;
        /*
         * Mask out PF_MEMALLOC s current task context is borrowed for the
@@ -230,8 +241,8 @@ asmlinkage void __do_softirq(void)
        pending = local_softirq_pending();
        account_irq_enter_time(current);
-        __local_bh_disable(_RET_IP_, SOFTIRQ_OFFSET);
+        __local_bh_disable_ip(_RET_IP_, SOFTIRQ_OFFSET);
-        lockdep_softirq_enter();
+        in_hardirq = lockdep_softirq_start();
        cpu = smp_processor_id();
 restart:
@@ -278,16 +289,13 @@ restart:
                wakeup_softirqd();
        }
-        lockdep_softirq_exit();
+        lockdep_softirq_end(in_hardirq);
        account_irq_exit_time(current);
        __local_bh_enable(SOFTIRQ_OFFSET);
        WARN_ON_ONCE(in_interrupt());
        tsk_restore_flags(current, old_flags, PF_MEMALLOC);
 }
 asmlinkage void do_softirq(void)
 {
        __u32 pending;
@@ -311,8 +319,6 @@ asmlinkage void do_softirq(void)
 */
 void irq_enter(void)
 {
-        int cpu = smp_processor_id();
        rcu_irq_enter();
        if (is_idle_task(current) && !in_interrupt()) {
                /*
@@ -320,7 +326,7 @@ void irq_enter(void)
                 * here, as softirq will be serviced on return from interrupt.
                 */
                local_bh_disable();
-                tick_check_idle(cpu);
+                tick_check_idle();
                _local_bh_enable();
        }
@@ -375,13 +381,13 @@ void irq_exit(void)
 #endif
        account_irq_exit_time(current);
-        trace_hardirq_exit();
        preempt_count_sub(HARDIRQ_OFFSET);
        if (!in_interrupt() && local_softirq_pending())
                invoke_softirq();
        tick_irq_exit();
        rcu_irq_exit();
+        trace_hardirq_exit(); /* must be last! */
 }
 /*
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 34a604726d0b..c8da99f905cf 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -385,13 +385,6 @@ static struct ctl_table kern_table[] = {
                .proc_handler   = proc_dointvec,
        },
        {
-                .procname       = "numa_balancing_settle_count",
-                .data           = &sysctl_numa_balancing_settle_count,
-                .maxlen         = sizeof(unsigned int),
-                .mode           = 0644,
-                .proc_handler   = proc_dointvec,
-        },
-        {
                .procname       = "numa_balancing_migrate_deferred",
                .data           = &sysctl_numa_balancing_migrate_deferred,
                .maxlen         = sizeof(unsigned int),
diff --git a/kernel/time/sched_clock.c b/kernel/time/sched_clock.c
index 68b799375981..0abb36464281 100644
--- a/kernel/time/sched_clock.c
+++ b/kernel/time/sched_clock.c
@@ -74,7 +74,7 @@ unsigned long long notrace sched_clock(void)
                return cd.epoch_ns;
        do {
-                seq = read_seqcount_begin(&cd.seq);
+                seq = raw_read_seqcount_begin(&cd.seq);
                epoch_cyc = cd.epoch_cyc;
                epoch_ns = cd.epoch_ns;
        } while (read_seqcount_retry(&cd.seq, seq));
@@ -99,10 +99,10 @@ static void notrace update_sched_clock(void)
                          cd.mult, cd.shift);
        raw_local_irq_save(flags);
-        write_seqcount_begin(&cd.seq);
+        raw_write_seqcount_begin(&cd.seq);
        cd.epoch_ns = ns;
        cd.epoch_cyc = cyc;
-        write_seqcount_end(&cd.seq);
+        raw_write_seqcount_end(&cd.seq);
        raw_local_irq_restore(flags);
 }
diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c
index 9532690daaa9..43780ab5e279 100644
--- a/kernel/time/tick-broadcast.c
+++ b/kernel/time/tick-broadcast.c
@@ -538,10 +538,10 @@ int tick_resume_broadcast_oneshot(struct clock_event_device *bc)
 * Called from irq_enter() when idle was interrupted to reenable the
 * per cpu device.
 */
-void tick_check_oneshot_broadcast(int cpu)
+void tick_check_oneshot_broadcast_this_cpu(void)
 {
-        if (cpumask_test_cpu(cpu, tick_broadcast_oneshot_mask)) {
+        if (cpumask_test_cpu(smp_processor_id(), tick_broadcast_oneshot_mask)) {
-                struct tick_device *td = &per_cpu(tick_cpu_device, cpu);
+                struct tick_device *td = &__get_cpu_var(tick_cpu_device);
                /*
                 * We might be in the middle of switching over from
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 162b03ab0ad2..20b2fe37d105 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -85,6 +85,7 @@ static void tick_periodic(int cpu)
                do_timer(1);
                write_sequnlock(&jiffies_lock);
+                update_wall_time();
        }
        update_process_times(user_mode(get_irq_regs()));
diff --git a/kernel/time/tick-internal.h b/kernel/time/tick-internal.h
index 18e71f7fbc2a..8329669b51ec 100644
--- a/kernel/time/tick-internal.h
+++ b/kernel/time/tick-internal.h
@@ -51,7 +51,7 @@ extern void tick_broadcast_switch_to_oneshot(void);
 extern void tick_shutdown_broadcast_oneshot(unsigned int *cpup);
 extern int tick_resume_broadcast_oneshot(struct clock_event_device *bc);
 extern int tick_broadcast_oneshot_active(void);
-extern void tick_check_oneshot_broadcast(int cpu);
+extern void tick_check_oneshot_broadcast_this_cpu(void);
 bool tick_broadcast_oneshot_available(void);
 # else /* BROADCAST */
 static inline void tick_broadcast_setup_oneshot(struct clock_event_device *bc)
@@ -62,7 +62,7 @@ static inline void tick_broadcast_oneshot_control(unsigned long reason) { }
 static inline void tick_broadcast_switch_to_oneshot(void) { }
 static inline void tick_shutdown_broadcast_oneshot(unsigned int *cpup) { }
 static inline int tick_broadcast_oneshot_active(void) { return 0; }
-static inline void tick_check_oneshot_broadcast(int cpu) { }
+static inline void tick_check_oneshot_broadcast_this_cpu(void) { }
 static inline bool tick_broadcast_oneshot_available(void) { return true; }
 # endif /* !BROADCAST */
@@ -155,3 +155,4 @@ static inline int tick_device_is_functional(struct clock_event_device *dev)
 #endif
 extern void do_timer(unsigned long ticks);
+extern void update_wall_time(void);
diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
index ea20f7d1ac2c..08cb0c3b8ccb 100644
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -86,6 +86,7 @@ static void tick_do_update_jiffies64(ktime_t now)
                tick_next_period = ktime_add(last_jiffies_update, tick_period);
        }
        write_sequnlock(&jiffies_lock);
+        update_wall_time();
 }
 /*
@@ -177,7 +178,7 @@ static bool can_stop_full_tick(void)
         * TODO: kick full dynticks CPUs when
         * sched_clock_stable is set.
         */
-        if (!sched_clock_stable) {
+        if (!sched_clock_stable()) {
                trace_tick_stop(0, "unstable sched clock\n");
                /*
                 * Don't allow the user to think they can get
@@ -391,11 +392,9 @@ __setup("nohz=", setup_tick_nohz);
 */
 static void tick_nohz_update_jiffies(ktime_t now)
 {
-        int cpu = smp_processor_id();
-        struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
        unsigned long flags;
-        ts->idle_waketime = now;
+        __this_cpu_write(tick_cpu_sched.idle_waketime, now);
        local_irq_save(flags);
        tick_do_update_jiffies64(now);
@@ -426,17 +425,15 @@ update_ts_time_stats(int cpu, struct tick_sched *ts, ktime_t now, u64 *last_upda
 }
-static void tick_nohz_stop_idle(int cpu, ktime_t now)
+static void tick_nohz_stop_idle(struct tick_sched *ts, ktime_t now)
 {
-        struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
+        update_ts_time_stats(smp_processor_id(), ts, now, NULL);
-        update_ts_time_stats(cpu, ts, now, NULL);
        ts->idle_active = 0;
        sched_clock_idle_wakeup_event(0);
 }
-static ktime_t tick_nohz_start_idle(int cpu, struct tick_sched *ts)
+static ktime_t tick_nohz_start_idle(struct tick_sched *ts)
 {
        ktime_t now = ktime_get();
@@ -754,7 +751,7 @@ static void __tick_nohz_idle_enter(struct tick_sched *ts)
        ktime_t now, expires;
        int cpu = smp_processor_id();
-        now = tick_nohz_start_idle(cpu, ts);
+        now = tick_nohz_start_idle(ts);
        if (can_stop_idle_tick(cpu, ts)) {
                int was_stopped = ts->tick_stopped;
@@ -911,8 +908,7 @@ static void tick_nohz_account_idle_ticks(struct tick_sched *ts)
 */
 void tick_nohz_idle_exit(void)
 {
-        int cpu = smp_processor_id();
+        struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
-        struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
        ktime_t now;
        local_irq_disable();
@@ -925,7 +921,7 @@ void tick_nohz_idle_exit(void)
                now = ktime_get();
        if (ts->idle_active)
-                tick_nohz_stop_idle(cpu, now);
+                tick_nohz_stop_idle(ts, now);
        if (ts->tick_stopped) {
                tick_nohz_restart_sched_tick(ts, now);
@@ -1009,12 +1005,10 @@ static void tick_nohz_switch_to_nohz(void)
 * timer and do not touch the other magic bits which need to be done
 * when idle is left.
 */
-static void tick_nohz_kick_tick(int cpu, ktime_t now)
+static void tick_nohz_kick_tick(struct tick_sched *ts, ktime_t now)
 {
 #if 0
        /* Switch back to 2.6.27 behaviour */
-        struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
        ktime_t delta;
        /*
@@ -1029,36 +1023,36 @@ static void tick_nohz_kick_tick(int cpu, ktime_t now)
 #endif
 }
-static inline void tick_check_nohz(int cpu)
+static inline void tick_check_nohz_this_cpu(void)
 {
-        struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
+        struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
        ktime_t now;
        if (!ts->idle_active && !ts->tick_stopped)
                return;
        now = ktime_get();
        if (ts->idle_active)
-                tick_nohz_stop_idle(cpu, now);
+                tick_nohz_stop_idle(ts, now);
        if (ts->tick_stopped) {
                tick_nohz_update_jiffies(now);
-                tick_nohz_kick_tick(cpu, now);
+                tick_nohz_kick_tick(ts, now);
        }
 }
 #else
 static inline void tick_nohz_switch_to_nohz(void) { }
-static inline void tick_check_nohz(int cpu) { }
+static inline void tick_check_nohz_this_cpu(void) { }
 #endif /* CONFIG_NO_HZ_COMMON */
 /*
 * Called from irq_enter to notify about the possible interruption of idle()
 */
-void tick_check_idle(int cpu)
+void tick_check_idle(void)
 {
-        tick_check_oneshot_broadcast(cpu);
+        tick_check_oneshot_broadcast_this_cpu();
-        tick_check_nohz(cpu);
+        tick_check_nohz_this_cpu();
 }
 /*
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 87b4f00284c9..0aa4ce81bc16 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -77,7 +77,7 @@ static void tk_set_wall_to_mono(struct timekeeper *tk, struct timespec wtm)
        tk->wall_to_monotonic = wtm;
        set_normalized_timespec(&tmp, -wtm.tv_sec, -wtm.tv_nsec);
        tk->offs_real = timespec_to_ktime(tmp);
-        tk->offs_tai = ktime_sub(tk->offs_real, ktime_set(tk->tai_offset, 0));
+        tk->offs_tai = ktime_add(tk->offs_real, ktime_set(tk->tai_offset, 0));
 }
 static void tk_set_sleep_time(struct timekeeper *tk, struct timespec t)
@@ -90,8 +90,9 @@ static void tk_set_sleep_time(struct timekeeper *tk, struct timespec t)
 }
 /**
- * timekeeper_setup_internals - Set up internals to use clocksource clock.
+ * tk_setup_internals - Set up internals to use clocksource clock.
 *
+ * @tk:         The target timekeeper to setup.
 * @clock:              Pointer to clocksource.
 *
 * Calculates a fixed cycle/nsec interval for a given clocksource/adjustment
@@ -595,7 +596,7 @@ s32 timekeeping_get_tai_offset(void)
 static void __timekeeping_set_tai_offset(struct timekeeper *tk, s32 tai_offset)
 {
        tk->tai_offset = tai_offset;
-        tk->offs_tai = ktime_sub(tk->offs_real, ktime_set(tai_offset, 0));
+        tk->offs_tai = ktime_add(tk->offs_real, ktime_set(tai_offset, 0));
 }
 /**
@@ -610,6 +611,7 @@ void timekeeping_set_tai_offset(s32 tai_offset)
        raw_spin_lock_irqsave(&timekeeper_lock, flags);
        write_seqcount_begin(&timekeeper_seq);
        __timekeeping_set_tai_offset(tk, tai_offset);
+        timekeeping_update(tk, TK_MIRROR | TK_CLOCK_WAS_SET);
        write_seqcount_end(&timekeeper_seq);
        raw_spin_unlock_irqrestore(&timekeeper_lock, flags);
        clock_was_set();
@@ -1023,6 +1025,8 @@ static int timekeeping_suspend(void)
                timekeeping_suspend_time =
                        timespec_add(timekeeping_suspend_time, delta_delta);
        }
+        timekeeping_update(tk, TK_MIRROR);
        write_seqcount_end(&timekeeper_seq);
        raw_spin_unlock_irqrestore(&timekeeper_lock, flags);
@@ -1130,16 +1134,6 @@ static void timekeeping_adjust(struct timekeeper *tk, s64 offset)
                 * we can adjust by 1.
                 */
                error >>= 2;
-                /*
-                 * XXX - In update_wall_time, we round up to the next
-                 * nanosecond, and store the amount rounded up into
-                 * the error. This causes the likely below to be unlikely.
-                 *
-                 * The proper fix is to avoid rounding up by using
-                 * the high precision tk->xtime_nsec instead of
-                 * xtime.tv_nsec everywhere. Fixing this will take some
-                 * time.
-                 */
                if (likely(error <= interval))
                        adj = 1;
                else
@@ -1255,7 +1249,7 @@ out_adjust:
 static inline unsigned int accumulate_nsecs_to_secs(struct timekeeper *tk)
 {
        u64 nsecps = (u64)NSEC_PER_SEC << tk->shift;
-        unsigned int action = 0;
+        unsigned int clock_set = 0;
        while (tk->xtime_nsec >= nsecps) {
                int leap;
@@ -1277,11 +1271,10 @@ static inline unsigned int accumulate_nsecs_to_secs(struct timekeeper *tk)
                        __timekeeping_set_tai_offset(tk, tk->tai_offset - leap);
-                        clock_was_set_delayed();
+                        clock_set = TK_CLOCK_WAS_SET;
-                        action = TK_CLOCK_WAS_SET;
                }
        }
-        return action;
+        return clock_set;
 }
 /**
@@ -1294,7 +1287,8 @@ static inline unsigned int accumulate_nsecs_to_secs(struct timekeeper *tk)
 * Returns the unconsumed cycles.
 */
 static cycle_t logarithmic_accumulation(struct timekeeper *tk, cycle_t offset,
-                                                u32 shift)
+                                                u32 shift,
+                                                unsigned int *clock_set)
 {
        cycle_t interval = tk->cycle_interval << shift;
        u64 raw_nsecs;
@@ -1308,7 +1302,7 @@ static cycle_t logarithmic_accumulation(struct timekeeper *tk, cycle_t offset,
        tk->cycle_last += interval;
        tk->xtime_nsec += tk->xtime_interval << shift;
-        accumulate_nsecs_to_secs(tk);
+        *clock_set |= accumulate_nsecs_to_secs(tk);
        /* Accumulate raw time */
        raw_nsecs = (u64)tk->raw_interval << shift;
@@ -1359,14 +1353,14 @@ static inline void old_vsyscall_fixup(struct timekeeper *tk)
 * update_wall_time - Uses the current clocksource to increment the wall time
 *
 */
-static void update_wall_time(void)
+void update_wall_time(void)
 {
        struct clocksource *clock;
        struct timekeeper *real_tk = &timekeeper;
        struct timekeeper *tk = &shadow_timekeeper;
        cycle_t offset;
        int shift = 0, maxshift;
-        unsigned int action;
+        unsigned int clock_set = 0;
        unsigned long flags;
        raw_spin_lock_irqsave(&timekeeper_lock, flags);
@@ -1401,7 +1395,8 @@ static void update_wall_time(void)
        maxshift = (64 - (ilog2(ntp_tick_length())+1)) - 1;
        shift = min(shift, maxshift);
        while (offset >= tk->cycle_interval) {
-                offset = logarithmic_accumulation(tk, offset, shift);
+                offset = logarithmic_accumulation(tk, offset, shift,
+                                                        &clock_set);
                if (offset < tk->cycle_interval<<shift)
                        shift--;
        }
@@ -1419,7 +1414,7 @@ static void update_wall_time(void)
         * Finally, make sure that after the rounding
         * xtime_nsec isn't larger than NSEC_PER_SEC
         */
-        action = accumulate_nsecs_to_secs(tk);
+        clock_set |= accumulate_nsecs_to_secs(tk);
        write_seqcount_begin(&timekeeper_seq);
        /* Update clock->cycle_last with the new value */
@@ -1435,10 +1430,12 @@ static void update_wall_time(void)
         * updating.
         */
        memcpy(real_tk, tk, sizeof(*tk));
-        timekeeping_update(real_tk, action);
+        timekeeping_update(real_tk, clock_set);
        write_seqcount_end(&timekeeper_seq);
 out:
        raw_spin_unlock_irqrestore(&timekeeper_lock, flags);
+        if (clock_set)
+                clock_was_set();
 }
 /**
@@ -1583,7 +1580,6 @@ struct timespec get_monotonic_coarse(void)
 void do_timer(unsigned long ticks)
 {
        jiffies_64 += ticks;
-        update_wall_time();
        calc_global_load(ticks);
 }
@@ -1698,12 +1694,14 @@ int do_adjtimex(struct timex *txc)
        if (tai != orig_tai) {
                __timekeeping_set_tai_offset(tk, tai);
-                update_pvclock_gtod(tk, true);
+                timekeeping_update(tk, TK_MIRROR | TK_CLOCK_WAS_SET);
-                clock_was_set_delayed();
        }
        write_seqcount_end(&timekeeper_seq);
        raw_spin_unlock_irqrestore(&timekeeper_lock, flags);
+        if (tai != orig_tai)
+                clock_was_set();
        ntp_notify_cmos_timer();
        return ret;
@@ -1739,4 +1737,5 @@ void xtime_update(unsigned long ticks)
        write_seqlock(&jiffies_lock);
        do_timer(ticks);
        write_sequnlock(&jiffies_lock);
+        update_wall_time();
 }
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index cc2f66f68dc5..294b8a271a04 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2558,7 +2558,7 @@ rb_reserve_next_event(struct ring_buffer *buffer,
                if (unlikely(test_time_stamp(delta))) {
                        int local_clock_stable = 1;
 #ifdef CONFIG_HAVE_UNSTABLE_SCHED_CLOCK
-                        local_clock_stable = sched_clock_stable;
+                        local_clock_stable = sched_clock_stable();
 #endif
                        WARN_ONCE(delta > (1ULL << 59),
                                  KERN_WARNING "Delta way too big! %llu ts=%llu write stamp = %llu\n%s",
diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
index fee77e15d815..6e32635e5e57 100644
--- a/kernel/trace/trace_sched_wakeup.c
+++ b/kernel/trace/trace_sched_wakeup.c
@@ -16,6 +16,7 @@
 #include <linux/uaccess.h>
 #include <linux/ftrace.h>
 #include <linux/sched/rt.h>
+#include <linux/sched/deadline.h>
 #include <trace/events/sched.h>
 #include "trace.h"
@@ -27,6 +28,8 @@ static int			wakeup_cpu;
 static int                      wakeup_current_cpu;
 static unsigned                 wakeup_prio = -1;
 static int                      wakeup_rt;
+static int                      wakeup_dl;
+static int                      tracing_dl = 0;
 static arch_spinlock_t wakeup_lock =
        (arch_spinlock_t)__ARCH_SPIN_LOCK_UNLOCKED;
@@ -437,6 +440,7 @@ static void __wakeup_reset(struct trace_array *tr)
 {
        wakeup_cpu = -1;
        wakeup_prio = -1;
+        tracing_dl = 0;
        if (wakeup_task)
                put_task_struct(wakeup_task);
@@ -472,9 +476,17 @@ probe_wakeup(void *ignore, struct task_struct *p, int success)
        tracing_record_cmdline(p);
        tracing_record_cmdline(current);
-        if ((wakeup_rt && !rt_task(p)) ||
+        /*
-                        p->prio >= wakeup_prio ||
+         * Semantic is like this:
-                        p->prio >= current->prio)
+         *  - wakeup tracer handles all tasks in the system, independently
+         *    from their scheduling class;
+         *  - wakeup_rt tracer handles tasks belonging to sched_dl and
+         *    sched_rt class;
+         *  - wakeup_dl handles tasks belonging to sched_dl class only.
+         */
+        if (tracing_dl || (wakeup_dl && !dl_task(p)) ||
+            (wakeup_rt && !dl_task(p) && !rt_task(p)) ||
+            (!dl_task(p) && (p->prio >= wakeup_prio || p->prio >= current->prio)))
                return;
        pc = preempt_count();
@@ -486,7 +498,8 @@ probe_wakeup(void *ignore, struct task_struct *p, int success)
        arch_spin_lock(&wakeup_lock);
        /* check for races. */
-        if (!tracer_enabled || p->prio >= wakeup_prio)
+        if (!tracer_enabled || tracing_dl ||
+            (!dl_task(p) && p->prio >= wakeup_prio))
                goto out_locked;
        /* reset the trace */
@@ -496,6 +509,15 @@ probe_wakeup(void *ignore, struct task_struct *p, int success)
        wakeup_current_cpu = wakeup_cpu;
        wakeup_prio = p->prio;
+        /*
+         * Once you start tracing a -deadline task, don't bother tracing
+         * another task until the first one wakes up.
+         */
+        if (dl_task(p))
+                tracing_dl = 1;
+        else
+                tracing_dl = 0;
        wakeup_task = p;
        get_task_struct(wakeup_task);
@@ -597,16 +619,25 @@ static int __wakeup_tracer_init(struct trace_array *tr)
 static int wakeup_tracer_init(struct trace_array *tr)
 {
+        wakeup_dl = 0;
        wakeup_rt = 0;
        return __wakeup_tracer_init(tr);
 }
 static int wakeup_rt_tracer_init(struct trace_array *tr)
 {
+        wakeup_dl = 0;
        wakeup_rt = 1;
        return __wakeup_tracer_init(tr);
 }
+static int wakeup_dl_tracer_init(struct trace_array *tr)
+{
+        wakeup_dl = 1;
+        wakeup_rt = 0;
+        return __wakeup_tracer_init(tr);
+}
 static void wakeup_tracer_reset(struct trace_array *tr)
 {
        int lat_flag = save_flags & TRACE_ITER_LATENCY_FMT;
@@ -674,6 +705,28 @@ static struct tracer wakeup_rt_tracer __read_mostly =
        .use_max_tr     = true,
 };
+static struct tracer wakeup_dl_tracer __read_mostly =
+{
+        .name           = "wakeup_dl",
+        .init           = wakeup_dl_tracer_init,
+        .reset          = wakeup_tracer_reset,
+        .start          = wakeup_tracer_start,
+        .stop           = wakeup_tracer_stop,
+        .wait_pipe      = poll_wait_pipe,
+        .print_max      = true,
+        .print_header   = wakeup_print_header,
+        .print_line     = wakeup_print_line,
+        .flags          = &tracer_flags,
+        .set_flag       = wakeup_set_flag,
+        .flag_changed   = wakeup_flag_changed,
+#ifdef CONFIG_FTRACE_SELFTEST
+        .selftest    = trace_selftest_startup_wakeup,
+#endif
+        .open           = wakeup_trace_open,
+        .close          = wakeup_trace_close,
+        .use_max_tr     = true,
+};
 __init static int init_wakeup_tracer(void)
 {
        int ret;
@@ -686,6 +739,10 @@ __init static int init_wakeup_tracer(void)
        if (ret)
                return ret;
+        ret = register_tracer(&wakeup_dl_tracer);
+        if (ret)
+                return ret;
        return 0;
 }
 core_initcall(init_wakeup_tracer);
diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c
index a7329b7902f8..e98fca60974f 100644
--- a/kernel/trace/trace_selftest.c
+++ b/kernel/trace/trace_selftest.c
@@ -1022,11 +1022,16 @@ trace_selftest_startup_nop(struct tracer *trace, struct trace_array *tr)
 #ifdef CONFIG_SCHED_TRACER
 static int trace_wakeup_test_thread(void *data)
 {
-        /* Make this a RT thread, doesn't need to be too high */
+        /* Make this a -deadline thread */
-        static const struct sched_param param = { .sched_priority = 5 };
+        static const struct sched_attr attr = {
+                .sched_policy = SCHED_DEADLINE,
+                .sched_runtime = 100000ULL,
+                .sched_deadline = 10000000ULL,
+                .sched_period = 10000000ULL
+        };
        struct completion *x = data;
-        sched_setscheduler(current, SCHED_FIFO, &param);
+        sched_setattr(current, &attr);
        /* Make it know we have a new prio */
        complete(x);
@@ -1040,8 +1045,8 @@ static int trace_wakeup_test_thread(void *data)
        /* we are awake, now wait to disappear */
        while (!kthread_should_stop()) {
                /*
-                 * This is an RT task, do short sleeps to let
+                 * This will likely be the system top priority
-                 * others run.
+                 * task, do short sleeps to let others run.
                 */
                msleep(100);
        }
@@ -1054,21 +1059,21 @@ trace_selftest_startup_wakeup(struct tracer *trace, struct trace_array *tr)
 {
        unsigned long save_max = tracing_max_latency;
        struct task_struct *p;
-        struct completion isrt;
+        struct completion is_ready;
        unsigned long count;
        int ret;
-        init_completion(&isrt);
+        init_completion(&is_ready);
-        /* create a high prio thread */
+        /* create a -deadline thread */
-        p = kthread_run(trace_wakeup_test_thread, &isrt, "ftrace-test");
+        p = kthread_run(trace_wakeup_test_thread, &is_ready, "ftrace-test");
        if (IS_ERR(p)) {
                printk(KERN_CONT "Failed to create ftrace wakeup test thread ");
                return -1;
        }
-        /* make sure the thread is running at an RT prio */
+        /* make sure the thread is running at -deadline policy */
-        wait_for_completion(&isrt);
+        wait_for_completion(&is_ready);
        /* start the tracing */
        ret = tracer_init(trace, tr);
@@ -1082,19 +1087,19 @@ trace_selftest_startup_wakeup(struct tracer *trace, struct trace_array *tr)
        while (p->on_rq) {
                /*
-                 * Sleep to make sure the RT thread is asleep too.
+                 * Sleep to make sure the -deadline thread is asleep too.
                 * On virtual machines we can't rely on timings,
                 * but we want to make sure this test still works.
                 */
                msleep(100);
        }
-        init_completion(&isrt);
+        init_completion(&is_ready);
        wake_up_process(p);
        /* Wait for the task to wake up */
-        wait_for_completion(&isrt);
+        wait_for_completion(&is_ready);
        /* stop the tracing. */
        tracing_stop();
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index db25707aa41b..6982094a7e74 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -761,6 +761,15 @@ config PANIC_ON_OOPS_VALUE
        default 0 if !PANIC_ON_OOPS
        default 1 if PANIC_ON_OOPS
+config PANIC_TIMEOUT
+        int "panic timeout"
+        default 0
+        help
+          Set the timeout value (in seconds) until a reboot occurs when the
+          the kernel panics. If n = 0, then we wait forever. A timeout
+          value n > 0 will wait n seconds before rebooting, while a timeout
+          value n < 0 will reboot immediately.
 config SCHED_DEBUG
        bool "Collect scheduler debugging info"
        depends on DEBUG_KERNEL && PROC_FS
diff --git a/lib/percpu_counter.c b/lib/percpu_counter.c
index 7473ee3b4ee7..8280a5dd1727 100644
--- a/lib/percpu_counter.c
+++ b/lib/percpu_counter.c
@@ -82,10 +82,10 @@ void __percpu_counter_add(struct percpu_counter *fbc, s64 amount, s32 batch)
                unsigned long flags;
                raw_spin_lock_irqsave(&fbc->lock, flags);
                fbc->count += count;
+                __this_cpu_sub(*fbc->counters, count - amount);
                raw_spin_unlock_irqrestore(&fbc->lock, flags);
-                __this_cpu_write(*fbc->counters, 0);
        } else {
-                __this_cpu_write(*fbc->counters, count);
+                this_cpu_add(*fbc->counters, amount);
        }
        preempt_enable();
 }
diff --git a/mm/fremap.c b/mm/fremap.c
index 5bff08147768..bbc4d660221a 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -208,9 +208,10 @@ get_write_lock:
                if (mapping_cap_account_dirty(mapping)) {
                        unsigned long addr;
                        struct file *file = get_file(vma->vm_file);
+                        /* mmap_region may free vma; grab the info now */
+                        vm_flags = vma->vm_flags;
-                        addr = mmap_region(file, start, size,
+                        addr = mmap_region(file, start, size, vm_flags, pgoff);
-                                        vma->vm_flags, pgoff);
                        fput(file);
                        if (IS_ERR_VALUE(addr)) {
                                err = addr;
@@ -218,7 +219,7 @@ get_write_lock:
                                BUG_ON(addr != start);
                                err = 0;
                        }
-                        goto out;
+                        goto out_freed;
                }
                mutex_lock(&mapping->i_mmap_mutex);
                flush_dcache_mmap_lock(mapping);
@@ -253,6 +254,7 @@ get_write_lock:
 out:
        if (vma)
                vm_flags = vma->vm_flags;
+out_freed:
        if (likely(!has_write_lock))
                up_read(&mm->mmap_sem);
        else
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 7de1bf85f683..95d1acb0f3d2 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -883,9 +883,6 @@ int copy_huge_pmd(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                goto out_unlock;
        }
-        /* mmap_sem prevents this happening but warn if that changes */
-        WARN_ON(pmd_trans_migrating(pmd));
        if (unlikely(pmd_trans_splitting(pmd))) {
                /* split huge page running from under us */
                spin_unlock(src_ptl);
@@ -1157,7 +1154,7 @@ alloc:
                new_page = NULL;
        if (unlikely(!new_page)) {
-                if (is_huge_zero_pmd(orig_pmd)) {
+                if (!page) {
                        ret = do_huge_pmd_wp_zero_page_fallback(mm, vma,
                                        address, pmd, orig_pmd, haddr);
                } else {
@@ -1184,7 +1181,7 @@ alloc:
        count_vm_event(THP_FAULT_ALLOC);
-        if (is_huge_zero_pmd(orig_pmd))
+        if (!page)
                clear_huge_page(new_page, haddr, HPAGE_PMD_NR);
        else
                copy_user_huge_page(new_page, page, haddr, vma, HPAGE_PMD_NR);
@@ -1210,7 +1207,7 @@ alloc:
                page_add_new_anon_rmap(new_page, vma, haddr);
                set_pmd_at(mm, haddr, pmd, entry);
                update_mmu_cache_pmd(vma, address, pmd);
-                if (is_huge_zero_pmd(orig_pmd)) {
+                if (!page) {
                        add_mm_counter(mm, MM_ANONPAGES, HPAGE_PMD_NR);
                        put_huge_zero_page();
                } else {
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index bf5e89457149..7f1a356153c0 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -338,7 +338,7 @@ struct mem_cgroup {
 static size_t memcg_size(void)
 {
        return sizeof(struct mem_cgroup) +
-                nr_node_ids * sizeof(struct mem_cgroup_per_node);
+                nr_node_ids * sizeof(struct mem_cgroup_per_node *);
 }
 /* internal only representation about the status of kmem accounting. */
diff --git a/mm/memory-failure.c b/mm/memory-failure.c
index db08af92c6fc..fabe55046c1d 100644
--- a/mm/memory-failure.c
+++ b/mm/memory-failure.c
@@ -938,6 +938,16 @@ static int hwpoison_user_mappings(struct page *p, unsigned long pfn,
                                BUG_ON(!PageHWPoison(p));
                                return SWAP_FAIL;
                        }
+                        /*
+                         * We pinned the head page for hwpoison handling,
+                         * now we split the thp and we are interested in
+                         * the hwpoisoned raw page, so move the refcount
+                         * to it.
+                         */
+                        if (hpage != p) {
+                                put_page(hpage);
+                                get_page(p);
+                        }
                        /* THP is split, so ppage should be the real poisoned page. */
                        ppage = p;
                }
diff --git a/mm/mlock.c b/mm/mlock.c
index d480cd6fc475..192e6eebe4f2 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -133,7 +133,10 @@ static void __munlock_isolation_failed(struct page *page)
 /**
 * munlock_vma_page - munlock a vma page
- * @page - page to be unlocked
+ * @page - page to be unlocked, either a normal page or THP page head
+ *
+ * returns the size of the page as a page mask (0 for normal page,
+ *         HPAGE_PMD_NR - 1 for THP head page)
 *
 * called from munlock()/munmap() path with page supposedly on the LRU.
 * When we munlock a page, because the vma where we found the page is being
@@ -148,21 +151,30 @@ static void __munlock_isolation_failed(struct page *page)
 */
 unsigned int munlock_vma_page(struct page *page)
 {
-        unsigned int page_mask = 0;
+        unsigned int nr_pages;
        BUG_ON(!PageLocked(page));
        if (TestClearPageMlocked(page)) {
-                unsigned int nr_pages = hpage_nr_pages(page);
+                nr_pages = hpage_nr_pages(page);
                mod_zone_page_state(page_zone(page), NR_MLOCK, -nr_pages);
-                page_mask = nr_pages - 1;
                if (!isolate_lru_page(page))
                        __munlock_isolated_page(page);
                else
                        __munlock_isolation_failed(page);
+        } else {
+                nr_pages = hpage_nr_pages(page);
        }
-        return page_mask;
+        /*
+         * Regardless of the original PageMlocked flag, we determine nr_pages
+         * after touching the flag. This leaves a possible race with a THP page
+         * split, such that a whole THP page was munlocked, but nr_pages == 1.
+         * Returning a smaller mask due to that is OK, the worst that can
+         * happen is subsequent useless scanning of the former tail pages.
+         * The NR_MLOCK accounting can however become broken.
+         */
+        return nr_pages - 1;
 }
 /**
@@ -286,10 +298,12 @@ static void __munlock_pagevec(struct pagevec *pvec, struct zone *zone)
 {
        int i;
        int nr = pagevec_count(pvec);
-        int delta_munlocked = -nr;
+        int delta_munlocked;
        struct pagevec pvec_putback;
        int pgrescued = 0;
+        pagevec_init(&pvec_putback, 0);
        /* Phase 1: page isolation */
        spin_lock_irq(&zone->lru_lock);
        for (i = 0; i < nr; i++) {
@@ -318,18 +332,21 @@ skip_munlock:
                        /*
                         * We won't be munlocking this page in the next phase
                         * but we still need to release the follow_page_mask()
-                         * pin.
+                         * pin. We cannot do it under lru_lock however. If it's
+                         * the last pin, __page_cache_release would deadlock.
                         */
+                        pagevec_add(&pvec_putback, pvec->pages[i]);
                        pvec->pages[i] = NULL;
-                        put_page(page);
-                        delta_munlocked++;
                }
        }
+        delta_munlocked = -nr + pagevec_count(&pvec_putback);
        __mod_zone_page_state(zone, NR_MLOCK, delta_munlocked);
        spin_unlock_irq(&zone->lru_lock);
+        /* Now we can release pins of pages that we are not munlocking */
+        pagevec_release(&pvec_putback);
        /* Phase 2: page munlock */
-        pagevec_init(&pvec_putback, 0);
        for (i = 0; i < nr; i++) {
                struct page *page = pvec->pages[i];
@@ -440,7 +457,8 @@ void munlock_vma_pages_range(struct vm_area_struct *vma,
        while (start < end) {
                struct page *page = NULL;
-                unsigned int page_mask, page_increm;
+                unsigned int page_mask;
+                unsigned long page_increm;
                struct pagevec pvec;
                struct zone *zone;
                int zoneid;
@@ -490,7 +508,9 @@ void munlock_vma_pages_range(struct vm_area_struct *vma,
                                goto next;
                        }
                }
-                page_increm = 1 + (~(start >> PAGE_SHIFT) & page_mask);
+                /* It's a bug to munlock in the middle of a THP page */
+                VM_BUG_ON((start >> PAGE_SHIFT) & page_mask);
+                page_increm = 1 + page_mask;
                start += page_increm * PAGE_SIZE;
 next:
                cond_resched();
diff --git a/mm/util.c b/mm/util.c
index f7bc2096071c..808f375648e7 100644
--- a/mm/util.c
+++ b/mm/util.c
@@ -390,7 +390,10 @@ struct address_space *page_mapping(struct page *page)
 {
        struct address_space *mapping = page->mapping;
-        VM_BUG_ON(PageSlab(page));
+        /* This happens if someone calls flush_dcache_page on slab page */
+        if (unlikely(PageSlab(page)))
+                return NULL;
        if (unlikely(PageSwapCache(page))) {
                swp_entry_t entry;
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 762896ebfcf5..47c908f1f626 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -530,6 +530,23 @@ static const struct header_ops vlan_header_ops = {
        .parse   = eth_header_parse,
 };
+static int vlan_passthru_hard_header(struct sk_buff *skb, struct net_device *dev,
+                                     unsigned short type,
+                                     const void *daddr, const void *saddr,
+                                     unsigned int len)
+{
+        struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
+        struct net_device *real_dev = vlan->real_dev;
+        return dev_hard_header(skb, real_dev, type, daddr, saddr, len);
+}
+static const struct header_ops vlan_passthru_header_ops = {
+        .create  = vlan_passthru_hard_header,
+        .rebuild = dev_rebuild_header,
+        .parse   = eth_header_parse,
+};
 static struct device_type vlan_type = {
        .name   = "vlan",
 };
@@ -573,7 +590,7 @@ static int vlan_dev_init(struct net_device *dev)
        dev->needed_headroom = real_dev->needed_headroom;
        if (real_dev->features & NETIF_F_HW_VLAN_CTAG_TX) {
-                dev->header_ops      = real_dev->header_ops;
+                dev->header_ops      = &vlan_passthru_header_ops;
                dev->hard_header_len = real_dev->hard_header_len;
        } else {
                dev->header_ops      = &vlan_header_ops;
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index a2b480a90872..b9c8a6eedf45 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -307,9 +307,9 @@ static int batadv_iv_ogm_iface_enable(struct batadv_hard_iface *hard_iface)
        hard_iface->bat_iv.ogm_buff = ogm_buff;
        batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
-        batadv_ogm_packet->header.packet_type = BATADV_IV_OGM;
+        batadv_ogm_packet->packet_type = BATADV_IV_OGM;
-        batadv_ogm_packet->header.version = BATADV_COMPAT_VERSION;
+        batadv_ogm_packet->version = BATADV_COMPAT_VERSION;
-        batadv_ogm_packet->header.ttl = 2;
+        batadv_ogm_packet->ttl = 2;
        batadv_ogm_packet->flags = BATADV_NO_FLAGS;
        batadv_ogm_packet->reserved = 0;
        batadv_ogm_packet->tq = BATADV_TQ_MAX_VALUE;
@@ -346,7 +346,7 @@ batadv_iv_ogm_primary_iface_set(struct batadv_hard_iface *hard_iface)
        batadv_ogm_packet = (struct batadv_ogm_packet *)ogm_buff;
        batadv_ogm_packet->flags = BATADV_PRIMARIES_FIRST_HOP;
-        batadv_ogm_packet->header.ttl = BATADV_TTL;
+        batadv_ogm_packet->ttl = BATADV_TTL;
 }
 /* when do we schedule our own ogm to be sent */
@@ -435,7 +435,7 @@ static void batadv_iv_ogm_send_to_if(struct batadv_forw_packet *forw_packet,
                           fwd_str, (packet_num > 0 ? "aggregated " : ""),
                           batadv_ogm_packet->orig,
                           ntohl(batadv_ogm_packet->seqno),
-                           batadv_ogm_packet->tq, batadv_ogm_packet->header.ttl,
+                           batadv_ogm_packet->tq, batadv_ogm_packet->ttl,
                           (batadv_ogm_packet->flags & BATADV_DIRECTLINK ?
                            "on" : "off"),
                           hard_iface->net_dev->name,
@@ -491,7 +491,7 @@ static void batadv_iv_ogm_emit(struct batadv_forw_packet *forw_packet)
        /* multihomed peer assumed
         * non-primary OGMs are only broadcasted on their interface
         */
-        if ((directlink && (batadv_ogm_packet->header.ttl == 1)) ||
+        if ((directlink && (batadv_ogm_packet->ttl == 1)) ||
            (forw_packet->own && (forw_packet->if_incoming != primary_if))) {
                /* FIXME: what about aggregated packets ? */
                batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
@@ -499,7 +499,7 @@ static void batadv_iv_ogm_emit(struct batadv_forw_packet *forw_packet)
                           (forw_packet->own ? "Sending own" : "Forwarding"),
                           batadv_ogm_packet->orig,
                           ntohl(batadv_ogm_packet->seqno),
-                           batadv_ogm_packet->header.ttl,
+                           batadv_ogm_packet->ttl,
                           forw_packet->if_incoming->net_dev->name,
                           forw_packet->if_incoming->net_dev->dev_addr);
@@ -572,7 +572,7 @@ batadv_iv_ogm_can_aggregate(const struct batadv_ogm_packet *new_bat_ogm_packet,
                 */
                if ((!directlink) &&
                    (!(batadv_ogm_packet->flags & BATADV_DIRECTLINK)) &&
-                    (batadv_ogm_packet->header.ttl != 1) &&
+                    (batadv_ogm_packet->ttl != 1) &&
                    /* own packets originating non-primary
                     * interfaces leave only that interface
@@ -587,7 +587,7 @@ batadv_iv_ogm_can_aggregate(const struct batadv_ogm_packet *new_bat_ogm_packet,
                 * interface only - we still can aggregate
                 */
                if ((directlink) &&
-                    (new_bat_ogm_packet->header.ttl == 1) &&
+                    (new_bat_ogm_packet->ttl == 1) &&
                    (forw_packet->if_incoming == if_incoming) &&
                    /* packets from direct neighbors or
@@ -778,7 +778,7 @@ static void batadv_iv_ogm_forward(struct batadv_orig_node *orig_node,
        struct batadv_priv *bat_priv = netdev_priv(if_incoming->soft_iface);
        uint16_t tvlv_len;
-        if (batadv_ogm_packet->header.ttl <= 1) {
+        if (batadv_ogm_packet->ttl <= 1) {
                batadv_dbg(BATADV_DBG_BATMAN, bat_priv, "ttl exceeded\n");
                return;
        }
@@ -798,7 +798,7 @@ static void batadv_iv_ogm_forward(struct batadv_orig_node *orig_node,
        tvlv_len = ntohs(batadv_ogm_packet->tvlv_len);
-        batadv_ogm_packet->header.ttl--;
+        batadv_ogm_packet->ttl--;
        memcpy(batadv_ogm_packet->prev_sender, ethhdr->h_source, ETH_ALEN);
        /* apply hop penalty */
@@ -807,7 +807,7 @@ static void batadv_iv_ogm_forward(struct batadv_orig_node *orig_node,
        batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                   "Forwarding packet: tq: %i, ttl: %i\n",
-                   batadv_ogm_packet->tq, batadv_ogm_packet->header.ttl);
+                   batadv_ogm_packet->tq, batadv_ogm_packet->ttl);
        /* switch of primaries first hop flag when forwarding */
        batadv_ogm_packet->flags &= ~BATADV_PRIMARIES_FIRST_HOP;
@@ -972,8 +972,8 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
        spin_unlock_bh(&neigh_node->bat_iv.lq_update_lock);
        if (dup_status == BATADV_NO_DUP) {
-                orig_node->last_ttl = batadv_ogm_packet->header.ttl;
+                orig_node->last_ttl = batadv_ogm_packet->ttl;
-                neigh_node->last_ttl = batadv_ogm_packet->header.ttl;
+                neigh_node->last_ttl = batadv_ogm_packet->ttl;
        }
        batadv_bonding_candidate_add(bat_priv, orig_node, neigh_node);
@@ -1247,7 +1247,7 @@ static void batadv_iv_ogm_process(const struct ethhdr *ethhdr,
         * packet in an aggregation.  Here we expect that the padding
         * is always zero (or not 0x01)
         */
-        if (batadv_ogm_packet->header.packet_type != BATADV_IV_OGM)
+        if (batadv_ogm_packet->packet_type != BATADV_IV_OGM)
                return;
        /* could be changed by schedule_own_packet() */
@@ -1267,8 +1267,8 @@ static void batadv_iv_ogm_process(const struct ethhdr *ethhdr,
                   if_incoming->net_dev->dev_addr, batadv_ogm_packet->orig,
                   batadv_ogm_packet->prev_sender,
                   ntohl(batadv_ogm_packet->seqno), batadv_ogm_packet->tq,
-                   batadv_ogm_packet->header.ttl,
+                   batadv_ogm_packet->ttl,
-                   batadv_ogm_packet->header.version, has_directlink_flag);
+                   batadv_ogm_packet->version, has_directlink_flag);
        rcu_read_lock();
        list_for_each_entry_rcu(hard_iface, &batadv_hardif_list, list) {
@@ -1433,7 +1433,7 @@ static void batadv_iv_ogm_process(const struct ethhdr *ethhdr,
         * seqno and similar ttl as the non-duplicate
         */
        sameseq = orig_node->last_real_seqno == ntohl(batadv_ogm_packet->seqno);
-        similar_ttl = orig_node->last_ttl - 3 <= batadv_ogm_packet->header.ttl;
+        similar_ttl = orig_node->last_ttl - 3 <= batadv_ogm_packet->ttl;
        if (is_bidirect && ((dup_status == BATADV_NO_DUP) ||
                            (sameseq && similar_ttl)))
                batadv_iv_ogm_orig_update(bat_priv, orig_node, ethhdr,
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 6c8c3934bd7b..b316a4cb6f14 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -349,7 +349,7 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
        unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
-        switch (unicast_4addr_packet->u.header.packet_type) {
+        switch (unicast_4addr_packet->u.packet_type) {
        case BATADV_UNICAST:
                batadv_dbg(BATADV_DBG_DAT, bat_priv,
                           "* encapsulated within a UNICAST packet\n");
@@ -374,7 +374,7 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
                        break;
                default:
                        batadv_dbg(BATADV_DBG_DAT, bat_priv, "* type: Unknown (%u)!\n",
-                                   unicast_4addr_packet->u.header.packet_type);
+                                   unicast_4addr_packet->u.packet_type);
                }
                break;
        case BATADV_BCAST:
@@ -387,7 +387,7 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb,
        default:
                batadv_dbg(BATADV_DBG_DAT, bat_priv,
                           "* encapsulated within an unknown packet type (0x%x)\n",
-                           unicast_4addr_packet->u.header.packet_type);
+                           unicast_4addr_packet->u.packet_type);
        }
 }
diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
index 271d321b3a04..6ddb6145ffb5 100644
--- a/net/batman-adv/fragmentation.c
+++ b/net/batman-adv/fragmentation.c
@@ -355,7 +355,7 @@ bool batadv_frag_skb_fwd(struct sk_buff *skb,
                batadv_add_counter(bat_priv, BATADV_CNT_FRAG_FWD_BYTES,
                                   skb->len + ETH_HLEN);
-                packet->header.ttl--;
+                packet->ttl--;
                batadv_send_skb_packet(skb, neigh_node->if_incoming,
                                       neigh_node->addr);
                ret = true;
@@ -444,9 +444,9 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
                goto out_err;
        /* Create one header to be copied to all fragments */
-        frag_header.header.packet_type = BATADV_UNICAST_FRAG;
+        frag_header.packet_type = BATADV_UNICAST_FRAG;
-        frag_header.header.version = BATADV_COMPAT_VERSION;
+        frag_header.version = BATADV_COMPAT_VERSION;
-        frag_header.header.ttl = BATADV_TTL;
+        frag_header.ttl = BATADV_TTL;
        frag_header.seqno = htons(atomic_inc_return(&bat_priv->frag_seqno));
        frag_header.reserved = 0;
        frag_header.no = 0;
diff --git a/net/batman-adv/icmp_socket.c b/net/batman-adv/icmp_socket.c
index 29ae4efe3543..130cc3217e2b 100644
--- a/net/batman-adv/icmp_socket.c
+++ b/net/batman-adv/icmp_socket.c
@@ -194,7 +194,7 @@ static ssize_t batadv_socket_write(struct file *file, const char __user *buff,
                goto free_skb;
        }
-        if (icmp_header->header.packet_type != BATADV_ICMP) {
+        if (icmp_header->packet_type != BATADV_ICMP) {
                batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                           "Error - can't send packet from char device: got bogus packet type (expected: BAT_ICMP)\n");
                len = -EINVAL;
@@ -243,9 +243,9 @@ static ssize_t batadv_socket_write(struct file *file, const char __user *buff,
        icmp_header->uid = socket_client->index;
-        if (icmp_header->header.version != BATADV_COMPAT_VERSION) {
+        if (icmp_header->version != BATADV_COMPAT_VERSION) {
                icmp_header->msg_type = BATADV_PARAMETER_PROBLEM;
-                icmp_header->header.version = BATADV_COMPAT_VERSION;
+                icmp_header->version = BATADV_COMPAT_VERSION;
                batadv_socket_add_packet(socket_client, icmp_header,
                                         packet_len);
                goto free_skb;
diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
index c51a5e568f0a..faba0f61ad53 100644
--- a/net/batman-adv/main.c
+++ b/net/batman-adv/main.c
@@ -277,7 +277,7 @@ int batadv_max_header_len(void)
                           sizeof(struct batadv_coded_packet));
 #endif
-        return header_len;
+        return header_len + ETH_HLEN;
 }
 /**
@@ -383,17 +383,17 @@ int batadv_batman_skb_recv(struct sk_buff *skb, struct net_device *dev,
        batadv_ogm_packet = (struct batadv_ogm_packet *)skb->data;
-        if (batadv_ogm_packet->header.version != BATADV_COMPAT_VERSION) {
+        if (batadv_ogm_packet->version != BATADV_COMPAT_VERSION) {
                batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
                           "Drop packet: incompatible batman version (%i)\n",
-                           batadv_ogm_packet->header.version);
+                           batadv_ogm_packet->version);
                goto err_free;
        }
        /* all receive handlers return whether they received or reused
         * the supplied skb. if not, we have to free the skb.
         */
-        idx = batadv_ogm_packet->header.packet_type;
+        idx = batadv_ogm_packet->packet_type;
        ret = (*batadv_rx_handler[idx])(skb, hard_iface);
        if (ret == NET_RX_DROP)
@@ -426,8 +426,8 @@ static void batadv_recv_handler_init(void)
        BUILD_BUG_ON(offsetof(struct batadv_unicast_packet, dest) != 4);
        BUILD_BUG_ON(offsetof(struct batadv_unicast_tvlv_packet, dst) != 4);
        BUILD_BUG_ON(offsetof(struct batadv_frag_packet, dest) != 4);
-        BUILD_BUG_ON(offsetof(struct batadv_icmp_packet, icmph.dst) != 4);
+        BUILD_BUG_ON(offsetof(struct batadv_icmp_packet, dst) != 4);
-        BUILD_BUG_ON(offsetof(struct batadv_icmp_packet_rr, icmph.dst) != 4);
+        BUILD_BUG_ON(offsetof(struct batadv_icmp_packet_rr, dst) != 4);
        /* broadcast packet */
        batadv_rx_handler[BATADV_BCAST] = batadv_recv_bcast_packet;
@@ -1119,9 +1119,9 @@ void batadv_tvlv_unicast_send(struct batadv_priv *bat_priv, uint8_t *src,
        skb_reserve(skb, ETH_HLEN);
        tvlv_buff = skb_put(skb, sizeof(*unicast_tvlv_packet) + tvlv_len);
        unicast_tvlv_packet = (struct batadv_unicast_tvlv_packet *)tvlv_buff;
-        unicast_tvlv_packet->header.packet_type = BATADV_UNICAST_TVLV;
+        unicast_tvlv_packet->packet_type = BATADV_UNICAST_TVLV;
-        unicast_tvlv_packet->header.version = BATADV_COMPAT_VERSION;
+        unicast_tvlv_packet->version = BATADV_COMPAT_VERSION;
-        unicast_tvlv_packet->header.ttl = BATADV_TTL;
+        unicast_tvlv_packet->ttl = BATADV_TTL;
        unicast_tvlv_packet->reserved = 0;
        unicast_tvlv_packet->tvlv_len = htons(tvlv_len);
        unicast_tvlv_packet->align = 0;
diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
index 351e199bc0af..511d7e1eea38 100644
--- a/net/batman-adv/network-coding.c
+++ b/net/batman-adv/network-coding.c
@@ -722,7 +722,7 @@ static bool batadv_can_nc_with_orig(struct batadv_priv *bat_priv,
 {
        if (orig_node->last_real_seqno != ntohl(ogm_packet->seqno))
                return false;
-        if (orig_node->last_ttl != ogm_packet->header.ttl + 1)
+        if (orig_node->last_ttl != ogm_packet->ttl + 1)
                return false;
        if (!batadv_compare_eth(ogm_packet->orig, ogm_packet->prev_sender))
                return false;
@@ -1082,9 +1082,9 @@ static bool batadv_nc_code_packets(struct batadv_priv *bat_priv,
        coded_packet = (struct batadv_coded_packet *)skb_dest->data;
        skb_reset_mac_header(skb_dest);
-        coded_packet->header.packet_type = BATADV_CODED;
+        coded_packet->packet_type = BATADV_CODED;
-        coded_packet->header.version = BATADV_COMPAT_VERSION;
+        coded_packet->version = BATADV_COMPAT_VERSION;
-        coded_packet->header.ttl = packet1->header.ttl;
+        coded_packet->ttl = packet1->ttl;
        /* Info about first unicast packet */
        memcpy(coded_packet->first_source, first_source, ETH_ALEN);
@@ -1097,7 +1097,7 @@ static bool batadv_nc_code_packets(struct batadv_priv *bat_priv,
        memcpy(coded_packet->second_source, second_source, ETH_ALEN);
        memcpy(coded_packet->second_orig_dest, packet2->dest, ETH_ALEN);
        coded_packet->second_crc = packet_id2;
-        coded_packet->second_ttl = packet2->header.ttl;
+        coded_packet->second_ttl = packet2->ttl;
        coded_packet->second_ttvn = packet2->ttvn;
        coded_packet->coded_len = htons(coding_len);
@@ -1452,7 +1452,7 @@ bool batadv_nc_skb_forward(struct sk_buff *skb,
        /* We only handle unicast packets */
        payload = skb_network_header(skb);
        packet = (struct batadv_unicast_packet *)payload;
-        if (packet->header.packet_type != BATADV_UNICAST)
+        if (packet->packet_type != BATADV_UNICAST)
                goto out;
        /* Try to find a coding opportunity and send the skb if one is found */
@@ -1505,7 +1505,7 @@ void batadv_nc_skb_store_for_decoding(struct batadv_priv *bat_priv,
        /* Check for supported packet type */
        payload = skb_network_header(skb);
        packet = (struct batadv_unicast_packet *)payload;
-        if (packet->header.packet_type != BATADV_UNICAST)
+        if (packet->packet_type != BATADV_UNICAST)
                goto out;
        /* Find existing nc_path or create a new */
@@ -1623,7 +1623,7 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
                ttvn = coded_packet_tmp.second_ttvn;
        } else {
                orig_dest = coded_packet_tmp.first_orig_dest;
-                ttl = coded_packet_tmp.header.ttl;
+                ttl = coded_packet_tmp.ttl;
                ttvn = coded_packet_tmp.first_ttvn;
        }
@@ -1648,9 +1648,9 @@ batadv_nc_skb_decode_packet(struct batadv_priv *bat_priv, struct sk_buff *skb,
        /* Create decoded unicast packet */
        unicast_packet = (struct batadv_unicast_packet *)skb->data;
-        unicast_packet->header.packet_type = BATADV_UNICAST;
+        unicast_packet->packet_type = BATADV_UNICAST;
-        unicast_packet->header.version = BATADV_COMPAT_VERSION;
+        unicast_packet->version = BATADV_COMPAT_VERSION;
-        unicast_packet->header.ttl = ttl;
+        unicast_packet->ttl = ttl;
        memcpy(unicast_packet->dest, orig_dest, ETH_ALEN);
        unicast_packet->ttvn = ttvn;
diff --git a/net/batman-adv/packet.h b/net/batman-adv/packet.h
index 207459b62966..2dd8f2422550 100644
--- a/net/batman-adv/packet.h
+++ b/net/batman-adv/packet.h
@@ -155,6 +155,7 @@ enum batadv_tvlv_type {
        BATADV_TVLV_ROAM        = 0x05,
 };
+#pragma pack(2)
 /* the destination hardware field in the ARP frame is used to
 * transport the claim type and the group id
 */
@@ -163,24 +164,20 @@ struct batadv_bla_claim_dst {
        uint8_t type;           /* bla_claimframe */
        __be16 group;           /* group id */
 };
+#pragma pack()
-struct batadv_header {
-        uint8_t  packet_type;
-        uint8_t  version;  /* batman version field */
-        uint8_t  ttl;
-        /* the parent struct has to add a byte after the header to make
-         * everything 4 bytes aligned again
-         */
-};
 /**
 * struct batadv_ogm_packet - ogm (routing protocol) packet
- * @header: common batman packet header
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
 * @flags: contains routing relevant flags - see enum batadv_iv_flags
 * @tvlv_len: length of tvlv data following the ogm header
 */
 struct batadv_ogm_packet {
-        struct batadv_header header;
+        uint8_t  packet_type;
+        uint8_t  version;
+        uint8_t  ttl;
        uint8_t  flags;
        __be32   seqno;
        uint8_t  orig[ETH_ALEN];
@@ -196,29 +193,51 @@ struct batadv_ogm_packet {
 #define BATADV_OGM_HLEN sizeof(struct batadv_ogm_packet)
 /**
- * batadv_icmp_header - common ICMP header
+ * batadv_icmp_header - common members among all the ICMP packets
- * @header: common batman header
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
 * @msg_type: ICMP packet type
 * @dst: address of the destination node
 * @orig: address of the source node
 * @uid: local ICMP socket identifier
+ * @align: not used - useful for alignment purposes only
+ *
+ * This structure is used for ICMP packets parsing only and it is never sent
+ * over the wire. The alignment field at the end is there to ensure that
+ * members are padded the same way as they are in real packets.
 */
 struct batadv_icmp_header {
-        struct batadv_header header;
+        uint8_t  packet_type;
+        uint8_t  version;
+        uint8_t  ttl;
        uint8_t  msg_type; /* see ICMP message types above */
        uint8_t  dst[ETH_ALEN];
        uint8_t  orig[ETH_ALEN];
        uint8_t  uid;
+        uint8_t  align[3];
 };
 /**
 * batadv_icmp_packet - ICMP packet
- * @icmph: common ICMP header
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
+ * @msg_type: ICMP packet type
+ * @dst: address of the destination node
+ * @orig: address of the source node
+ * @uid: local ICMP socket identifier
 * @reserved: not used - useful for alignment
 * @seqno: ICMP sequence number
 */
 struct batadv_icmp_packet {
-        struct batadv_icmp_header icmph;
+        uint8_t  packet_type;
+        uint8_t  version;
+        uint8_t  ttl;
+        uint8_t  msg_type; /* see ICMP message types above */
+        uint8_t  dst[ETH_ALEN];
+        uint8_t  orig[ETH_ALEN];
+        uint8_t  uid;
        uint8_t  reserved;
        __be16   seqno;
 };
@@ -227,13 +246,25 @@ struct batadv_icmp_packet {
 /**
 * batadv_icmp_packet_rr - ICMP RouteRecord packet
- * @icmph: common ICMP header
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
+ * @msg_type: ICMP packet type
+ * @dst: address of the destination node
+ * @orig: address of the source node
+ * @uid: local ICMP socket identifier
 * @rr_cur: number of entries the rr array
 * @seqno: ICMP sequence number
 * @rr: route record array
 */
 struct batadv_icmp_packet_rr {
-        struct batadv_icmp_header icmph;
+        uint8_t  packet_type;
+        uint8_t  version;
+        uint8_t  ttl;
+        uint8_t  msg_type; /* see ICMP message types above */
+        uint8_t  dst[ETH_ALEN];
+        uint8_t  orig[ETH_ALEN];
+        uint8_t  uid;
        uint8_t  rr_cur;
        __be16   seqno;
        uint8_t  rr[BATADV_RR_LEN][ETH_ALEN];
@@ -253,8 +284,18 @@ struct batadv_icmp_packet_rr {
 */
 #pragma pack(2)
+/**
+ * struct batadv_unicast_packet - unicast packet for network payload
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
+ * @ttvn: translation table version number
+ * @dest: originator destination of the unicast packet
+ */
 struct batadv_unicast_packet {
-        struct batadv_header header;
+        uint8_t  packet_type;
+        uint8_t  version;
+        uint8_t  ttl;
        uint8_t  ttvn; /* destination translation table version number */
        uint8_t  dest[ETH_ALEN];
        /* "4 bytes boundary + 2 bytes" long to make the payload after the
@@ -280,7 +321,9 @@ struct batadv_unicast_4addr_packet {
 /**
 * struct batadv_frag_packet - fragmented packet
- * @header: common batman packet header with type, compatversion, and ttl
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
 * @dest: final destination used when routing fragments
 * @orig: originator of the fragment used when merging the packet
 * @no: fragment number within this sequence
@@ -289,7 +332,9 @@ struct batadv_unicast_4addr_packet {
 * @total_size: size of the merged packet
 */
 struct batadv_frag_packet {
-        struct  batadv_header header;
+        uint8_t packet_type;
+        uint8_t version;  /* batman version field */
+        uint8_t ttl;
 #if defined(__BIG_ENDIAN_BITFIELD)
        uint8_t no:4;
        uint8_t reserved:4;
@@ -305,8 +350,19 @@ struct batadv_frag_packet {
        __be16  total_size;
 };
+/**
+ * struct batadv_bcast_packet - broadcast packet for network payload
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
+ * @reserved: reserved byte for alignment
+ * @seqno: sequence identification
+ * @orig: originator of the broadcast packet
+ */
 struct batadv_bcast_packet {
-        struct batadv_header header;
+        uint8_t  packet_type;
+        uint8_t  version;  /* batman version field */
+        uint8_t  ttl;
        uint8_t  reserved;
        __be32   seqno;
        uint8_t  orig[ETH_ALEN];
@@ -315,11 +371,11 @@ struct batadv_bcast_packet {
         */
 };
-#pragma pack()
 /**
 * struct batadv_coded_packet - network coded packet
- * @header: common batman packet header and ttl of first included packet
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
 * @reserved: Align following fields to 2-byte boundaries
 * @first_source: original source of first included packet
 * @first_orig_dest: original destinal of first included packet
@@ -334,7 +390,9 @@ struct batadv_bcast_packet {
 * @coded_len: length of network coded part of the payload
 */
 struct batadv_coded_packet {
-        struct batadv_header header;
+        uint8_t  packet_type;
+        uint8_t  version;  /* batman version field */
+        uint8_t  ttl;
        uint8_t  first_ttvn;
        /* uint8_t  first_dest[ETH_ALEN]; - saved in mac header destination */
        uint8_t  first_source[ETH_ALEN];
@@ -349,9 +407,13 @@ struct batadv_coded_packet {
        __be16   coded_len;
 };
+#pragma pack()
 /**
 * struct batadv_unicast_tvlv - generic unicast packet with tvlv payload
- * @header: common batman packet header
+ * @packet_type: batman-adv packet type, part of the general header
+ * @version: batman-adv protocol version, part of the genereal header
+ * @ttl: time to live for this packet, part of the genereal header
 * @reserved: reserved field (for packet alignment)
 * @src: address of the source
 * @dst: address of the destination
@@ -359,7 +421,9 @@ struct batadv_coded_packet {
 * @align: 2 bytes to align the header to a 4 byte boundry
 */
 struct batadv_unicast_tvlv_packet {
-        struct batadv_header header;
+        uint8_t  packet_type;
+        uint8_t  version;  /* batman version field */
+        uint8_t  ttl;
        uint8_t  reserved;
        uint8_t  dst[ETH_ALEN];
        uint8_t  src[ETH_ALEN];
@@ -420,13 +484,13 @@ struct batadv_tvlv_tt_vlan_data {
 * struct batadv_tvlv_tt_change - translation table diff data
 * @flags: status indicators concerning the non-mesh client (see
 *  batadv_tt_client_flags)
- * @reserved: reserved field
+ * @reserved: reserved field - useful for alignment purposes only
 * @addr: mac address of non-mesh client that triggered this tt change
 * @vid: VLAN identifier
 */
 struct batadv_tvlv_tt_change {
        uint8_t flags;
-        uint8_t reserved;
+        uint8_t reserved[3];
        uint8_t addr[ETH_ALEN];
        __be16 vid;
 };
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index d4114d775ad6..46278bfb8fdb 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -308,7 +308,7 @@ static int batadv_recv_my_icmp_packet(struct batadv_priv *bat_priv,
                memcpy(icmph->dst, icmph->orig, ETH_ALEN);
                memcpy(icmph->orig, primary_if->net_dev->dev_addr, ETH_ALEN);
                icmph->msg_type = BATADV_ECHO_REPLY;
-                icmph->header.ttl = BATADV_TTL;
+                icmph->ttl = BATADV_TTL;
                res = batadv_send_skb_to_orig(skb, orig_node, NULL);
                if (res != NET_XMIT_DROP)
@@ -338,9 +338,9 @@ static int batadv_recv_icmp_ttl_exceeded(struct batadv_priv *bat_priv,
        icmp_packet = (struct batadv_icmp_packet *)skb->data;
        /* send TTL exceeded if packet is an echo request (traceroute) */
-        if (icmp_packet->icmph.msg_type != BATADV_ECHO_REQUEST) {
+        if (icmp_packet->msg_type != BATADV_ECHO_REQUEST) {
                pr_debug("Warning - can't forward icmp packet from %pM to %pM: ttl exceeded\n",
-                         icmp_packet->icmph.orig, icmp_packet->icmph.dst);
+                         icmp_packet->orig, icmp_packet->dst);
                goto out;
        }
@@ -349,7 +349,7 @@ static int batadv_recv_icmp_ttl_exceeded(struct batadv_priv *bat_priv,
                goto out;
        /* get routing information */
-        orig_node = batadv_orig_hash_find(bat_priv, icmp_packet->icmph.orig);
+        orig_node = batadv_orig_hash_find(bat_priv, icmp_packet->orig);
        if (!orig_node)
                goto out;
@@ -359,11 +359,11 @@ static int batadv_recv_icmp_ttl_exceeded(struct batadv_priv *bat_priv,
        icmp_packet = (struct batadv_icmp_packet *)skb->data;
-        memcpy(icmp_packet->icmph.dst, icmp_packet->icmph.orig, ETH_ALEN);
+        memcpy(icmp_packet->dst, icmp_packet->orig, ETH_ALEN);
-        memcpy(icmp_packet->icmph.orig, primary_if->net_dev->dev_addr,
+        memcpy(icmp_packet->orig, primary_if->net_dev->dev_addr,
               ETH_ALEN);
-        icmp_packet->icmph.msg_type = BATADV_TTL_EXCEEDED;
+        icmp_packet->msg_type = BATADV_TTL_EXCEEDED;
-        icmp_packet->icmph.header.ttl = BATADV_TTL;
+        icmp_packet->ttl = BATADV_TTL;
        if (batadv_send_skb_to_orig(skb, orig_node, NULL) != NET_XMIT_DROP)
                ret = NET_RX_SUCCESS;
@@ -434,7 +434,7 @@ int batadv_recv_icmp_packet(struct sk_buff *skb,
                return batadv_recv_my_icmp_packet(bat_priv, skb);
        /* TTL exceeded */
-        if (icmph->header.ttl < 2)
+        if (icmph->ttl < 2)
                return batadv_recv_icmp_ttl_exceeded(bat_priv, skb);
        /* get routing information */
@@ -449,7 +449,7 @@ int batadv_recv_icmp_packet(struct sk_buff *skb,
        icmph = (struct batadv_icmp_header *)skb->data;
        /* decrement ttl */
-        icmph->header.ttl--;
+        icmph->ttl--;
        /* route it */
        if (batadv_send_skb_to_orig(skb, orig_node, recv_if) != NET_XMIT_DROP)
@@ -709,7 +709,7 @@ static int batadv_route_unicast_packet(struct sk_buff *skb,
        unicast_packet = (struct batadv_unicast_packet *)skb->data;
        /* TTL exceeded */
-        if (unicast_packet->header.ttl < 2) {
+        if (unicast_packet->ttl < 2) {
                pr_debug("Warning - can't forward unicast packet from %pM to %pM: ttl exceeded\n",
                         ethhdr->h_source, unicast_packet->dest);
                goto out;
@@ -727,9 +727,9 @@ static int batadv_route_unicast_packet(struct sk_buff *skb,
        /* decrement ttl */
        unicast_packet = (struct batadv_unicast_packet *)skb->data;
-        unicast_packet->header.ttl--;
+        unicast_packet->ttl--;
-        switch (unicast_packet->header.packet_type) {
+        switch (unicast_packet->packet_type) {
        case BATADV_UNICAST_4ADDR:
                hdr_len = sizeof(struct batadv_unicast_4addr_packet);
                break;
@@ -970,7 +970,7 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
        unicast_packet = (struct batadv_unicast_packet *)skb->data;
        unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
-        is4addr = unicast_packet->header.packet_type == BATADV_UNICAST_4ADDR;
+        is4addr = unicast_packet->packet_type == BATADV_UNICAST_4ADDR;
        /* the caller function should have already pulled 2 bytes */
        if (is4addr)
                hdr_size = sizeof(*unicast_4addr_packet);
@@ -1160,7 +1160,7 @@ int batadv_recv_bcast_packet(struct sk_buff *skb,
        if (batadv_is_my_mac(bat_priv, bcast_packet->orig))
                goto out;
-        if (bcast_packet->header.ttl < 2)
+        if (bcast_packet->ttl < 2)
                goto out;
        orig_node = batadv_orig_hash_find(bat_priv, bcast_packet->orig);
diff --git a/net/batman-adv/send.c b/net/batman-adv/send.c
index c83be5ebaa28..fba4dcfcfac2 100644
--- a/net/batman-adv/send.c
+++ b/net/batman-adv/send.c
@@ -161,11 +161,11 @@ batadv_send_skb_push_fill_unicast(struct sk_buff *skb, int hdr_size,
                return false;
        unicast_packet = (struct batadv_unicast_packet *)skb->data;
-        unicast_packet->header.version = BATADV_COMPAT_VERSION;
+        unicast_packet->version = BATADV_COMPAT_VERSION;
        /* batman packet type: unicast */
-        unicast_packet->header.packet_type = BATADV_UNICAST;
+        unicast_packet->packet_type = BATADV_UNICAST;
        /* set unicast ttl */
-        unicast_packet->header.ttl = BATADV_TTL;
+        unicast_packet->ttl = BATADV_TTL;
        /* copy the destination for faster routing */
        memcpy(unicast_packet->dest, orig_node->orig, ETH_ALEN);
        /* set the destination tt version number */
@@ -221,7 +221,7 @@ bool batadv_send_skb_prepare_unicast_4addr(struct batadv_priv *bat_priv,
                goto out;
        uc_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data;
-        uc_4addr_packet->u.header.packet_type = BATADV_UNICAST_4ADDR;
+        uc_4addr_packet->u.packet_type = BATADV_UNICAST_4ADDR;
        memcpy(uc_4addr_packet->src, primary_if->net_dev->dev_addr, ETH_ALEN);
        uc_4addr_packet->subtype = packet_subtype;
        uc_4addr_packet->reserved = 0;
@@ -436,7 +436,7 @@ int batadv_add_bcast_packet_to_list(struct batadv_priv *bat_priv,
        /* as we have a copy now, it is safe to decrease the TTL */
        bcast_packet = (struct batadv_bcast_packet *)newskb->data;
-        bcast_packet->header.ttl--;
+        bcast_packet->ttl--;
        skb_reset_mac_header(newskb);
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 36f050876f82..a8f99d1486c0 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -264,11 +264,11 @@ static int batadv_interface_tx(struct sk_buff *skb,
                        goto dropped;
                bcast_packet = (struct batadv_bcast_packet *)skb->data;
-                bcast_packet->header.version = BATADV_COMPAT_VERSION;
+                bcast_packet->version = BATADV_COMPAT_VERSION;
-                bcast_packet->header.ttl = BATADV_TTL;
+                bcast_packet->ttl = BATADV_TTL;
                /* batman packet type: broadcast */
-                bcast_packet->header.packet_type = BATADV_BCAST;
+                bcast_packet->packet_type = BATADV_BCAST;
                bcast_packet->reserved = 0;
                /* hw address of first interface is the orig mac because only
@@ -328,7 +328,7 @@ void batadv_interface_rx(struct net_device *soft_iface,
                         struct sk_buff *skb, struct batadv_hard_iface *recv_if,
                         int hdr_size, struct batadv_orig_node *orig_node)
 {
-        struct batadv_header *batadv_header = (struct batadv_header *)skb->data;
+        struct batadv_bcast_packet *batadv_bcast_packet;
        struct batadv_priv *bat_priv = netdev_priv(soft_iface);
        __be16 ethertype = htons(ETH_P_BATMAN);
        struct vlan_ethhdr *vhdr;
@@ -336,7 +336,8 @@ void batadv_interface_rx(struct net_device *soft_iface,
        unsigned short vid;
        bool is_bcast;
-        is_bcast = (batadv_header->packet_type == BATADV_BCAST);
+        batadv_bcast_packet = (struct batadv_bcast_packet *)skb->data;
+        is_bcast = (batadv_bcast_packet->packet_type == BATADV_BCAST);
        /* check if enough space is available for pulling, and pull */
        if (!pskb_may_pull(skb, hdr_size))
@@ -345,7 +346,12 @@ void batadv_interface_rx(struct net_device *soft_iface,
        skb_pull_rcsum(skb, hdr_size);
        skb_reset_mac_header(skb);
-        vid = batadv_get_vid(skb, hdr_size);
+        /* clean the netfilter state now that the batman-adv header has been
+         * removed
+         */
+        nf_reset(skb);
+        vid = batadv_get_vid(skb, 0);
        ethhdr = eth_hdr(skb);
        switch (ntohs(ethhdr->h_proto)) {
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 4add57d4857f..ff625fedbc5e 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -333,7 +333,8 @@ static void batadv_tt_local_event(struct batadv_priv *bat_priv,
                return;
        tt_change_node->change.flags = flags;
-        tt_change_node->change.reserved = 0;
+        memset(tt_change_node->change.reserved, 0,
+               sizeof(tt_change_node->change.reserved));
        memcpy(tt_change_node->change.addr, common->addr, ETH_ALEN);
        tt_change_node->change.vid = htons(common->vid);
@@ -2221,7 +2222,8 @@ static void batadv_tt_tvlv_generate(struct batadv_priv *bat_priv,
                               ETH_ALEN);
                        tt_change->flags = tt_common_entry->flags;
                        tt_change->vid = htons(tt_common_entry->vid);
-                        tt_change->reserved = 0;
+                        memset(tt_change->reserved, 0,
+                               sizeof(tt_change->reserved));
                        tt_num_entries++;
                        tt_change++;
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 6a6c8bb4fd72..7552f9e3089c 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -940,8 +940,22 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
        bt_cb(skb)->pkt_type = *((unsigned char *) skb->data);
        skb_pull(skb, 1);
-        if (hci_pi(sk)->channel == HCI_CHANNEL_RAW &&
+        if (hci_pi(sk)->channel == HCI_CHANNEL_USER) {
-            bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
+                /* No permission check is needed for user channel
+                 * since that gets enforced when binding the socket.
+                 *
+                 * However check that the packet type is valid.
+                 */
+                if (bt_cb(skb)->pkt_type != HCI_COMMAND_PKT &&
+                    bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
+                    bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) {
+                        err = -EINVAL;
+                        goto drop;
+                }
+                skb_queue_tail(&hdev->raw_q, skb);
+                queue_work(hdev->workqueue, &hdev->tx_work);
+        } else if (bt_cb(skb)->pkt_type == HCI_COMMAND_PKT) {
                u16 opcode = get_unaligned_le16(skb->data);
                u16 ogf = hci_opcode_ogf(opcode);
                u16 ocf = hci_opcode_ocf(opcode);
@@ -972,14 +986,6 @@ static int hci_sock_sendmsg(struct kiocb *iocb, struct socket *sock,
                        goto drop;
                }
-                if (hci_pi(sk)->channel == HCI_CHANNEL_USER &&
-                    bt_cb(skb)->pkt_type != HCI_COMMAND_PKT &&
-                    bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
-                    bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) {
-                        err = -EINVAL;
-                        goto drop;
-                }
                skb_queue_tail(&hdev->raw_q, skb);
                queue_work(hdev->workqueue, &hdev->tx_work);
        }
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 4c214b2b88ef..ef66365b7354 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1998,7 +1998,7 @@ int br_multicast_set_hash_max(struct net_bridge *br, unsigned long val)
        u32 old;
        struct net_bridge_mdb_htable *mdb;
-        spin_lock(&br->multicast_lock);
+        spin_lock_bh(&br->multicast_lock);
        if (!netif_running(br->dev))
                goto unlock;
@@ -2030,7 +2030,7 @@ rollback:
        }
 unlock:
-        spin_unlock(&br->multicast_lock);
+        spin_unlock_bh(&br->multicast_lock);
        return err;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index ba3b7ea5ebb3..0ce469e5ec80 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2539,7 +2539,7 @@ static inline int skb_needs_linearize(struct sk_buff *skb,
 }
 int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
-                        struct netdev_queue *txq, void *accel_priv)
+                        struct netdev_queue *txq)
 {
        const struct net_device_ops *ops = dev->netdev_ops;
        int rc = NETDEV_TX_OK;
@@ -2605,13 +2605,10 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
                        dev_queue_xmit_nit(skb, dev);
                skb_len = skb->len;
-                if (accel_priv)
-                        rc = ops->ndo_dfwd_start_xmit(skb, dev, accel_priv);
-                else
                        rc = ops->ndo_start_xmit(skb, dev);
                trace_net_dev_xmit(skb, rc, dev, skb_len);
-                if (rc == NETDEV_TX_OK && txq)
+                if (rc == NETDEV_TX_OK)
                        txq_trans_update(txq);
                return rc;
        }
@@ -2627,10 +2624,7 @@ gso:
                        dev_queue_xmit_nit(nskb, dev);
                skb_len = nskb->len;
-                if (accel_priv)
+                rc = ops->ndo_start_xmit(nskb, dev);
-                        rc = ops->ndo_dfwd_start_xmit(nskb, dev, accel_priv);
-                else
-                        rc = ops->ndo_start_xmit(nskb, dev);
                trace_net_dev_xmit(nskb, rc, dev, skb_len);
                if (unlikely(rc != NETDEV_TX_OK)) {
                        if (rc & ~NETDEV_TX_MASK)
@@ -2811,7 +2805,7 @@ EXPORT_SYMBOL(dev_loopback_xmit);
 *      the BH enable code must have IRQs enabled so that it will not deadlock.
 *          --BLG
 */
-int dev_queue_xmit(struct sk_buff *skb)
+int __dev_queue_xmit(struct sk_buff *skb, void *accel_priv)
 {
        struct net_device *dev = skb->dev;
        struct netdev_queue *txq;
@@ -2827,7 +2821,7 @@ int dev_queue_xmit(struct sk_buff *skb)
        skb_update_prio(skb);
-        txq = netdev_pick_tx(dev, skb);
+        txq = netdev_pick_tx(dev, skb, accel_priv);
        q = rcu_dereference_bh(txq->qdisc);
 #ifdef CONFIG_NET_CLS_ACT
@@ -2863,7 +2857,7 @@ int dev_queue_xmit(struct sk_buff *skb)
                        if (!netif_xmit_stopped(txq)) {
                                __this_cpu_inc(xmit_recursion);
-                                rc = dev_hard_start_xmit(skb, dev, txq, NULL);
+                                rc = dev_hard_start_xmit(skb, dev, txq);
                                __this_cpu_dec(xmit_recursion);
                                if (dev_xmit_complete(rc)) {
                                        HARD_TX_UNLOCK(dev, txq);
@@ -2892,8 +2886,19 @@ out:
        rcu_read_unlock_bh();
        return rc;
 }
+int dev_queue_xmit(struct sk_buff *skb)
+{
+        return __dev_queue_xmit(skb, NULL);
+}
 EXPORT_SYMBOL(dev_queue_xmit);
+int dev_queue_xmit_accel(struct sk_buff *skb, void *accel_priv)
+{
+        return __dev_queue_xmit(skb, accel_priv);
+}
+EXPORT_SYMBOL(dev_queue_xmit_accel);
 /*=======================================================================
                        Receiver routines
@@ -4500,7 +4505,7 @@ struct net_device *netdev_all_upper_get_next_dev_rcu(struct net_device *dev,
 {
        struct netdev_adjacent *upper;
-        WARN_ON_ONCE(!rcu_read_lock_held());
+        WARN_ON_ONCE(!rcu_read_lock_held() && !lockdep_rtnl_is_held());
        upper = list_entry_rcu((*iter)->next, struct netdev_adjacent, list);
diff --git a/net/core/filter.c b/net/core/filter.c
index 01b780856db2..ad30d626a5bd 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -36,7 +36,6 @@
 #include <asm/uaccess.h>
 #include <asm/unaligned.h>
 #include <linux/filter.h>
-#include <linux/reciprocal_div.h>
 #include <linux/ratelimit.h>
 #include <linux/seccomp.h>
 #include <linux/if_vlan.h>
@@ -166,7 +165,7 @@ unsigned int sk_run_filter(const struct sk_buff *skb,
                        A /= X;
                        continue;
                case BPF_S_ALU_DIV_K:
-                        A = reciprocal_divide(A, K);
+                        A /= K;
                        continue;
                case BPF_S_ALU_MOD_X:
                        if (X == 0)
@@ -553,11 +552,6 @@ int sk_chk_filter(struct sock_filter *filter, unsigned int flen)
                /* Some instructions need special checks */
                switch (code) {
                case BPF_S_ALU_DIV_K:
-                        /* check for division by zero */
-                        if (ftest->k == 0)
-                                return -EINVAL;
-                        ftest->k = reciprocal_value(ftest->k);
-                        break;
                case BPF_S_ALU_MOD_K:
                        /* check for division by zero */
                        if (ftest->k == 0)
@@ -853,27 +847,7 @@ void sk_decode_filter(struct sock_filter *filt, struct sock_filter *to)
        to->code = decodes[code];
        to->jt = filt->jt;
        to->jf = filt->jf;
+        to->k = filt->k;
-        if (code == BPF_S_ALU_DIV_K) {
-                /*
-                 * When loaded this rule user gave us X, which was
-                 * translated into R = r(X). Now we calculate the
-                 * RR = r(R) and report it back. If next time this
-                 * value is loaded and RRR = r(RR) is calculated
-                 * then the R == RRR will be true.
-                 *
-                 * One exception. X == 1 translates into R == 0 and
-                 * we can't calculate RR out of it with r().
-                 */
-                if (filt->k == 0)
-                        to->k = 1;
-                else
-                        to->k = reciprocal_value(filt->k);
-                BUG_ON(reciprocal_value(to->k) != filt->k);
-        } else
-                to->k = filt->k;
 }
 int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf, unsigned int len)
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index d6ef17322500..2fc5beaf5783 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -395,17 +395,21 @@ u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
 EXPORT_SYMBOL(__netdev_pick_tx);
 struct netdev_queue *netdev_pick_tx(struct net_device *dev,
-                                    struct sk_buff *skb)
+                                    struct sk_buff *skb,
+                                    void *accel_priv)
 {
        int queue_index = 0;
        if (dev->real_num_tx_queues != 1) {
                const struct net_device_ops *ops = dev->netdev_ops;
                if (ops->ndo_select_queue)
-                        queue_index = ops->ndo_select_queue(dev, skb);
+                        queue_index = ops->ndo_select_queue(dev, skb,
+                                                            accel_priv);
                else
                        queue_index = __netdev_pick_tx(dev, skb);
-                queue_index = dev_cap_txqueue(dev, queue_index);
+                if (!accel_priv)
+                        queue_index = dev_cap_txqueue(dev, queue_index);
        }
        skb_set_queue_mapping(skb, queue_index);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 36b1443f9ae4..932c6d7cf666 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1275,7 +1275,7 @@ int neigh_compat_output(struct neighbour *neigh, struct sk_buff *skb)
        if (dev_hard_header(skb, dev, ntohs(skb->protocol), NULL, NULL,
                            skb->len) < 0 &&
-            dev->header_ops->rebuild(skb))
+            dev_rebuild_header(skb))
                return 0;
        return dev_queue_xmit(skb);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 8f971990677c..19fe9c717ced 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -375,7 +375,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
        if (skb_queue_len(&npinfo->txq) == 0 && !netpoll_owner_active(dev)) {
                struct netdev_queue *txq;
-                txq = netdev_pick_tx(dev, skb);
+                txq = netdev_pick_tx(dev, skb, NULL);
                /* try until next clock tick */
                for (tries = jiffies_to_usecs(1)/USEC_PER_POLL;
@@ -386,8 +386,14 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
                                            !vlan_hw_offload_capable(netif_skb_features(skb),
                                                                     skb->vlan_proto)) {
                                                skb = __vlan_put_tag(skb, skb->vlan_proto, vlan_tx_tag_get(skb));
-                                                if (unlikely(!skb))
+                                                if (unlikely(!skb)) {
-                                                        break;
+                                                        /* This is actually a packet drop, but we
+                                                         * don't want the code at the end of this
+                                                         * function to try and re-queue a NULL skb.
+                                                         */
+                                                        status = NETDEV_TX_OK;
+                                                        goto unlock_txq;
+                                                }
                                                skb->vlan_tci = 0;
                                        }
@@ -395,6 +401,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
                                        if (status == NETDEV_TX_OK)
                                                txq_trans_update(txq);
                                }
+                        unlock_txq:
                                __netif_tx_unlock(txq);
                                if (status == NETDEV_TX_OK)
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 4c6bdf97a657..595ddf0459db 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -152,17 +152,6 @@ static const struct file_operations dccpprobe_fops = {
        .llseek  = noop_llseek,
 };
-static __init int setup_jprobe(void)
-{
-        int ret = register_jprobe(&dccp_send_probe);
-        if (ret) {
-                request_module("dccp");
-                ret = register_jprobe(&dccp_send_probe);
-        }
-        return ret;
-}
 static __init int dccpprobe_init(void)
 {
        int ret = -ENOMEM;
@@ -174,7 +163,13 @@ static __init int dccpprobe_init(void)
        if (!proc_create(procname, S_IRUSR, init_net.proc_net, &dccpprobe_fops))
                goto err0;
-        ret = setup_jprobe();
+        ret = register_jprobe(&dccp_send_probe);
+        if (ret) {
+                ret = request_module("dccp");
+                if (!ret)
+                        ret = register_jprobe(&dccp_send_probe);
+        }
        if (ret)
                goto err1;
diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c
index 459e200c08a4..a2d2456a557a 100644
--- a/net/ieee802154/6lowpan.c
+++ b/net/ieee802154/6lowpan.c
@@ -547,7 +547,7 @@ static int lowpan_header_create(struct sk_buff *skb,
                        hc06_ptr += 3;
                } else {
                        /* compress nothing */
-                        memcpy(hc06_ptr, &hdr, 4);
+                        memcpy(hc06_ptr, hdr, 4);
                        /* replace the top byte with new ECN | DSCP format */
                        *hc06_ptr = tmp;
                        hc06_ptr += 4;
diff --git a/net/ieee802154/nl-phy.c b/net/ieee802154/nl-phy.c
index d08c7a43dcd1..89b265aea151 100644
--- a/net/ieee802154/nl-phy.c
+++ b/net/ieee802154/nl-phy.c
@@ -221,8 +221,10 @@ int ieee802154_add_iface(struct sk_buff *skb, struct genl_info *info)
        if (info->attrs[IEEE802154_ATTR_DEV_TYPE]) {
                type = nla_get_u8(info->attrs[IEEE802154_ATTR_DEV_TYPE]);
-                if (type >= __IEEE802154_DEV_MAX)
+                if (type >= __IEEE802154_DEV_MAX) {
-                        return -EINVAL;
+                        rc = -EINVAL;
+                        goto nla_put_failure;
+                }
        }
        dev = phy->add_iface(phy, devname, type);
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index e5d436188464..2cd02f32f99f 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -28,6 +28,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
        netdev_features_t enc_features;
        int ghl = GRE_HEADER_SECTION;
        struct gre_base_hdr *greh;
+        u16 mac_offset = skb->mac_header;
        int mac_len = skb->mac_len;
        __be16 protocol = skb->protocol;
        int tnl_hlen;
@@ -58,13 +59,13 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
        } else
                csum = false;
+        if (unlikely(!pskb_may_pull(skb, ghl)))
+                goto out;
        /* setup inner skb. */
        skb->protocol = greh->protocol;
        skb->encapsulation = 0;
-        if (unlikely(!pskb_may_pull(skb, ghl)))
-                goto out;
        __skb_pull(skb, ghl);
        skb_reset_mac_header(skb);
        skb_set_network_header(skb, skb_inner_network_offset(skb));
@@ -73,8 +74,10 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
        /* segment inner packet. */
        enc_features = skb->dev->hw_enc_features & netif_skb_features(skb);
        segs = skb_mac_gso_segment(skb, enc_features);
-        if (!segs || IS_ERR(segs))
+        if (!segs || IS_ERR(segs)) {
+                skb_gso_error_unwind(skb, protocol, ghl, mac_offset, mac_len);
                goto out;
+        }
        skb = segs;
        tnl_hlen = skb_tnl_header_len(skb);
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 56a964a553d2..e34dccbc4d70 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -106,6 +106,10 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
        r->id.idiag_sport = inet->inet_sport;
        r->id.idiag_dport = inet->inet_dport;
+        memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
+        memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
        r->id.idiag_src[0] = inet->inet_rcv_saddr;
        r->id.idiag_dst[0] = inet->inet_daddr;
@@ -240,12 +244,19 @@ static int inet_twsk_diag_fill(struct inet_timewait_sock *tw,
        r->idiag_family       = tw->tw_family;
        r->idiag_retrans      = 0;
        r->id.idiag_if        = tw->tw_bound_dev_if;
        sock_diag_save_cookie(tw, r->id.idiag_cookie);
        r->id.idiag_sport     = tw->tw_sport;
        r->id.idiag_dport     = tw->tw_dport;
+        memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
+        memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
        r->id.idiag_src[0]    = tw->tw_rcv_saddr;
        r->id.idiag_dst[0]    = tw->tw_daddr;
        r->idiag_state        = tw->tw_substate;
        r->idiag_timer        = 3;
        r->idiag_expires      = jiffies_to_msecs(tmo);
@@ -726,8 +737,13 @@ static int inet_diag_fill_req(struct sk_buff *skb, struct sock *sk,
        r->id.idiag_sport = inet->inet_sport;
        r->id.idiag_dport = ireq->ir_rmt_port;
+        memset(&r->id.idiag_src, 0, sizeof(r->id.idiag_src));
+        memset(&r->id.idiag_dst, 0, sizeof(r->id.idiag_dst));
        r->id.idiag_src[0] = ireq->ir_loc_addr;
        r->id.idiag_dst[0] = ireq->ir_rmt_addr;
        r->idiag_expires = jiffies_to_msecs(tmo);
        r->idiag_rqueue = 0;
        r->idiag_wqueue = 0;
@@ -914,12 +930,15 @@ skip_listen_ht:
                spin_lock_bh(lock);
                sk_nulls_for_each(sk, node, &head->chain) {
                        int res;
+                        int state;
                        if (!net_eq(sock_net(sk), net))
                                continue;
                        if (num < s_num)
                                goto next_normal;
-                        if (!(r->idiag_states & (1 << sk->sk_state)))
+                        state = (sk->sk_state == TCP_TIME_WAIT) ?
+                                inet_twsk(sk)->tw_substate : sk->sk_state;
+                        if (!(r->idiag_states & (1 << state)))
                                goto next_normal;
                        if (r->sdiag_family != AF_UNSPEC &&
                            sk->sk_family != r->sdiag_family)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index d7aea4c5b940..e560ef34cf4b 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -217,6 +217,7 @@ static int ipgre_rcv(struct sk_buff *skb, const struct tnl_ptk_info *tpi)
                                  iph->saddr, iph->daddr, tpi->key);
        if (tunnel) {
+                skb_pop_mac_header(skb);
                ip_tunnel_rcv(tunnel, skb, tpi, log_ecn_error);
                return PACKET_RCVD;
        }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 912402752f2f..df184616493f 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -828,7 +828,7 @@ static int __ip_append_data(struct sock *sk,
        if (cork->length + length > maxnonfragsize - fragheaderlen) {
                ip_local_error(sk, EMSGSIZE, fl4->daddr, inet->inet_dport,
-                               mtu-exthdrlen);
+                               mtu - (opt ? opt->optlen : 0));
                return -EMSGSIZE;
        }
@@ -1151,7 +1151,8 @@ ssize_t	ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
                         mtu : 0xFFFF;
        if (cork->length + size > maxnonfragsize - fragheaderlen) {
-                ip_local_error(sk, EMSGSIZE, fl4->daddr, inet->inet_dport, mtu);
+                ip_local_error(sk, EMSGSIZE, fl4->daddr, inet->inet_dport,
+                               mtu - (opt ? opt->optlen : 0));
                return -EMSGSIZE;
        }
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 62212c772a4b..1672409f5ba5 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -157,9 +157,12 @@ static struct mr_table *ipmr_get_table(struct net *net, u32 id)
 static int ipmr_fib_lookup(struct net *net, struct flowi4 *flp4,
                           struct mr_table **mrt)
 {
-        struct ipmr_result res;
-        struct fib_lookup_arg arg = { .result = &res, };
        int err;
+        struct ipmr_result res;
+        struct fib_lookup_arg arg = {
+                .result = &res,
+                .flags = FIB_LOOKUP_NOREF,
+        };
        err = fib_rules_lookup(net->ipv4.mr_rules_ops,
                               flowi4_to_flowi(flp4), 0, &arg);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index c4638e6f0238..82de78603686 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1623,11 +1623,11 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                    (len > sysctl_tcp_dma_copybreak) && !(flags & MSG_PEEK) &&
                    !sysctl_tcp_low_latency &&
                    net_dma_find_channel()) {
-                        preempt_enable_no_resched();
+                        preempt_enable();
                        tp->ucopy.pinned_list =
                                        dma_pin_iovec_pages(msg->msg_iov, len);
                } else {
-                        preempt_enable_no_resched();
+                        preempt_enable();
                }
        }
 #endif
diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
index 06493736fbc8..098b3a29f6f3 100644
--- a/net/ipv4/tcp_metrics.c
+++ b/net/ipv4/tcp_metrics.c
@@ -22,6 +22,9 @@
 int sysctl_tcp_nometrics_save __read_mostly;
+static struct tcp_metrics_block *__tcp_get_metrics(const struct inetpeer_addr *addr,
+                                                   struct net *net, unsigned int hash);
 struct tcp_fastopen_metrics {
        u16     mss;
        u16     syn_loss:10;            /* Recurring Fast Open SYN losses */
@@ -130,16 +133,41 @@ static void tcpm_suck_dst(struct tcp_metrics_block *tm, struct dst_entry *dst,
        }
 }
+#define TCP_METRICS_TIMEOUT             (60 * 60 * HZ)
+static void tcpm_check_stamp(struct tcp_metrics_block *tm, struct dst_entry *dst)
+{
+        if (tm && unlikely(time_after(jiffies, tm->tcpm_stamp + TCP_METRICS_TIMEOUT)))
+                tcpm_suck_dst(tm, dst, false);
+}
+#define TCP_METRICS_RECLAIM_DEPTH       5
+#define TCP_METRICS_RECLAIM_PTR         (struct tcp_metrics_block *) 0x1UL
 static struct tcp_metrics_block *tcpm_new(struct dst_entry *dst,
                                          struct inetpeer_addr *addr,
-                                          unsigned int hash,
+                                          unsigned int hash)
-                                          bool reclaim)
 {
        struct tcp_metrics_block *tm;
        struct net *net;
+        bool reclaim = false;
        spin_lock_bh(&tcp_metrics_lock);
        net = dev_net(dst->dev);
+        /* While waiting for the spin-lock the cache might have been populated
+         * with this entry and so we have to check again.
+         */
+        tm = __tcp_get_metrics(addr, net, hash);
+        if (tm == TCP_METRICS_RECLAIM_PTR) {
+                reclaim = true;
+                tm = NULL;
+        }
+        if (tm) {
+                tcpm_check_stamp(tm, dst);
+                goto out_unlock;
+        }
        if (unlikely(reclaim)) {
                struct tcp_metrics_block *oldest;
@@ -169,17 +197,6 @@ out_unlock:
        return tm;
 }
-#define TCP_METRICS_TIMEOUT             (60 * 60 * HZ)
-static void tcpm_check_stamp(struct tcp_metrics_block *tm, struct dst_entry *dst)
-{
-        if (tm && unlikely(time_after(jiffies, tm->tcpm_stamp + TCP_METRICS_TIMEOUT)))
-                tcpm_suck_dst(tm, dst, false);
-}
-#define TCP_METRICS_RECLAIM_DEPTH       5
-#define TCP_METRICS_RECLAIM_PTR         (struct tcp_metrics_block *) 0x1UL
 static struct tcp_metrics_block *tcp_get_encode(struct tcp_metrics_block *tm, int depth)
 {
        if (tm)
@@ -282,7 +299,6 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk,
        struct inetpeer_addr addr;
        unsigned int hash;
        struct net *net;
-        bool reclaim;
        addr.family = sk->sk_family;
        switch (addr.family) {
@@ -304,13 +320,10 @@ static struct tcp_metrics_block *tcp_get_metrics(struct sock *sk,
        hash = hash_32(hash, net->ipv4.tcp_metrics_hash_log);
        tm = __tcp_get_metrics(&addr, net, hash);
-        reclaim = false;
+        if (tm == TCP_METRICS_RECLAIM_PTR)
-        if (tm == TCP_METRICS_RECLAIM_PTR) {
-                reclaim = true;
                tm = NULL;
-        }
        if (!tm && create)
-                tm = tcpm_new(dst, &addr, hash, reclaim);
+                tm = tcpm_new(dst, &addr, hash);
        else
                tcpm_check_stamp(tm, dst);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index f140048334ce..a7e4729e974b 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2478,6 +2478,7 @@ struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
                                       netdev_features_t features)
 {
        struct sk_buff *segs = ERR_PTR(-EINVAL);
+        u16 mac_offset = skb->mac_header;
        int mac_len = skb->mac_len;
        int tnl_hlen = skb_inner_mac_header(skb) - skb_transport_header(skb);
        __be16 protocol = skb->protocol;
@@ -2497,8 +2498,11 @@ struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
        /* segment inner packet. */
        enc_features = skb->dev->hw_enc_features & netif_skb_features(skb);
        segs = skb_mac_gso_segment(skb, enc_features);
-        if (!segs || IS_ERR(segs))
+        if (!segs || IS_ERR(segs)) {
+                skb_gso_error_unwind(skb, protocol, tnl_hlen, mac_offset,
+                                     mac_len);
                goto out;
+        }
        outer_hlen = skb_tnl_header_len(skb);
        skb = segs;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 83206de2bc76..79c62bdcd3c5 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -41,6 +41,14 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
 {
        struct sk_buff *segs = ERR_PTR(-EINVAL);
        unsigned int mss;
+        int offset;
+        __wsum csum;
+        if (skb->encapsulation &&
+            skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL) {
+                segs = skb_udp_tunnel_segment(skb, features);
+                goto out;
+        }
        mss = skb_shinfo(skb)->gso_size;
        if (unlikely(skb->len <= mss))
@@ -63,27 +71,20 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
                goto out;
        }
+        /* Do software UFO. Complete and fill in the UDP checksum as
+         * HW cannot do checksum of UDP packets sent as multiple
+         * IP fragments.
+         */
+        offset = skb_checksum_start_offset(skb);
+        csum = skb_checksum(skb, offset, skb->len - offset, 0);
+        offset += skb->csum_offset;
+        *(__sum16 *)(skb->data + offset) = csum_fold(csum);
+        skb->ip_summed = CHECKSUM_NONE;
        /* Fragment the skb. IP headers of the fragments are updated in
         * inet_gso_segment()
         */
-        if (skb->encapsulation && skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL)
+        segs = skb_segment(skb, features);
-                segs = skb_udp_tunnel_segment(skb, features);
-        else {
-                int offset;
-                __wsum csum;
-                /* Do software UFO. Complete and fill in the UDP checksum as
-                 * HW cannot do checksum of UDP packets sent as multiple
-                 * IP fragments.
-                 */
-                offset = skb_checksum_start_offset(skb);
-                csum = skb_checksum(skb, offset, skb->len - offset, 0);
-                offset += skb->csum_offset;
-                *(__sum16 *)(skb->data + offset) = csum_fold(csum);
-                skb->ip_summed = CHECKSUM_NONE;
-                segs = skb_segment(skb, features);
-        }
 out:
        return segs;
 }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index d5fa5b8c443e..4b6b720971b9 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1671,7 +1671,7 @@ void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)
 static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
 {
        struct in6_addr addr;
-        if (ifp->prefix_len == 127) /* RFC 6164 */
+        if (ifp->prefix_len >= 127) /* RFC 6164 */
                return;
        ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
        if (ipv6_addr_any(&addr))
@@ -1682,7 +1682,7 @@ static void addrconf_join_anycast(struct inet6_ifaddr *ifp)
 static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)
 {
        struct in6_addr addr;
-        if (ifp->prefix_len == 127) /* RFC 6164 */
+        if (ifp->prefix_len >= 127) /* RFC 6164 */
                return;
        ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
        if (ipv6_addr_any(&addr))
@@ -2509,7 +2509,8 @@ static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
        struct inet6_ifaddr *ifp;
        ifp = ipv6_add_addr(idev, addr, NULL, plen,
-                            scope, IFA_F_PERMANENT, 0, 0);
+                            scope, IFA_F_PERMANENT,
+                            INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
        if (!IS_ERR(ifp)) {
                spin_lock_bh(&ifp->lock);
                ifp->flags &= ~IFA_F_TENTATIVE;
@@ -2637,7 +2638,8 @@ static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr
 #endif
-        ifp = ipv6_add_addr(idev, addr, NULL, 64, IFA_LINK, addr_flags, 0, 0);
+        ifp = ipv6_add_addr(idev, addr, NULL, 64, IFA_LINK, addr_flags,
+                            INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
        if (!IS_ERR(ifp)) {
                addrconf_prefix_route(&ifp->addr, ifp->prefix_len, idev->dev, 0, 0);
                addrconf_dad_start(ifp);
@@ -3187,6 +3189,22 @@ out:
        in6_ifa_put(ifp);
 }
+/* ifp->idev must be at least read locked */
+static bool ipv6_lonely_lladdr(struct inet6_ifaddr *ifp)
+{
+        struct inet6_ifaddr *ifpiter;
+        struct inet6_dev *idev = ifp->idev;
+        list_for_each_entry(ifpiter, &idev->addr_list, if_list) {
+                if (ifp != ifpiter && ifpiter->scope == IFA_LINK &&
+                    (ifpiter->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|
+                                       IFA_F_OPTIMISTIC|IFA_F_DADFAILED)) ==
+                    IFA_F_PERMANENT)
+                        return false;
+        }
+        return true;
+}
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
 {
        struct net_device *dev = ifp->idev->dev;
@@ -3206,14 +3224,11 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
         */
        read_lock_bh(&ifp->idev->lock);
-        spin_lock(&ifp->lock);
+        send_mld = ifp->scope == IFA_LINK && ipv6_lonely_lladdr(ifp);
-        send_mld = ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL &&
-                   ifp->idev->valid_ll_addr_cnt == 1;
        send_rs = send_mld &&
                  ipv6_accept_ra(ifp->idev) &&
                  ifp->idev->cnf.rtr_solicits > 0 &&
                  (dev->flags&IFF_LOOPBACK) == 0;
-        spin_unlock(&ifp->lock);
        read_unlock_bh(&ifp->idev->lock);
        /* While dad is in progress mld report's source address is in6_addrany.
@@ -3456,7 +3471,12 @@ restart:
                                         &inet6_addr_lst[i], addr_lst) {
                        unsigned long age;
-                        if (ifp->flags & IFA_F_PERMANENT)
+                        /* When setting preferred_lft to a value not zero or
+                         * infinity, while valid_lft is infinity
+                         * IFA_F_PERMANENT has a non-infinity life time.
+                         */
+                        if ((ifp->flags & IFA_F_PERMANENT) &&
+                            (ifp->prefered_lft == INFINITY_LIFE_TIME))
                                continue;
                        spin_lock(&ifp->lock);
@@ -3481,7 +3501,8 @@ restart:
                                        ifp->flags |= IFA_F_DEPRECATED;
                                }
-                                if (time_before(ifp->tstamp + ifp->valid_lft * HZ, next))
+                                if ((ifp->valid_lft != INFINITY_LIFE_TIME) &&
+                                    (time_before(ifp->tstamp + ifp->valid_lft * HZ, next)))
                                        next = ifp->tstamp + ifp->valid_lft * HZ;
                                spin_unlock(&ifp->lock);
@@ -3761,7 +3782,8 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
        put_ifaddrmsg(nlh, ifa->prefix_len, ifa->flags, rt_scope(ifa->scope),
                      ifa->idev->dev->ifindex);
-        if (!(ifa->flags&IFA_F_PERMANENT)) {
+        if (!((ifa->flags&IFA_F_PERMANENT) &&
+              (ifa->prefered_lft == INFINITY_LIFE_TIME))) {
                preferred = ifa->prefered_lft;
                valid = ifa->valid_lft;
                if (preferred != INFINITY_LIFE_TIME) {
@@ -4503,19 +4525,6 @@ errout:
                rtnl_set_sk_err(net, RTNLGRP_IPV6_PREFIX, err);
 }
-static void update_valid_ll_addr_cnt(struct inet6_ifaddr *ifp, int count)
-{
-        write_lock_bh(&ifp->idev->lock);
-        spin_lock(&ifp->lock);
-        if (((ifp->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|
-                            IFA_F_DADFAILED)) == IFA_F_PERMANENT) &&
-            (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL))
-                ifp->idev->valid_ll_addr_cnt += count;
-        WARN_ON(ifp->idev->valid_ll_addr_cnt < 0);
-        spin_unlock(&ifp->lock);
-        write_unlock_bh(&ifp->idev->lock);
-}
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 {
        struct net *net = dev_net(ifp->idev->dev);
@@ -4524,8 +4533,6 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
        switch (event) {
        case RTM_NEWADDR:
-                update_valid_ll_addr_cnt(ifp, 1);
                /*
                 * If the address was optimistic
                 * we inserted the route at the start of
@@ -4541,8 +4548,6 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                                              ifp->idev->dev, 0, 0);
                break;
        case RTM_DELADDR:
-                update_valid_ll_addr_cnt(ifp, -1);
                if (ifp->idev->cnf.forwarding)
                        addrconf_leave_anycast(ifp);
                addrconf_leave_solict(ifp->idev, &ifp->addr);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 4acdb63495db..e6f931997996 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1193,11 +1193,35 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
        fragheaderlen = sizeof(struct ipv6hdr) + rt->rt6i_nfheader_len +
                        (opt ? opt->opt_nflen : 0);
-        maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen - sizeof(struct frag_hdr);
+        maxfraglen = ((mtu - fragheaderlen) & ~7) + fragheaderlen -
+                     sizeof(struct frag_hdr);
        if (mtu <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN) {
-                if (cork->length + length > sizeof(struct ipv6hdr) + IPV6_MAXPLEN - fragheaderlen) {
+                unsigned int maxnonfragsize, headersize;
-                        ipv6_local_error(sk, EMSGSIZE, fl6, mtu-exthdrlen);
+                headersize = sizeof(struct ipv6hdr) +
+                             (opt ? opt->tot_len : 0) +
+                             (dst_allfrag(&rt->dst) ?
+                              sizeof(struct frag_hdr) : 0) +
+                             rt->rt6i_nfheader_len;
+                maxnonfragsize = (np->pmtudisc >= IPV6_PMTUDISC_DO) ?
+                                 mtu : sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
+                /* dontfrag active */
+                if ((cork->length + length > mtu - headersize) && dontfrag &&
+                    (sk->sk_protocol == IPPROTO_UDP ||
+                     sk->sk_protocol == IPPROTO_RAW)) {
+                        ipv6_local_rxpmtu(sk, fl6, mtu - headersize +
+                                                   sizeof(struct ipv6hdr));
+                        goto emsgsize;
+                }
+                if (cork->length + length > maxnonfragsize - headersize) {
+emsgsize:
+                        ipv6_local_error(sk, EMSGSIZE, fl6,
+                                         mtu - headersize +
+                                         sizeof(struct ipv6hdr));
                        return -EMSGSIZE;
                }
        }
@@ -1222,12 +1246,6 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         * --yoshfuji
         */
-        if ((length > mtu) && dontfrag && (sk->sk_protocol == IPPROTO_UDP ||
-                                           sk->sk_protocol == IPPROTO_RAW)) {
-                ipv6_local_rxpmtu(sk, fl6, mtu-exthdrlen);
-                return -EMSGSIZE;
-        }
        skb = skb_peek_tail(&sk->sk_write_queue);
        cork->length += length;
        if (((length > mtu) ||
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index d6062325db08..7881965a8248 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -103,16 +103,25 @@ struct ip6_tnl_net {
 static struct net_device_stats *ip6_get_stats(struct net_device *dev)
 {
-        struct pcpu_tstats sum = { 0 };
+        struct pcpu_tstats tmp, sum = { 0 };
        int i;
        for_each_possible_cpu(i) {
+                unsigned int start;
                const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
-                sum.rx_packets += tstats->rx_packets;
+                do {
-                sum.rx_bytes   += tstats->rx_bytes;
+                        start = u64_stats_fetch_begin_bh(&tstats->syncp);
-                sum.tx_packets += tstats->tx_packets;
+                        tmp.rx_packets = tstats->rx_packets;
-                sum.tx_bytes   += tstats->tx_bytes;
+                        tmp.rx_bytes = tstats->rx_bytes;
+                        tmp.tx_packets = tstats->tx_packets;
+                        tmp.tx_bytes =  tstats->tx_bytes;
+                } while (u64_stats_fetch_retry_bh(&tstats->syncp, start));
+                sum.rx_packets += tmp.rx_packets;
+                sum.rx_bytes   += tmp.rx_bytes;
+                sum.tx_packets += tmp.tx_packets;
+                sum.tx_bytes   += tmp.tx_bytes;
        }
        dev->stats.rx_packets = sum.rx_packets;
        dev->stats.rx_bytes   = sum.rx_bytes;
@@ -824,8 +833,10 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                }
                tstats = this_cpu_ptr(t->dev->tstats);
+                u64_stats_update_begin(&tstats->syncp);
                tstats->rx_packets++;
                tstats->rx_bytes += skb->len;
+                u64_stats_update_end(&tstats->syncp);
                netif_rx(skb);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index ed94ba61dda0..7b42d5ef868d 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -75,26 +75,6 @@ struct vti6_net {
        struct ip6_tnl __rcu **tnls[2];
 };
-static struct net_device_stats *vti6_get_stats(struct net_device *dev)
-{
-        struct pcpu_tstats sum = { 0 };
-        int i;
-        for_each_possible_cpu(i) {
-                const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i);
-                sum.rx_packets += tstats->rx_packets;
-                sum.rx_bytes   += tstats->rx_bytes;
-                sum.tx_packets += tstats->tx_packets;
-                sum.tx_bytes   += tstats->tx_bytes;
-        }
-        dev->stats.rx_packets = sum.rx_packets;
-        dev->stats.rx_bytes   = sum.rx_bytes;
-        dev->stats.tx_packets = sum.tx_packets;
-        dev->stats.tx_bytes   = sum.tx_bytes;
-        return &dev->stats;
-}
 #define for_each_vti6_tunnel_rcu(start) \
        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
@@ -331,8 +311,10 @@ static int vti6_rcv(struct sk_buff *skb)
                }
                tstats = this_cpu_ptr(t->dev->tstats);
+                u64_stats_update_begin(&tstats->syncp);
                tstats->rx_packets++;
                tstats->rx_bytes += skb->len;
+                u64_stats_update_end(&tstats->syncp);
                skb->mark = 0;
                secpath_reset(skb);
@@ -716,7 +698,7 @@ static const struct net_device_ops vti6_netdev_ops = {
        .ndo_start_xmit = vti6_tnl_xmit,
        .ndo_do_ioctl   = vti6_ioctl,
        .ndo_change_mtu = vti6_change_mtu,
-        .ndo_get_stats  = vti6_get_stats,
+        .ndo_get_stats64 = ip_tunnel_get_stats64,
 };
 /**
@@ -750,12 +732,18 @@ static void vti6_dev_setup(struct net_device *dev)
 static inline int vti6_dev_init_gen(struct net_device *dev)
 {
        struct ip6_tnl *t = netdev_priv(dev);
+        int i;
        t->dev = dev;
        t->net = dev_net(dev);
        dev->tstats = alloc_percpu(struct pcpu_tstats);
        if (!dev->tstats)
                return -ENOMEM;
+        for_each_possible_cpu(i) {
+                struct pcpu_tstats *stats;
+                stats = per_cpu_ptr(dev->tstats, i);
+                u64_stats_init(&stats->syncp);
+        }
        return 0;
 }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index f365310bfcca..0eb4038a4d63 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -141,9 +141,12 @@ static struct mr6_table *ip6mr_get_table(struct net *net, u32 id)
 static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
                            struct mr6_table **mrt)
 {
-        struct ip6mr_result res;
-        struct fib_lookup_arg arg = { .result = &res, };
        int err;
+        struct ip6mr_result res;
+        struct fib_lookup_arg arg = {
+                .result = &res,
+                .flags = FIB_LOOKUP_NOREF,
+        };
        err = fib_rules_lookup(net->ipv6.mr6_rules_ops,
                               flowi6_to_flowi(flp6), 0, &arg);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a0a48ac3403f..4b4944c3e4c4 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1905,9 +1905,7 @@ static struct rt6_info *ip6_rt_copy(struct rt6_info *ort,
                else
                        rt->rt6i_gateway = *dest;
                rt->rt6i_flags = ort->rt6i_flags;
-                if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) ==
+                rt6_set_from(rt, ort);
-                    (RTF_DEFAULT | RTF_ADDRCONF))
-                        rt6_set_from(rt, ort);
                rt->rt6i_metric = 0;
 #ifdef CONFIG_IPV6_SUBTREES
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 366fbba3359a..d3005b34476a 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -702,8 +702,10 @@ static int ipip6_rcv(struct sk_buff *skb)
                }
                tstats = this_cpu_ptr(tunnel->dev->tstats);
+                u64_stats_update_begin(&tstats->syncp);
                tstats->rx_packets++;
                tstats->rx_bytes += skb->len;
+                u64_stats_update_end(&tstats->syncp);
                netif_rx(skb);
@@ -924,7 +926,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                if (tunnel->parms.iph.daddr && skb_dst(skb))
                        skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu);
-                if (skb->len > mtu) {
+                if (skb->len > mtu && !skb_is_gso(skb)) {
                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                        ip_rt_put(rt);
                        goto tx_error;
@@ -966,8 +968,10 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
        tos = INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
        skb = iptunnel_handle_offloads(skb, false, SKB_GSO_SIT);
-        if (IS_ERR(skb))
+        if (IS_ERR(skb)) {
+                ip_rt_put(rt);
                goto out;
+        }
        err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, IPPROTO_IPV6, tos,
                            ttl, df, !net_eq(tunnel->net, dev_net(dev)));
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 7b01b9f5846c..c71b699eb555 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -715,7 +715,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
        unsigned long cpu_flags;
        size_t copied = 0;
        u32 peek_seq = 0;
-        u32 *seq;
+        u32 *seq, skb_len;
        unsigned long used;
        int target;     /* Read at least this many bytes */
        long timeo;
@@ -812,6 +812,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                }
                continue;
        found_ok_skb:
+                skb_len = skb->len;
                /* Ok so how much can we use? */
                used = skb->len - offset;
                if (len < used)
@@ -844,7 +845,7 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
                }
                /* Partial read */
-                if (used + offset < skb->len)
+                if (used + offset < skb_len)
                        continue;
        } while (len > 0);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 36c3a4cbcabf..a0757913046e 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1061,7 +1061,8 @@ static void ieee80211_uninit(struct net_device *dev)
 }
 static u16 ieee80211_netdev_select_queue(struct net_device *dev,
-                                         struct sk_buff *skb)
+                                         struct sk_buff *skb,
+                                         void *accel_priv)
 {
        return ieee80211_select_queue(IEEE80211_DEV_TO_SUB_IF(dev), skb);
 }
@@ -1078,7 +1079,8 @@ static const struct net_device_ops ieee80211_dataif_ops = {
 };
 static u16 ieee80211_monitor_select_queue(struct net_device *dev,
-                                          struct sk_buff *skb)
+                                          struct sk_buff *skb,
+                                          void *accel_priv)
 {
        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
        struct ieee80211_local *local = sdata->local;
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index c558b246ef00..ca7fa7f0613d 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -463,7 +463,6 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 {
        struct sta_info *sta = tx->sta;
        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
-        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
        struct ieee80211_local *local = tx->local;
        if (unlikely(!sta))
@@ -474,15 +473,6 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
                     !(info->flags & IEEE80211_TX_CTL_NO_PS_BUFFER))) {
                int ac = skb_get_queue_mapping(tx->skb);
-                /* only deauth, disassoc and action are bufferable MMPDUs */
-                if (ieee80211_is_mgmt(hdr->frame_control) &&
-                    !ieee80211_is_deauth(hdr->frame_control) &&
-                    !ieee80211_is_disassoc(hdr->frame_control) &&
-                    !ieee80211_is_action(hdr->frame_control)) {
-                        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
-                        return TX_CONTINUE;
-                }
                ps_dbg(sta->sdata, "STA %pM aid %d: PS buffer for AC %d\n",
                       sta->sta.addr, sta->sta.aid, ac);
                if (tx->local->total_ps_buffered >= TOTAL_MAX_TX_BUFFER)
@@ -525,9 +515,22 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
 static ieee80211_tx_result debug_noinline
 ieee80211_tx_h_ps_buf(struct ieee80211_tx_data *tx)
 {
+        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(tx->skb);
+        struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
        if (unlikely(tx->flags & IEEE80211_TX_PS_BUFFERED))
                return TX_CONTINUE;
+        /* only deauth, disassoc and action are bufferable MMPDUs */
+        if (ieee80211_is_mgmt(hdr->frame_control) &&
+            !ieee80211_is_deauth(hdr->frame_control) &&
+            !ieee80211_is_disassoc(hdr->frame_control) &&
+            !ieee80211_is_action(hdr->frame_control)) {
+                if (tx->flags & IEEE80211_TX_UNICAST)
+                        info->flags |= IEEE80211_TX_CTL_NO_PS_BUFFER;
+                return TX_CONTINUE;
+        }
        if (tx->flags & IEEE80211_TX_UNICAST)
                return ieee80211_tx_h_unicast_ps_buf(tx);
        else
diff --git a/net/netfilter/ipvs/ip_vs_nfct.c b/net/netfilter/ipvs/ip_vs_nfct.c
index c8beafd401aa..5a355a46d1dc 100644
--- a/net/netfilter/ipvs/ip_vs_nfct.c
+++ b/net/netfilter/ipvs/ip_vs_nfct.c
@@ -63,6 +63,7 @@
 #include <net/ip_vs.h>
 #include <net/netfilter/nf_conntrack_core.h>
 #include <net/netfilter/nf_conntrack_expect.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_zones.h>
@@ -97,6 +98,11 @@ ip_vs_update_conntrack(struct sk_buff *skb, struct ip_vs_conn *cp, int outin)
        if (CTINFO2DIR(ctinfo) != IP_CT_DIR_ORIGINAL)
                return;
+        /* Applications may adjust TCP seqs */
+        if (cp->app && nf_ct_protonum(ct) == IPPROTO_TCP &&
+            !nfct_seqadj(ct) && !nfct_seqadj_ext_add(ct))
+                return;
        /*
         * The connection is not yet in the hashtable, so we update it.
         * CIP->VIP will remain the same, so leave the tuple in
diff --git a/net/netfilter/nf_conntrack_seqadj.c b/net/netfilter/nf_conntrack_seqadj.c
index 17c1bcb182c6..f6e2ae91a80b 100644
--- a/net/netfilter/nf_conntrack_seqadj.c
+++ b/net/netfilter/nf_conntrack_seqadj.c
@@ -36,6 +36,11 @@ int nf_ct_seqadj_set(struct nf_conn *ct, enum ip_conntrack_info ctinfo,
        if (off == 0)
                return 0;
+        if (unlikely(!seqadj)) {
+                WARN_ONCE(1, "Missing nfct_seqadj_ext_add() setup call\n");
+                return 0;
+        }
        set_bit(IPS_SEQ_ADJUST_BIT, &ct->status);
        spin_lock_bh(&ct->lock);
diff --git a/net/netfilter/nf_conntrack_timestamp.c b/net/netfilter/nf_conntrack_timestamp.c
index 902fb0a6b38a..7a394df0deb7 100644
--- a/net/netfilter/nf_conntrack_timestamp.c
+++ b/net/netfilter/nf_conntrack_timestamp.c
@@ -97,7 +97,6 @@ int nf_conntrack_tstamp_pernet_init(struct net *net)
 void nf_conntrack_tstamp_pernet_fini(struct net *net)
 {
        nf_conntrack_tstamp_fini_sysctl(net);
-        nf_ct_extend_unregister(&tstamp_extend);
 }
 int nf_conntrack_tstamp_init(void)
diff --git a/net/netfilter/nf_nat_irc.c b/net/netfilter/nf_nat_irc.c
index f02b3605823e..1fb2258c3535 100644
--- a/net/netfilter/nf_nat_irc.c
+++ b/net/netfilter/nf_nat_irc.c
@@ -34,10 +34,14 @@ static unsigned int help(struct sk_buff *skb,
                         struct nf_conntrack_expect *exp)
 {
        char buffer[sizeof("4294967296 65635")];
+        struct nf_conn *ct = exp->master;
+        union nf_inet_addr newaddr;
        u_int16_t port;
        unsigned int ret;
        /* Reply comes from server. */
+        newaddr = ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3;
        exp->saved_proto.tcp.port = exp->tuple.dst.u.tcp.port;
        exp->dir = IP_CT_DIR_REPLY;
        exp->expectfn = nf_nat_follow_master;
@@ -57,17 +61,35 @@ static unsigned int help(struct sk_buff *skb,
        }
        if (port == 0) {
-                nf_ct_helper_log(skb, exp->master, "all ports in use");
+                nf_ct_helper_log(skb, ct, "all ports in use");
                return NF_DROP;
        }
-        ret = nf_nat_mangle_tcp_packet(skb, exp->master, ctinfo,
+        /* strlen("\1DCC CHAT chat AAAAAAAA P\1\n")=27
-                                       protoff, matchoff, matchlen, buffer,
+         * strlen("\1DCC SCHAT chat AAAAAAAA P\1\n")=28
-                                       strlen(buffer));
+         * strlen("\1DCC SEND F AAAAAAAA P S\1\n")=26
+         * strlen("\1DCC MOVE F AAAAAAAA P S\1\n")=26
+         * strlen("\1DCC TSEND F AAAAAAAA P S\1\n")=27
+         *
+         * AAAAAAAAA: bound addr (1.0.0.0==16777216, min 8 digits,
+         *                        255.255.255.255==4294967296, 10 digits)
+         * P:         bound port (min 1 d, max 5d (65635))
+         * F:         filename   (min 1 d )
+         * S:         size       (min 1 d )
+         * 0x01, \n:  terminators
+         */
+        /* AAA = "us", ie. where server normally talks to. */
+        snprintf(buffer, sizeof(buffer), "%u %u", ntohl(newaddr.ip), port);
+        pr_debug("nf_nat_irc: inserting '%s' == %pI4, port %u\n",
+                 buffer, &newaddr.ip, port);
+        ret = nf_nat_mangle_tcp_packet(skb, ct, ctinfo, protoff, matchoff,
+                                       matchlen, buffer, strlen(buffer));
        if (ret != NF_ACCEPT) {
-                nf_ct_helper_log(skb, exp->master, "cannot mangle packet");
+                nf_ct_helper_log(skb, ct, "cannot mangle packet");
                nf_ct_unexpect_related(exp);
        }
        return ret;
 }
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index f93b7d06f4be..71a9f49a768b 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -312,6 +312,9 @@ static int nf_tables_table_enable(struct nft_table *table)
        int err, i = 0;
        list_for_each_entry(chain, &table->chains, list) {
+                if (!(chain->flags & NFT_BASE_CHAIN))
+                        continue;
                err = nf_register_hook(&nft_base_chain(chain)->ops);
                if (err < 0)
                        goto err;
@@ -321,6 +324,9 @@ static int nf_tables_table_enable(struct nft_table *table)
        return 0;
 err:
        list_for_each_entry(chain, &table->chains, list) {
+                if (!(chain->flags & NFT_BASE_CHAIN))
+                        continue;
                if (i-- <= 0)
                        break;
@@ -333,8 +339,10 @@ static int nf_tables_table_disable(struct nft_table *table)
 {
        struct nft_chain *chain;
-        list_for_each_entry(chain, &table->chains, list)
+        list_for_each_entry(chain, &table->chains, list) {
-                nf_unregister_hook(&nft_base_chain(chain)->ops);
+                if (chain->flags & NFT_BASE_CHAIN)
+                        nf_unregister_hook(&nft_base_chain(chain)->ops);
+        }
        return 0;
 }
@@ -2098,17 +2106,21 @@ static int nf_tables_dump_sets_all(struct nft_ctx *ctx, struct sk_buff *skb,
                                   struct netlink_callback *cb)
 {
        const struct nft_set *set;
-        unsigned int idx = 0, s_idx = cb->args[0];
+        unsigned int idx, s_idx = cb->args[0];
        struct nft_table *table, *cur_table = (struct nft_table *)cb->args[2];
        if (cb->args[1])
                return skb->len;
        list_for_each_entry(table, &ctx->afi->tables, list) {
-                if (cur_table && cur_table != table)
+                if (cur_table) {
-                        continue;
+                        if (cur_table != table)
+                                continue;
+                        cur_table = NULL;
+                }
                ctx->table = table;
+                idx = 0;
                list_for_each_entry(set, &ctx->table->sets, list) {
                        if (idx < s_idx)
                                goto cont;
@@ -2370,7 +2382,9 @@ static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx,
        enum nft_registers dreg;
        dreg = nft_type_to_reg(set->dtype);
-        return nft_validate_data_load(ctx, dreg, &elem->data, set->dtype);
+        return nft_validate_data_load(ctx, dreg, &elem->data,
+                                      set->dtype == NFT_DATA_VERDICT ?
+                                      NFT_DATA_VERDICT : NFT_DATA_VALUE);
 }
 int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set,
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 3c4b69e5fe17..a155d19a225e 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -1053,6 +1053,7 @@ static void __net_exit nfnl_log_net_exit(struct net *net)
 #ifdef CONFIG_PROC_FS
        remove_proc_entry("nfnetlink_log", net->nf.proc_netfilter);
 #endif
+        nf_log_unset(net, &nfulnl_logger);
 }
 static struct pernet_operations nfnl_log_net_ops = {
diff --git a/net/netfilter/nft_exthdr.c b/net/netfilter/nft_exthdr.c
index 8e0bb75e7c51..55c939f5371f 100644
--- a/net/netfilter/nft_exthdr.c
+++ b/net/netfilter/nft_exthdr.c
@@ -31,7 +31,7 @@ static void nft_exthdr_eval(const struct nft_expr *expr,
 {
        struct nft_exthdr *priv = nft_expr_priv(expr);
        struct nft_data *dest = &data[priv->dreg];
-        unsigned int offset;
+        unsigned int offset = 0;
        int err;
        err = ipv6_find_hdr(pkt->skb, &offset, priv->type, NULL, NULL);
diff --git a/net/nfc/core.c b/net/nfc/core.c
index 872529105abc..83b9927e7d19 100644
--- a/net/nfc/core.c
+++ b/net/nfc/core.c
@@ -384,7 +384,7 @@ int nfc_dep_link_is_up(struct nfc_dev *dev, u32 target_idx,
 {
        dev->dep_link_up = true;
-        if (!dev->active_target) {
+        if (!dev->active_target && rf_mode == NFC_RF_INITIATOR) {
                struct nfc_target *target;
                target = nfc_find_target(dev, target_idx);
diff --git a/net/rds/ib.c b/net/rds/ib.c
index b4c8b0022fee..ba2dffeff608 100644
--- a/net/rds/ib.c
+++ b/net/rds/ib.c
@@ -338,7 +338,8 @@ static int rds_ib_laddr_check(__be32 addr)
        ret = rdma_bind_addr(cm_id, (struct sockaddr *)&sin);
        /* due to this, we will claim to support iWARP devices unless we
           check node_type. */
-        if (ret || cm_id->device->node_type != RDMA_NODE_IB_CA)
+        if (ret || !cm_id->device ||
+            cm_id->device->node_type != RDMA_NODE_IB_CA)
                ret = -EADDRNOTAVAIL;
        rdsdebug("addr %pI4 ret %d node type %d\n",
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index 8eb9501e3d60..b7ebe23cdedf 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -421,8 +421,7 @@ static void rds_ib_recv_cache_put(struct list_head *new_item,
                                 struct rds_ib_refill_cache *cache)
 {
        unsigned long flags;
-        struct list_head *old;
+        struct list_head *old, *chpfirst;
-        struct list_head __percpu *chpfirst;
        local_irq_save(flags);
@@ -432,7 +431,7 @@ static void rds_ib_recv_cache_put(struct list_head *new_item,
        else /* put on front */
                list_add_tail(new_item, chpfirst);
-        __this_cpu_write(chpfirst, new_item);
+        __this_cpu_write(cache->percpu->first, new_item);
        __this_cpu_inc(cache->percpu->count);
        if (__this_cpu_read(cache->percpu->count) < RDS_IB_RECYCLE_BATCH_COUNT)
@@ -452,7 +451,7 @@ static void rds_ib_recv_cache_put(struct list_head *new_item,
        } while (old);
-        __this_cpu_write(chpfirst, NULL);
+        __this_cpu_write(cache->percpu->first, NULL);
        __this_cpu_write(cache->percpu->count, 0);
 end:
        local_irq_restore(flags);
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 33af77246bfe..62ced6516c58 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1253,6 +1253,7 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
        if (msg->msg_name) {
                struct sockaddr_rose *srose;
+                struct full_sockaddr_rose *full_srose = msg->msg_name;
                memset(msg->msg_name, 0, sizeof(struct full_sockaddr_rose));
                srose = msg->msg_name;
@@ -1260,18 +1261,9 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
                srose->srose_addr   = rose->dest_addr;
                srose->srose_call   = rose->dest_call;
                srose->srose_ndigis = rose->dest_ndigis;
-                if (msg->msg_namelen >= sizeof(struct full_sockaddr_rose)) {
+                for (n = 0 ; n < rose->dest_ndigis ; n++)
-                        struct full_sockaddr_rose *full_srose = (struct full_sockaddr_rose *)msg->msg_name;
+                        full_srose->srose_digis[n] = rose->dest_digis[n];
-                        for (n = 0 ; n < rose->dest_ndigis ; n++)
+                msg->msg_namelen = sizeof(struct full_sockaddr_rose);
-                                full_srose->srose_digis[n] = rose->dest_digis[n];
-                        msg->msg_namelen = sizeof(struct full_sockaddr_rose);
-                } else {
-                        if (rose->dest_ndigis >= 1) {
-                                srose->srose_ndigis = 1;
-                                srose->srose_digi = rose->dest_digis[0];
-                        }
-                        msg->msg_namelen = sizeof(struct sockaddr_rose);
-                }
        }
        skb_free_datagram(sk, skb);
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 5c5edf56adbd..11fe1a416433 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -77,16 +77,16 @@ static int tcf_csum_init(struct net *n, struct nlattr *nla, struct nlattr *est,
                                     &csum_idx_gen, &csum_hash_info);
                if (IS_ERR(pc))
                        return PTR_ERR(pc);
-                p = to_tcf_csum(pc);
                ret = ACT_P_CREATED;
        } else {
-                p = to_tcf_csum(pc);
+                if (bind)/* dont override defaults */
-                if (!ovr) {
+                        return 0;
-                        tcf_hash_release(pc, bind, &csum_hash_info);
+                tcf_hash_release(pc, bind, &csum_hash_info);
+                if (!ovr)
                        return -EEXIST;
-                }
        }
+        p = to_tcf_csum(pc);
        spin_lock_bh(&p->tcf_lock);
        p->tcf_action = parm->action;
        p->update_flags = parm->update_flags;
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index 5645a4d32abd..eb9ba60ebab4 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -102,10 +102,11 @@ static int tcf_gact_init(struct net *net, struct nlattr *nla,
                        return PTR_ERR(pc);
                ret = ACT_P_CREATED;
        } else {
-                if (!ovr) {
+                if (bind)/* dont override defaults */
-                        tcf_hash_release(pc, bind, &gact_hash_info);
+                        return 0;
+                tcf_hash_release(pc, bind, &gact_hash_info);
+                if (!ovr)
                        return -EEXIST;
-                }
        }
        gact = to_gact(pc);
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 882a89762f77..dcbfe8ce04a6 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -141,10 +141,12 @@ static int tcf_ipt_init(struct net *net, struct nlattr *nla, struct nlattr *est,
                        return PTR_ERR(pc);
                ret = ACT_P_CREATED;
        } else {
-                if (!ovr) {
+                if (bind)/* dont override defaults */
-                        tcf_ipt_release(to_ipt(pc), bind);
+                        return 0;
+                tcf_ipt_release(to_ipt(pc), bind);
+                if (!ovr)
                        return -EEXIST;
-                }
        }
        ipt = to_ipt(pc);
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 6a15ace00241..76869538d028 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -70,15 +70,15 @@ static int tcf_nat_init(struct net *net, struct nlattr *nla, struct nlattr *est,
                                     &nat_idx_gen, &nat_hash_info);
                if (IS_ERR(pc))
                        return PTR_ERR(pc);
-                p = to_tcf_nat(pc);
                ret = ACT_P_CREATED;
        } else {
-                p = to_tcf_nat(pc);
+                if (bind)
-                if (!ovr) {
+                        return 0;
-                        tcf_hash_release(pc, bind, &nat_hash_info);
+                tcf_hash_release(pc, bind, &nat_hash_info);
+                if (!ovr)
                        return -EEXIST;
-                }
        }
+        p = to_tcf_nat(pc);
        spin_lock_bh(&p->tcf_lock);
        p->old_addr = parm->old_addr;
diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c
index 03b67674169c..7aa2dcd989f8 100644
--- a/net/sched/act_pedit.c
+++ b/net/sched/act_pedit.c
@@ -84,10 +84,12 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla,
                ret = ACT_P_CREATED;
        } else {
                p = to_pedit(pc);
-                if (!ovr) {
+                tcf_hash_release(pc, bind, &pedit_hash_info);
-                        tcf_hash_release(pc, bind, &pedit_hash_info);
+                if (bind)
+                        return 0;
+                if (!ovr)
                        return -EEXIST;
-                }
                if (p->tcfp_nkeys && p->tcfp_nkeys != parm->nkeys) {
                        keys = kmalloc(ksize, GFP_KERNEL);
                        if (keys == NULL)
diff --git a/net/sched/act_police.c b/net/sched/act_police.c
index 16a62c36928a..ef246d87e68b 100644
--- a/net/sched/act_police.c
+++ b/net/sched/act_police.c
@@ -177,10 +177,12 @@ static int tcf_act_police_locate(struct net *net, struct nlattr *nla,
                        if (bind) {
                                police->tcf_bindcnt += 1;
                                police->tcf_refcnt += 1;
+                                return 0;
                        }
                        if (ovr)
                                goto override;
-                        return ret;
+                        /* not replacing */
+                        return -EEXIST;
                }
        }
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 31157d3e729c..f7b45ab85388 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -142,10 +142,13 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla,
                ret = ACT_P_CREATED;
        } else {
                d = to_defact(pc);
-                if (!ovr) {
-                        tcf_simp_release(d, bind);
+                if (bind)
+                        return 0;
+                tcf_simp_release(d, bind);
+                if (!ovr)
                        return -EEXIST;
-                }
                reset_policy(d, defdata, parm);
        }
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index 35ea643b4325..8fe9d25c3008 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -120,10 +120,11 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla,
                ret = ACT_P_CREATED;
        } else {
                d = to_skbedit(pc);
-                if (!ovr) {
+                if (bind)
-                        tcf_hash_release(pc, bind, &skbedit_hash_info);
+                        return 0;
+                tcf_hash_release(pc, bind, &skbedit_hash_info);
+                if (!ovr)
                        return -EEXIST;
-                }
        }
        spin_lock_bh(&d->tcf_lock);
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 922a09406ba7..7fc899a943a8 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -126,7 +126,7 @@ int sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
        HARD_TX_LOCK(dev, txq, smp_processor_id());
        if (!netif_xmit_frozen_or_stopped(txq))
-                ret = dev_hard_start_xmit(skb, dev, txq, NULL);
+                ret = dev_hard_start_xmit(skb, dev, txq);
        HARD_TX_UNLOCK(dev, txq);
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index f51ba985a36e..59268f6e2c36 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -208,8 +208,6 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
        INIT_LIST_HEAD(&q->retransmit);
        INIT_LIST_HEAD(&q->sacked);
        INIT_LIST_HEAD(&q->abandoned);
-        q->empty = 1;
 }
 /* Free the outqueue structure and any related pending chunks.
@@ -332,7 +330,6 @@ int sctp_outq_tail(struct sctp_outq *q, struct sctp_chunk *chunk)
                                SCTP_INC_STATS(net, SCTP_MIB_OUTUNORDERCHUNKS);
                        else
                                SCTP_INC_STATS(net, SCTP_MIB_OUTORDERCHUNKS);
-                        q->empty = 0;
                        break;
                }
        } else {
@@ -654,7 +651,6 @@ redo:
                        if (chunk->fast_retransmit == SCTP_NEED_FRTX)
                                chunk->fast_retransmit = SCTP_DONT_FRTX;
-                        q->empty = 0;
                        q->asoc->stats.rtxchunks++;
                        break;
                }
@@ -1065,8 +1061,6 @@ static int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
                        sctp_transport_reset_timers(transport);
-                        q->empty = 0;
                        /* Only let one DATA chunk get bundled with a
                         * COOKIE-ECHO chunk.
                         */
@@ -1275,29 +1269,17 @@ int sctp_outq_sack(struct sctp_outq *q, struct sctp_chunk *chunk)
                 "advertised peer ack point:0x%x\n", __func__, asoc, ctsn,
                 asoc->adv_peer_ack_point);
-        /* See if all chunks are acked.
+        return sctp_outq_is_empty(q);
-         * Make sure the empty queue handler will get run later.
-         */
-        q->empty = (list_empty(&q->out_chunk_list) &&
-                    list_empty(&q->retransmit));
-        if (!q->empty)
-                goto finish;
-        list_for_each_entry(transport, transport_list, transports) {
-                q->empty = q->empty && list_empty(&transport->transmitted);
-                if (!q->empty)
-                        goto finish;
-        }
-        pr_debug("%s: sack queue is empty\n", __func__);
-finish:
-        return q->empty;
 }
-/* Is the outqueue empty?  */
+/* Is the outqueue empty?
+ * The queue is empty when we have not pending data, no in-flight data
+ * and nothing pending retransmissions.
+ */
 int sctp_outq_is_empty(const struct sctp_outq *q)
 {
-        return q->empty;
+        return q->out_qlen == 0 && q->outstanding_bytes == 0 &&
+               list_empty(&q->retransmit);
 }
 /********************************************************************
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 69cd9bf3f561..13b987745820 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1498,6 +1498,7 @@ void tipc_recv_msg(struct sk_buff *head, struct tipc_bearer *b_ptr)
                int type;
                head = head->next;
+                buf->next = NULL;
                /* Ensure bearer is still enabled */
                if (unlikely(!b_ptr->active))
diff --git a/net/tipc/port.c b/net/tipc/port.c
index c081a7632302..d43f3182b1d4 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -251,18 +251,15 @@ struct tipc_port *tipc_createport(struct sock *sk,
        return p_ptr;
 }
-int tipc_deleteport(u32 ref)
+int tipc_deleteport(struct tipc_port *p_ptr)
 {
-        struct tipc_port *p_ptr;
        struct sk_buff *buf = NULL;
-        tipc_withdraw(ref, 0, NULL);
+        tipc_withdraw(p_ptr, 0, NULL);
-        p_ptr = tipc_port_lock(ref);
-        if (!p_ptr)
-                return -EINVAL;
-        tipc_ref_discard(ref);
+        spin_lock_bh(p_ptr->lock);
-        tipc_port_unlock(p_ptr);
+        tipc_ref_discard(p_ptr->ref);
+        spin_unlock_bh(p_ptr->lock);
        k_cancel_timer(&p_ptr->timer);
        if (p_ptr->connected) {
@@ -704,47 +701,36 @@ int tipc_set_portimportance(u32 ref, unsigned int imp)
 }
-int tipc_publish(u32 ref, unsigned int scope, struct tipc_name_seq const *seq)
+int tipc_publish(struct tipc_port *p_ptr, unsigned int scope,
+                 struct tipc_name_seq const *seq)
 {
-        struct tipc_port *p_ptr;
        struct publication *publ;
        u32 key;
-        int res = -EINVAL;
-        p_ptr = tipc_port_lock(ref);
+        if (p_ptr->connected)
-        if (!p_ptr)
                return -EINVAL;
+        key = p_ptr->ref + p_ptr->pub_count + 1;
+        if (key == p_ptr->ref)
+                return -EADDRINUSE;
-        if (p_ptr->connected)
-                goto exit;
-        key = ref + p_ptr->pub_count + 1;
-        if (key == ref) {
-                res = -EADDRINUSE;
-                goto exit;
-        }
        publ = tipc_nametbl_publish(seq->type, seq->lower, seq->upper,
                                    scope, p_ptr->ref, key);
        if (publ) {
                list_add(&publ->pport_list, &p_ptr->publications);
                p_ptr->pub_count++;
                p_ptr->published = 1;
-                res = 0;
+                return 0;
        }
-exit:
+        return -EINVAL;
-        tipc_port_unlock(p_ptr);
-        return res;
 }
-int tipc_withdraw(u32 ref, unsigned int scope, struct tipc_name_seq const *seq)
+int tipc_withdraw(struct tipc_port *p_ptr, unsigned int scope,
+                  struct tipc_name_seq const *seq)
 {
-        struct tipc_port *p_ptr;
        struct publication *publ;
        struct publication *tpubl;
        int res = -EINVAL;
-        p_ptr = tipc_port_lock(ref);
-        if (!p_ptr)
-                return -EINVAL;
        if (!seq) {
                list_for_each_entry_safe(publ, tpubl,
                                         &p_ptr->publications, pport_list) {
@@ -771,7 +757,6 @@ int tipc_withdraw(u32 ref, unsigned int scope, struct tipc_name_seq const *seq)
        }
        if (list_empty(&p_ptr->publications))
                p_ptr->published = 0;
-        tipc_port_unlock(p_ptr);
        return res;
 }
diff --git a/net/tipc/port.h b/net/tipc/port.h
index 912253597343..34f12bd4074e 100644
--- a/net/tipc/port.h
+++ b/net/tipc/port.h
@@ -116,7 +116,7 @@ int tipc_reject_msg(struct sk_buff *buf, u32 err);
 void tipc_acknowledge(u32 port_ref, u32 ack);
-int tipc_deleteport(u32 portref);
+int tipc_deleteport(struct tipc_port *p_ptr);
 int tipc_portimportance(u32 portref, unsigned int *importance);
 int tipc_set_portimportance(u32 portref, unsigned int importance);
@@ -127,9 +127,9 @@ int tipc_set_portunreliable(u32 portref, unsigned int isunreliable);
 int tipc_portunreturnable(u32 portref, unsigned int *isunreturnable);
 int tipc_set_portunreturnable(u32 portref, unsigned int isunreturnable);
-int tipc_publish(u32 portref, unsigned int scope,
+int tipc_publish(struct tipc_port *p_ptr, unsigned int scope,
                 struct tipc_name_seq const *name_seq);
-int tipc_withdraw(u32 portref, unsigned int scope,
+int tipc_withdraw(struct tipc_port *p_ptr, unsigned int scope,
                  struct tipc_name_seq const *name_seq);
 int tipc_connect(u32 portref, struct tipc_portid const *port);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 3b61851bb927..e741416d1d24 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -354,7 +354,7 @@ static int release(struct socket *sock)
         * Delete TIPC port; this ensures no more messages are queued
         * (also disconnects an active connection & sends a 'FIN-' to peer)
         */
-        res = tipc_deleteport(tport->ref);
+        res = tipc_deleteport(tport);
        /* Discard any remaining (connection-based) messages in receive queue */
        __skb_queue_purge(&sk->sk_receive_queue);
@@ -386,30 +386,46 @@ static int release(struct socket *sock)
 */
 static int bind(struct socket *sock, struct sockaddr *uaddr, int uaddr_len)
 {
+        struct sock *sk = sock->sk;
        struct sockaddr_tipc *addr = (struct sockaddr_tipc *)uaddr;
-        u32 portref = tipc_sk_port(sock->sk)->ref;
+        struct tipc_port *tport = tipc_sk_port(sock->sk);
+        int res = -EINVAL;
-        if (unlikely(!uaddr_len))
+        lock_sock(sk);
-                return tipc_withdraw(portref, 0, NULL);
+        if (unlikely(!uaddr_len)) {
+                res = tipc_withdraw(tport, 0, NULL);
+                goto exit;
+        }
-        if (uaddr_len < sizeof(struct sockaddr_tipc))
+        if (uaddr_len < sizeof(struct sockaddr_tipc)) {
-                return -EINVAL;
+                res = -EINVAL;
-        if (addr->family != AF_TIPC)
+                goto exit;
-                return -EAFNOSUPPORT;
+        }
+        if (addr->family != AF_TIPC) {
+                res = -EAFNOSUPPORT;
+                goto exit;
+        }
        if (addr->addrtype == TIPC_ADDR_NAME)
                addr->addr.nameseq.upper = addr->addr.nameseq.lower;
-        else if (addr->addrtype != TIPC_ADDR_NAMESEQ)
+        else if (addr->addrtype != TIPC_ADDR_NAMESEQ) {
-                return -EAFNOSUPPORT;
+                res = -EAFNOSUPPORT;
+                goto exit;
+        }
        if ((addr->addr.nameseq.type < TIPC_RESERVED_TYPES) &&
            (addr->addr.nameseq.type != TIPC_TOP_SRV) &&
-            (addr->addr.nameseq.type != TIPC_CFG_SRV))
+            (addr->addr.nameseq.type != TIPC_CFG_SRV)) {
-                return -EACCES;
+                res = -EACCES;
+                goto exit;
+        }
-        return (addr->scope > 0) ?
+        res = (addr->scope > 0) ?
-                tipc_publish(portref, addr->scope, &addr->addr.nameseq) :
+                tipc_publish(tport, addr->scope, &addr->addr.nameseq) :
-                tipc_withdraw(portref, -addr->scope, &addr->addr.nameseq);
+                tipc_withdraw(tport, -addr->scope, &addr->addr.nameseq);
+exit:
+        release_sock(sk);
+        return res;
 }
 /**
diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
index a271c27fac77..722da616438c 100644
--- a/net/wireless/radiotap.c
+++ b/net/wireless/radiotap.c
@@ -124,6 +124,10 @@ int ieee80211_radiotap_iterator_init(
        /* find payload start allowing for extended bitmap(s) */
        if (iterator->_bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT)) {
+                if ((unsigned long)iterator->_arg -
+                    (unsigned long)iterator->_rtheader + sizeof(uint32_t) >
+                    (unsigned long)iterator->_max_length)
+                        return -EINVAL;
                while (get_unaligned_le32(iterator->_arg) &
                                        (1 << IEEE80211_RADIOTAP_EXT)) {
                        iterator->_arg += sizeof(uint32_t);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 65f800890d70..d3c5bd7c6b51 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -632,6 +632,16 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
        }
 #endif
+        if (!bss && (status == WLAN_STATUS_SUCCESS)) {
+                WARN_ON_ONCE(!wiphy_to_dev(wdev->wiphy)->ops->connect);
+                bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
+                                       wdev->ssid, wdev->ssid_len,
+                                       WLAN_CAPABILITY_ESS,
+                                       WLAN_CAPABILITY_ESS);
+                if (bss)
+                        cfg80211_hold_bss(bss_from_pub(bss));
+        }
        if (wdev->current_bss) {
                cfg80211_unhold_bss(wdev->current_bss);
                cfg80211_put_bss(wdev->wiphy, &wdev->current_bss->pub);
@@ -649,16 +659,8 @@ void __cfg80211_connect_result(struct net_device *dev, const u8 *bssid,
                return;
        }
-        if (!bss) {
+        if (WARN_ON(!bss))
-                WARN_ON_ONCE(!wiphy_to_dev(wdev->wiphy)->ops->connect);
+                return;
-                bss = cfg80211_get_bss(wdev->wiphy, NULL, bssid,
-                                       wdev->ssid, wdev->ssid_len,
-                                       WLAN_CAPABILITY_ESS,
-                                       WLAN_CAPABILITY_ESS);
-                if (WARN_ON(!bss))
-                        return;
-                cfg80211_hold_bss(bss_from_pub(bss));
-        }
        wdev->current_bss = bss_from_pub(bss);
diff --git a/scripts/gcc-goto.sh b/scripts/gcc-goto.sh
index a2af2e88daf3..c9469d34ecc6 100644
--- a/scripts/gcc-goto.sh
+++ b/scripts/gcc-goto.sh
@@ -5,7 +5,7 @@
 cat << "END" | $@ -x c - -c -o /dev/null >/dev/null 2>&1 && echo "y"
 int main(void)
 {
-#ifdef __arm__
+#if defined(__arm__) || defined(__aarch64__)
        /*
         * Not related to asm goto, but used by jump label
         * and broken on some ARM GCC versions (see GCC Bug 48637).
diff --git a/scripts/kconfig/streamline_config.pl b/scripts/kconfig/streamline_config.pl
index 4606cdfb859d..31331723e810 100644
--- a/scripts/kconfig/streamline_config.pl
+++ b/scripts/kconfig/streamline_config.pl
@@ -219,6 +219,13 @@ sub read_kconfig {
            $depends{$config} = $1;
        } elsif ($state eq "DEP" && /^\s*depends\s+on\s+(.*)$/) {
            $depends{$config} .= " " . $1;
+        } elsif ($state eq "DEP" && /^\s*def(_(bool|tristate)|ault)\s+(\S.*)$/) {
+            my $dep = $3;
+            if ($dep !~ /^\s*(y|m|n)\s*$/) {
+                $dep =~ s/.*\sif\s+//;
+                $depends{$config} .= " " . $dep;
+                dprint "Added default depends $dep to $config\n";
+            }
        # Get the configs that select this config
        } elsif ($state ne "NONE" && /^\s*select\s+(\S+)/) {
diff --git a/scripts/link-vmlinux.sh b/scripts/link-vmlinux.sh
index 32b10f53d0b4..2dcb37736d84 100644
--- a/scripts/link-vmlinux.sh
+++ b/scripts/link-vmlinux.sh
@@ -82,7 +82,9 @@ kallsyms()
                kallsymopt="${kallsymopt} --all-symbols"
        fi
-        kallsymopt="${kallsymopt} --page-offset=$CONFIG_PAGE_OFFSET"
+        if [ -n "${CONFIG_ARM}" ] && [ -n "${CONFIG_PAGE_OFFSET}" ]; then
+                kallsymopt="${kallsymopt} --page-offset=$CONFIG_PAGE_OFFSET"
+        fi
        local aflags="${KBUILD_AFLAGS} ${KBUILD_AFLAGS_KERNEL}               \
                      ${NOSTDINC_FLAGS} ${LINUXINCLUDE} ${KBUILD_CPPFLAGS}"
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 419491d8e7d2..57b0b49f4e6e 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -234,6 +234,14 @@ static int inode_alloc_security(struct inode *inode)
        return 0;
 }
+static void inode_free_rcu(struct rcu_head *head)
+{
+        struct inode_security_struct *isec;
+        isec = container_of(head, struct inode_security_struct, rcu);
+        kmem_cache_free(sel_inode_cache, isec);
+}
 static void inode_free_security(struct inode *inode)
 {
        struct inode_security_struct *isec = inode->i_security;
@@ -244,8 +252,16 @@ static void inode_free_security(struct inode *inode)
                list_del_init(&isec->list);
        spin_unlock(&sbsec->isec_lock);
-        inode->i_security = NULL;
+        /*
-        kmem_cache_free(sel_inode_cache, isec);
+         * The inode may still be referenced in a path walk and
+         * a call to selinux_inode_permission() can be made
+         * after inode_free_security() is called. Ideally, the VFS
+         * wouldn't do this, but fixing that is a much harder
+         * job. For now, simply free the i_security via RCU, and
+         * leave the current inode->i_security pointer intact.
+         * The inode will be freed after the RCU grace period too.
+         */
+        call_rcu(&isec->rcu, inode_free_rcu);
 }
 static int file_alloc_security(struct file *file)
@@ -4334,8 +4350,10 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
                }
                err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
                                   PEER__RECV, &ad);
-                if (err)
+                if (err) {
                        selinux_netlbl_err(skb, err, 0);
+                        return err;
+                }
        }
        if (secmark_active) {
@@ -5586,11 +5604,11 @@ static int selinux_setprocattr(struct task_struct *p,
                /* Check for ptracing, and update the task SID if ok.
                   Otherwise, leave SID unchanged and fail. */
                ptsid = 0;
-                task_lock(p);
+                rcu_read_lock();
                tracer = ptrace_parent(p);
                if (tracer)
                        ptsid = task_sid(tracer);
-                task_unlock(p);
+                rcu_read_unlock();
                if (tracer) {
                        error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index b1dfe1049450..078e553f52f2 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -38,7 +38,10 @@ struct task_security_struct {
 struct inode_security_struct {
        struct inode *inode;    /* back pointer to inode object */
-        struct list_head list;  /* list of inode_security_struct */
+        union {
+                struct list_head list;  /* list of inode_security_struct */
+                struct rcu_head rcu;    /* for freeing the inode_security_struct */
+        };
        u32 task_sid;           /* SID of creating task */
        u32 sid;                /* SID of this object */
        u16 sclass;             /* security class of this object */
diff --git a/tools/Makefile b/tools/Makefile
index a9b02008443c..927cd46d36dc 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -39,10 +39,10 @@ cpupower: FORCE
 cgroup firewire guest usb virtio vm net: FORCE
        $(call descend,$@)
-liblk: FORCE
+libapikfs: FORCE
-        $(call descend,lib/lk)
+        $(call descend,lib/api)
-perf: liblk FORCE
+perf: libapikfs FORCE
        $(call descend,$@)
 selftests: FORCE
@@ -80,10 +80,10 @@ cpupower_clean:
 cgroup_clean firewire_clean lguest_clean usb_clean virtio_clean vm_clean net_clean:
        $(call descend,$(@:_clean=),clean)
-liblk_clean:
+libapikfs_clean:
-        $(call descend,lib/lk,clean)
+        $(call descend,lib/api,clean)
-perf_clean: liblk_clean
+perf_clean: libapikfs_clean
        $(call descend,$(@:_clean=),clean)
 selftests_clean:
diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c
index b8d6d541d854..4088b816a3ee 100644
--- a/tools/hv/hv_kvp_daemon.c
+++ b/tools/hv/hv_kvp_daemon.c
@@ -26,7 +26,6 @@
 #include <sys/socket.h>
 #include <sys/poll.h>
 #include <sys/utsname.h>
-#include <linux/types.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <unistd.h>
diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c
index 8bcb04096eb2..520de3304571 100644
--- a/tools/hv/hv_vss_daemon.c
+++ b/tools/hv/hv_vss_daemon.c
@@ -22,7 +22,6 @@
 #include <sys/socket.h>
 #include <sys/poll.h>
 #include <sys/ioctl.h>
-#include <linux/types.h>
 #include <fcntl.h>
 #include <stdio.h>
 #include <mntent.h>
diff --git a/tools/perf/util/include/asm/bug.h b/tools/include/asm/bug.h
index 7fcc6810adc2..9e5f4846967f 100644
--- a/tools/perf/util/include/asm/bug.h
+++ b/tools/include/asm/bug.h
@@ -1,5 +1,7 @@
-#ifndef _PERF_ASM_GENERIC_BUG_H
+#ifndef _TOOLS_ASM_BUG_H
-#define _PERF_ASM_GENERIC_BUG_H
+#define _TOOLS_ASM_BUG_H
+#include <linux/compiler.h>
 #define __WARN_printf(arg...)   do { fprintf(stderr, arg); } while (0)
@@ -19,4 +21,5 @@
                        __warned = 1;           \
        unlikely(__ret_warn_once);              \
 })
-#endif
+#endif /* _TOOLS_ASM_BUG_H */
diff --git a/tools/perf/util/include/linux/compiler.h b/tools/include/linux/compiler.h
index b003ad7200b2..fbc6665c6d53 100644
--- a/tools/perf/util/include/linux/compiler.h
+++ b/tools/include/linux/compiler.h
@@ -1,5 +1,5 @@
-#ifndef _PERF_LINUX_COMPILER_H_
+#ifndef _TOOLS_LINUX_COMPILER_H_
-#define _PERF_LINUX_COMPILER_H_
+#define _TOOLS_LINUX_COMPILER_H_
 #ifndef __always_inline
 # define __always_inline        inline __attribute__((always_inline))
@@ -27,4 +27,12 @@
 # define __weak                 __attribute__((weak))
 #endif
+#ifndef likely
+# define likely(x)              __builtin_expect(!!(x), 1)
 #endif
+#ifndef unlikely
+# define unlikely(x)            __builtin_expect(!!(x), 0)
+#endif
+#endif /* _TOOLS_LINUX_COMPILER_H */
diff --git a/tools/lib/lk/Makefile b/tools/lib/api/Makefile
index 3dba0a4aebbf..ed2f51e11b80 100644
--- a/tools/lib/lk/Makefile
+++ b/tools/lib/api/Makefile
@@ -1,4 +1,5 @@
 include ../../scripts/Makefile.include
+include ../../perf/config/utilities.mak         # QUIET_CLEAN
 CC = $(CROSS_COMPILE)gcc
 AR = $(CROSS_COMPILE)ar
@@ -7,11 +8,11 @@ AR = $(CROSS_COMPILE)ar
 LIB_H=
 LIB_OBJS=
-LIB_H += debugfs.h
+LIB_H += fs/debugfs.h
-LIB_OBJS += $(OUTPUT)debugfs.o
+LIB_OBJS += $(OUTPUT)fs/debugfs.o
-LIBFILE = liblk.a
+LIBFILE = libapikfs.a
 CFLAGS = -ggdb3 -Wall -Wextra -std=gnu99 -Werror -O6 -D_FORTIFY_SOURCE=2 $(EXTRA_WARNINGS) $(EXTRA_CFLAGS) -fPIC
 EXTLIBS = -lelf -lpthread -lrt -lm
@@ -25,14 +26,17 @@ $(LIBFILE): $(LIB_OBJS)
 $(LIB_OBJS): $(LIB_H)
-$(OUTPUT)%.o: %.c
+libapi_dirs:
+        $(QUIET_MKDIR)mkdir -p $(OUTPUT)fs/
+$(OUTPUT)%.o: %.c libapi_dirs
        $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $<
-$(OUTPUT)%.s: %.c
+$(OUTPUT)%.s: %.c libapi_dirs
        $(QUIET_CC)$(CC) -S $(ALL_CFLAGS) $<
-$(OUTPUT)%.o: %.S
+$(OUTPUT)%.o: %.S libapi_dirs
        $(QUIET_CC)$(CC) -o $@ -c $(ALL_CFLAGS) $<
 clean:
-        $(RM) $(LIB_OBJS) $(LIBFILE)
+        $(call QUIET_CLEAN, libapi) $(RM) $(LIB_OBJS) $(LIBFILE)
 .PHONY: clean
diff --git a/tools/lib/lk/debugfs.c b/tools/lib/api/fs/debugfs.c
index 7c4347962353..7c4347962353 100644
--- a/tools/lib/lk/debugfs.c
+++ b/tools/lib/api/fs/debugfs.c
diff --git a/tools/lib/lk/debugfs.h b/tools/lib/api/fs/debugfs.h
index 935c59bdb442..f19d3df9609d 100644
--- a/tools/lib/lk/debugfs.h
+++ b/tools/lib/api/fs/debugfs.h
@@ -1,5 +1,5 @@
-#ifndef __LK_DEBUGFS_H__
+#ifndef __API_DEBUGFS_H__
-#define __LK_DEBUGFS_H__
+#define __API_DEBUGFS_H__
 #define _STR(x) #x
 #define STR(x) _STR(x)
@@ -26,4 +26,4 @@ char *debugfs_mount(const char *mountpoint);
 extern char debugfs_mountpoint[];
-#endif /* __LK_DEBUGFS_H__ */
+#endif /* __API_DEBUGFS_H__ */
diff --git a/tools/lib/lockdep/Makefile b/tools/lib/lockdep/Makefile
new file mode 100644
index 000000000000..da8b7aa3d351
--- /dev/null
+++ b/tools/lib/lockdep/Makefile
@@ -0,0 +1,251 @@
+# liblockdep version
+LL_VERSION = 0
+LL_PATCHLEVEL = 0
+LL_EXTRAVERSION = 1
+# file format version
+FILE_VERSION = 1
+MAKEFLAGS += --no-print-directory
+# Makefiles suck: This macro sets a default value of $(2) for the
+# variable named by $(1), unless the variable has been set by
+# environment or command line. This is necessary for CC and AR
+# because make sets default values, so the simpler ?= approach
+# won't work as expected.
+define allow-override
+  $(if $(or $(findstring environment,$(origin $(1))),\
+            $(findstring command line,$(origin $(1)))),,\
+    $(eval $(1) = $(2)))
+endef
+# Allow setting CC and AR, or setting CROSS_COMPILE as a prefix.
+$(call allow-override,CC,$(CROSS_COMPILE)gcc)
+$(call allow-override,AR,$(CROSS_COMPILE)ar)
+INSTALL = install
+# Use DESTDIR for installing into a different root directory.
+# This is useful for building a package. The program will be
+# installed in this directory as if it was the root directory.
+# Then the build tool can move it later.
+DESTDIR ?=
+DESTDIR_SQ = '$(subst ','\'',$(DESTDIR))'
+prefix ?= /usr/local
+libdir_relative = lib
+libdir = $(prefix)/$(libdir_relative)
+bindir_relative = bin
+bindir = $(prefix)/$(bindir_relative)
+export DESTDIR DESTDIR_SQ INSTALL
+# copy a bit from Linux kbuild
+ifeq ("$(origin V)", "command line")
+  VERBOSE = $(V)
+endif
+ifndef VERBOSE
+  VERBOSE = 0
+endif
+ifeq ("$(origin O)", "command line")
+  BUILD_OUTPUT := $(O)
+endif
+ifeq ($(BUILD_SRC),)
+ifneq ($(BUILD_OUTPUT),)
+define build_output
+        $(if $(VERBOSE:1=),@)$(MAKE) -C $(BUILD_OUTPUT) \
+        BUILD_SRC=$(CURDIR) -f $(CURDIR)/Makefile $1
+endef
+saved-output := $(BUILD_OUTPUT)
+BUILD_OUTPUT := $(shell cd $(BUILD_OUTPUT) && /bin/pwd)
+$(if $(BUILD_OUTPUT),, \
+     $(error output directory "$(saved-output)" does not exist))
+all: sub-make
+gui: force
+        $(call build_output, all_cmd)
+$(filter-out gui,$(MAKECMDGOALS)): sub-make
+sub-make: force
+        $(call build_output, $(MAKECMDGOALS))
+# Leave processing to above invocation of make
+skip-makefile := 1
+endif # BUILD_OUTPUT
+endif # BUILD_SRC
+# We process the rest of the Makefile if this is the final invocation of make
+ifeq ($(skip-makefile),)
+srctree         := $(if $(BUILD_SRC),$(BUILD_SRC),$(CURDIR))
+objtree         := $(CURDIR)
+src             := $(srctree)
+obj             := $(objtree)
+export prefix libdir bindir src obj
+# Shell quotes
+libdir_SQ = $(subst ','\'',$(libdir))
+bindir_SQ = $(subst ','\'',$(bindir))
+LIB_FILE = liblockdep.a liblockdep.so
+BIN_FILE = lockdep
+CONFIG_INCLUDES =
+CONFIG_LIBS     =
+CONFIG_FLAGS    =
+OBJ             = $@
+N               =
+export Q VERBOSE
+LIBLOCKDEP_VERSION = $(LL_VERSION).$(LL_PATCHLEVEL).$(LL_EXTRAVERSION)
+INCLUDES = -I. -I/usr/local/include -I./uinclude $(CONFIG_INCLUDES)
+# Set compile option CFLAGS if not set elsewhere
+CFLAGS ?= -g -DCONFIG_LOCKDEP -DCONFIG_STACKTRACE -DCONFIG_PROVE_LOCKING -DBITS_PER_LONG=__WORDSIZE -DLIBLOCKDEP_VERSION='"$(LIBLOCKDEP_VERSION)"' -rdynamic -O0 -g
+override CFLAGS += $(CONFIG_FLAGS) $(INCLUDES) $(PLUGIN_DIR_SQ)
+ifeq ($(VERBOSE),1)
+  Q =
+  print_compile =
+  print_app_build =
+  print_fpic_compile =
+  print_shared_lib_compile =
+  print_install =
+else
+  Q = @
+  print_compile =               echo '  CC                 '$(OBJ);
+  print_app_build =             echo '  BUILD              '$(OBJ);
+  print_fpic_compile =          echo '  CC FPIC            '$(OBJ);
+  print_shared_lib_compile =    echo '  BUILD SHARED LIB   '$(OBJ);
+  print_static_lib_build =      echo '  BUILD STATIC LIB   '$(OBJ);
+  print_install =               echo '  INSTALL     '$1'        to      $(DESTDIR_SQ)$2';
+endif
+do_fpic_compile =                                       \
+        ($(print_fpic_compile)                          \
+        $(CC) -c $(CFLAGS) $(EXT) -fPIC $< -o $@)
+do_app_build =                                          \
+        ($(print_app_build)                             \
+        $(CC) $^ -rdynamic -o $@ $(CONFIG_LIBS) $(LIBS))
+do_compile_shared_library =                     \
+        ($(print_shared_lib_compile)            \
+        $(CC) --shared $^ -o $@ -lpthread -ldl)
+do_build_static_lib =                           \
+        ($(print_static_lib_build)              \
+        $(RM) $@;  $(AR) rcs $@ $^)
+define do_compile
+        $(print_compile)                                                \
+        $(CC) -c $(CFLAGS) $(EXT) $< -o $(obj)/$@;
+endef
+$(obj)/%.o: $(src)/%.c
+        $(Q)$(call do_compile)
+%.o: $(src)/%.c
+        $(Q)$(call do_compile)
+PEVENT_LIB_OBJS = common.o lockdep.o preload.o rbtree.o
+ALL_OBJS = $(PEVENT_LIB_OBJS)
+CMD_TARGETS = $(LIB_FILE)
+TARGETS = $(CMD_TARGETS)
+all: all_cmd
+all_cmd: $(CMD_TARGETS)
+liblockdep.so: $(PEVENT_LIB_OBJS)
+        $(Q)$(do_compile_shared_library)
+liblockdep.a: $(PEVENT_LIB_OBJS)
+        $(Q)$(do_build_static_lib)
+$(PEVENT_LIB_OBJS): %.o: $(src)/%.c
+        $(Q)$(do_fpic_compile)
+## make deps
+all_objs := $(sort $(ALL_OBJS))
+all_deps := $(all_objs:%.o=.%.d)
+# let .d file also depends on the source and header files
+define check_deps
+                @set -e; $(RM) $@; \
+                $(CC) -MM $(CFLAGS) $< > $@.$$$$; \
+                sed 's,\($*\)\.o[ :]*,\1.o $@ : ,g' < $@.$$$$ > $@; \
+                $(RM) $@.$$$$
+endef
+$(all_deps): .%.d: $(src)/%.c
+        $(Q)$(call check_deps)
+$(all_objs) : %.o : .%.d
+dep_includes := $(wildcard $(all_deps))
+ifneq ($(dep_includes),)
+ include $(dep_includes)
+endif
+### Detect environment changes
+TRACK_CFLAGS = $(subst ','\'',$(CFLAGS)):$(ARCH):$(CROSS_COMPILE)
+tags:   force
+        $(RM) tags
+        find . -name '*.[ch]' | xargs ctags --extra=+f --c-kinds=+px \
+        --regex-c++='/_PE\(([^,)]*).*/PEVENT_ERRNO__\1/'
+TAGS:   force
+        $(RM) TAGS
+        find . -name '*.[ch]' | xargs etags \
+        --regex='/_PE(\([^,)]*\).*/PEVENT_ERRNO__\1/'
+define do_install
+        $(print_install)                                \
+        if [ ! -d '$(DESTDIR_SQ)$2' ]; then             \
+                $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2'; \
+        fi;                                             \
+        $(INSTALL) $1 '$(DESTDIR_SQ)$2'
+endef
+install_lib: all_cmd
+        $(Q)$(call do_install,$(LIB_FILE),$(libdir_SQ))
+        $(Q)$(call do_install,$(BIN_FILE),$(bindir_SQ))
+install: install_lib
+clean:
+        $(RM) *.o *~ $(TARGETS) *.a *.so $(VERSION_FILES) .*.d
+        $(RM) tags TAGS
+endif # skip-makefile
+PHONY += force
+force:
+# Declare the contents of the .PHONY variable as phony.  We keep that
+# information in a variable so we can use it in if_changed and friends.
+.PHONY: $(PHONY)
diff --git a/tools/lib/lockdep/common.c b/tools/lib/lockdep/common.c
new file mode 100644
index 000000000000..8ef602f18a32
--- /dev/null
+++ b/tools/lib/lockdep/common.c
@@ -0,0 +1,33 @@
+#include <stddef.h>
+#include <stdbool.h>
+#include <linux/compiler.h>
+#include <linux/lockdep.h>
+#include <unistd.h>
+#include <sys/syscall.h>
+static __thread struct task_struct current_obj;
+/* lockdep wants these */
+bool debug_locks = true;
+bool debug_locks_silent;
+__attribute__((constructor)) static void liblockdep_init(void)
+{
+        lockdep_init();
+}
+__attribute__((destructor)) static void liblockdep_exit(void)
+{
+        debug_check_no_locks_held(&current_obj);
+}
+struct task_struct *__curr(void)
+{
+        if (current_obj.pid == 0) {
+                /* Makes lockdep output pretty */
+                prctl(PR_GET_NAME, current_obj.comm);
+                current_obj.pid = syscall(__NR_gettid);
+        }
+        return &current_obj;
+}
diff --git a/tools/lib/lockdep/include/liblockdep/common.h b/tools/lib/lockdep/include/liblockdep/common.h
new file mode 100644
index 000000000000..0bda630027c3
--- /dev/null
+++ b/tools/lib/lockdep/include/liblockdep/common.h
@@ -0,0 +1,50 @@
+#ifndef _LIBLOCKDEP_COMMON_H
+#define _LIBLOCKDEP_COMMON_H
+#include <pthread.h>
+#define NR_LOCKDEP_CACHING_CLASSES 2
+#define MAX_LOCKDEP_SUBCLASSES 8UL
+#ifndef CALLER_ADDR0
+#define CALLER_ADDR0 ((unsigned long)__builtin_return_address(0))
+#endif
+#ifndef _RET_IP_
+#define _RET_IP_ CALLER_ADDR0
+#endif
+#ifndef _THIS_IP_
+#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
+#endif
+struct lockdep_subclass_key {
+        char __one_byte;
+};
+struct lock_class_key {
+        struct lockdep_subclass_key subkeys[MAX_LOCKDEP_SUBCLASSES];
+};
+struct lockdep_map {
+        struct lock_class_key   *key;
+        struct lock_class       *class_cache[NR_LOCKDEP_CACHING_CLASSES];
+        const char              *name;
+#ifdef CONFIG_LOCK_STAT
+        int                     cpu;
+        unsigned long           ip;
+#endif
+};
+void lockdep_init_map(struct lockdep_map *lock, const char *name,
+                        struct lock_class_key *key, int subclass);
+void lock_acquire(struct lockdep_map *lock, unsigned int subclass,
+                        int trylock, int read, int check,
+                        struct lockdep_map *nest_lock, unsigned long ip);
+void lock_release(struct lockdep_map *lock, int nested,
+                        unsigned long ip);
+#define STATIC_LOCKDEP_MAP_INIT(_name, _key) \
+        { .name = (_name), .key = (void *)(_key), }
+#endif
diff --git a/tools/lib/lockdep/include/liblockdep/mutex.h b/tools/lib/lockdep/include/liblockdep/mutex.h
new file mode 100644
index 000000000000..c342f7087147
--- /dev/null
+++ b/tools/lib/lockdep/include/liblockdep/mutex.h
@@ -0,0 +1,70 @@
+#ifndef _LIBLOCKDEP_MUTEX_H
+#define _LIBLOCKDEP_MUTEX_H
+#include <pthread.h>
+#include "common.h"
+struct liblockdep_pthread_mutex {
+        pthread_mutex_t mutex;
+        struct lockdep_map dep_map;
+};
+typedef struct liblockdep_pthread_mutex liblockdep_pthread_mutex_t;
+#define LIBLOCKDEP_PTHREAD_MUTEX_INITIALIZER(mtx)                       \
+                (const struct liblockdep_pthread_mutex) {               \
+        .mutex = PTHREAD_MUTEX_INITIALIZER,                             \
+        .dep_map = STATIC_LOCKDEP_MAP_INIT(#mtx, &((&(mtx))->dep_map)), \
+}
+static inline int __mutex_init(liblockdep_pthread_mutex_t *lock,
+                                const char *name,
+                                struct lock_class_key *key,
+                                const pthread_mutexattr_t *__mutexattr)
+{
+        lockdep_init_map(&lock->dep_map, name, key, 0);
+        return pthread_mutex_init(&lock->mutex, __mutexattr);
+}
+#define liblockdep_pthread_mutex_init(mutex, mutexattr)         \
+({                                                              \
+        static struct lock_class_key __key;                     \
+                                                                \
+        __mutex_init((mutex), #mutex, &__key, (mutexattr));     \
+})
+static inline int liblockdep_pthread_mutex_lock(liblockdep_pthread_mutex_t *lock)
+{
+        lock_acquire(&lock->dep_map, 0, 0, 0, 2, NULL, (unsigned long)_RET_IP_);
+        return pthread_mutex_lock(&lock->mutex);
+}
+static inline int liblockdep_pthread_mutex_unlock(liblockdep_pthread_mutex_t *lock)
+{
+        lock_release(&lock->dep_map, 0, (unsigned long)_RET_IP_);
+        return pthread_mutex_unlock(&lock->mutex);
+}
+static inline int liblockdep_pthread_mutex_trylock(liblockdep_pthread_mutex_t *lock)
+{
+        lock_acquire(&lock->dep_map, 0, 1, 0, 2, NULL, (unsigned long)_RET_IP_);
+        return pthread_mutex_trylock(&lock->mutex) == 0 ? 1 : 0;
+}
+static inline int liblockdep_pthread_mutex_destroy(liblockdep_pthread_mutex_t *lock)
+{
+        return pthread_mutex_destroy(&lock->mutex);
+}
+#ifdef __USE_LIBLOCKDEP
+#define pthread_mutex_t         liblockdep_pthread_mutex_t
+#define pthread_mutex_init      liblockdep_pthread_mutex_init
+#define pthread_mutex_lock      liblockdep_pthread_mutex_lock
+#define pthread_mutex_unlock    liblockdep_pthread_mutex_unlock
+#define pthread_mutex_trylock   liblockdep_pthread_mutex_trylock
+#define pthread_mutex_destroy   liblockdep_pthread_mutex_destroy
+#endif
+#endif
diff --git a/tools/lib/lockdep/include/liblockdep/rwlock.h b/tools/lib/lockdep/include/liblockdep/rwlock.h
new file mode 100644
index 000000000000..a680ab8c2e36
--- /dev/null
+++ b/tools/lib/lockdep/include/liblockdep/rwlock.h
@@ -0,0 +1,86 @@
+#ifndef _LIBLOCKDEP_RWLOCK_H
+#define _LIBLOCKDEP_RWLOCK_H
+#include <pthread.h>
+#include "common.h"
+struct liblockdep_pthread_rwlock {
+        pthread_rwlock_t rwlock;
+        struct lockdep_map dep_map;
+};
+typedef struct liblockdep_pthread_rwlock liblockdep_pthread_rwlock_t;
+#define LIBLOCKDEP_PTHREAD_RWLOCK_INITIALIZER(rwl)                      \
+                (struct liblockdep_pthread_rwlock) {                    \
+        .rwlock = PTHREAD_RWLOCK_INITIALIZER,                           \
+        .dep_map = STATIC_LOCKDEP_MAP_INIT(#rwl, &((&(rwl))->dep_map)), \
+}
+static inline int __rwlock_init(liblockdep_pthread_rwlock_t *lock,
+                                const char *name,
+                                struct lock_class_key *key,
+                                const pthread_rwlockattr_t *attr)
+{
+        lockdep_init_map(&lock->dep_map, name, key, 0);
+        return pthread_rwlock_init(&lock->rwlock, attr);
+}
+#define liblockdep_pthread_rwlock_init(lock, attr)              \
+({                                                      \
+        static struct lock_class_key __key;             \
+                                                        \
+        __rwlock_init((lock), #lock, &__key, (attr));   \
+})
+static inline int liblockdep_pthread_rwlock_rdlock(liblockdep_pthread_rwlock_t *lock)
+{
+        lock_acquire(&lock->dep_map, 0, 0, 2, 2, NULL, (unsigned long)_RET_IP_);
+        return pthread_rwlock_rdlock(&lock->rwlock);
+}
+static inline int liblockdep_pthread_rwlock_unlock(liblockdep_pthread_rwlock_t *lock)
+{
+        lock_release(&lock->dep_map, 0, (unsigned long)_RET_IP_);
+        return pthread_rwlock_unlock(&lock->rwlock);
+}
+static inline int liblockdep_pthread_rwlock_wrlock(liblockdep_pthread_rwlock_t *lock)
+{
+        lock_acquire(&lock->dep_map, 0, 0, 0, 2, NULL, (unsigned long)_RET_IP_);
+        return pthread_rwlock_wrlock(&lock->rwlock);
+}
+static inline int liblockdep_pthread_rwlock_tryrdlock(liblockdep_pthread_rwlock_t *lock)
+{
+        lock_acquire(&lock->dep_map, 0, 1, 2, 2, NULL, (unsigned long)_RET_IP_);
+        return pthread_rwlock_tryrdlock(&lock->rwlock) == 0 ? 1 : 0;
+}
+static inline int liblockdep_pthread_rwlock_trywlock(liblockdep_pthread_rwlock_t *lock)
+{
+        lock_acquire(&lock->dep_map, 0, 1, 0, 2, NULL, (unsigned long)_RET_IP_);
+        return pthread_rwlock_trywlock(&lock->rwlock) == 0 ? 1 : 0;
+}
+static inline int liblockdep_rwlock_destroy(liblockdep_pthread_rwlock_t *lock)
+{
+        return pthread_rwlock_destroy(&lock->rwlock);
+}
+#ifdef __USE_LIBLOCKDEP
+#define pthread_rwlock_t                liblockdep_pthread_rwlock_t
+#define pthread_rwlock_init             liblockdep_pthread_rwlock_init
+#define pthread_rwlock_rdlock           liblockdep_pthread_rwlock_rdlock
+#define pthread_rwlock_unlock           liblockdep_pthread_rwlock_unlock
+#define pthread_rwlock_wrlock           liblockdep_pthread_rwlock_wrlock
+#define pthread_rwlock_tryrdlock        liblockdep_pthread_rwlock_tryrdlock
+#define pthread_rwlock_trywlock         liblockdep_pthread_rwlock_trywlock
+#define pthread_rwlock_destroy          liblockdep_rwlock_destroy
+#endif
+#endif
diff --git a/tools/lib/lockdep/lockdep b/tools/lib/lockdep/lockdep
new file mode 100755
index 000000000000..49af9fe19f5b
--- /dev/null
+++ b/tools/lib/lockdep/lockdep
@@ -0,0 +1,3 @@
+#!/bin/bash
+LD_PRELOAD="./liblockdep.so $LD_PRELOAD" "$@"
diff --git a/tools/lib/lockdep/lockdep.c b/tools/lib/lockdep/lockdep.c
new file mode 100644
index 000000000000..f42b7e9aa48f
--- /dev/null
+++ b/tools/lib/lockdep/lockdep.c
@@ -0,0 +1,2 @@
+#include <linux/lockdep.h>
+#include "../../../kernel/locking/lockdep.c"
diff --git a/tools/lib/lockdep/lockdep_internals.h b/tools/lib/lockdep/lockdep_internals.h
new file mode 100644
index 000000000000..29d0c954cc24
--- /dev/null
+++ b/tools/lib/lockdep/lockdep_internals.h
@@ -0,0 +1 @@
+#include "../../../kernel/locking/lockdep_internals.h"
diff --git a/tools/lib/lockdep/lockdep_states.h b/tools/lib/lockdep/lockdep_states.h
new file mode 100644
index 000000000000..248d235efda9
--- /dev/null
+++ b/tools/lib/lockdep/lockdep_states.h
@@ -0,0 +1 @@
+#include "../../../kernel/locking/lockdep_states.h"
diff --git a/tools/lib/lockdep/preload.c b/tools/lib/lockdep/preload.c
new file mode 100644
index 000000000000..f8465a811aa5
--- /dev/null
+++ b/tools/lib/lockdep/preload.c
@@ -0,0 +1,447 @@
+#define _GNU_SOURCE
+#include <pthread.h>
+#include <stdio.h>
+#include <dlfcn.h>
+#include <stdlib.h>
+#include <sysexits.h>
+#include "include/liblockdep/mutex.h"
+#include "../../../include/linux/rbtree.h"
+/**
+ * struct lock_lookup - liblockdep's view of a single unique lock
+ * @orig: pointer to the original pthread lock, used for lookups
+ * @dep_map: lockdep's dep_map structure
+ * @key: lockdep's key structure
+ * @node: rb-tree node used to store the lock in a global tree
+ * @name: a unique name for the lock
+ */
+struct lock_lookup {
+        void *orig; /* Original pthread lock, used for lookups */
+        struct lockdep_map dep_map; /* Since all locks are dynamic, we need
+                                     * a dep_map and a key for each lock */
+        /*
+         * Wait, there's no support for key classes? Yup :(
+         * Most big projects wrap the pthread api with their own calls to
+         * be compatible with different locking methods. This means that
+         * "classes" will be brokes since the function that creates all
+         * locks will point to a generic locking function instead of the
+         * actual code that wants to do the locking.
+         */
+        struct lock_class_key key;
+        struct rb_node node;
+#define LIBLOCKDEP_MAX_LOCK_NAME 22
+        char name[LIBLOCKDEP_MAX_LOCK_NAME];
+};
+/* This is where we store our locks */
+static struct rb_root locks = RB_ROOT;
+static pthread_rwlock_t locks_rwlock = PTHREAD_RWLOCK_INITIALIZER;
+/* pthread mutex API */
+#ifdef __GLIBC__
+extern int __pthread_mutex_init(pthread_mutex_t *mutex, const pthread_mutexattr_t *attr);
+extern int __pthread_mutex_lock(pthread_mutex_t *mutex);
+extern int __pthread_mutex_trylock(pthread_mutex_t *mutex);
+extern int __pthread_mutex_unlock(pthread_mutex_t *mutex);
+extern int __pthread_mutex_destroy(pthread_mutex_t *mutex);
+#else
+#define __pthread_mutex_init    NULL
+#define __pthread_mutex_lock    NULL
+#define __pthread_mutex_trylock NULL
+#define __pthread_mutex_unlock  NULL
+#define __pthread_mutex_destroy NULL
+#endif
+static int (*ll_pthread_mutex_init)(pthread_mutex_t *mutex,
+                        const pthread_mutexattr_t *attr)        = __pthread_mutex_init;
+static int (*ll_pthread_mutex_lock)(pthread_mutex_t *mutex)     = __pthread_mutex_lock;
+static int (*ll_pthread_mutex_trylock)(pthread_mutex_t *mutex)  = __pthread_mutex_trylock;
+static int (*ll_pthread_mutex_unlock)(pthread_mutex_t *mutex)   = __pthread_mutex_unlock;
+static int (*ll_pthread_mutex_destroy)(pthread_mutex_t *mutex)  = __pthread_mutex_destroy;
+/* pthread rwlock API */
+#ifdef __GLIBC__
+extern int __pthread_rwlock_init(pthread_rwlock_t *rwlock, const pthread_rwlockattr_t *attr);
+extern int __pthread_rwlock_destroy(pthread_rwlock_t *rwlock);
+extern int __pthread_rwlock_wrlock(pthread_rwlock_t *rwlock);
+extern int __pthread_rwlock_trywrlock(pthread_rwlock_t *rwlock);
+extern int __pthread_rwlock_rdlock(pthread_rwlock_t *rwlock);
+extern int __pthread_rwlock_tryrdlock(pthread_rwlock_t *rwlock);
+extern int __pthread_rwlock_unlock(pthread_rwlock_t *rwlock);
+#else
+#define __pthread_rwlock_init           NULL
+#define __pthread_rwlock_destroy        NULL
+#define __pthread_rwlock_wrlock         NULL
+#define __pthread_rwlock_trywrlock      NULL
+#define __pthread_rwlock_rdlock         NULL
+#define __pthread_rwlock_tryrdlock      NULL
+#define __pthread_rwlock_unlock         NULL
+#endif
+static int (*ll_pthread_rwlock_init)(pthread_rwlock_t *rwlock,
+                        const pthread_rwlockattr_t *attr)               = __pthread_rwlock_init;
+static int (*ll_pthread_rwlock_destroy)(pthread_rwlock_t *rwlock)       = __pthread_rwlock_destroy;
+static int (*ll_pthread_rwlock_rdlock)(pthread_rwlock_t *rwlock)        = __pthread_rwlock_rdlock;
+static int (*ll_pthread_rwlock_tryrdlock)(pthread_rwlock_t *rwlock)     = __pthread_rwlock_tryrdlock;
+static int (*ll_pthread_rwlock_trywrlock)(pthread_rwlock_t *rwlock)     = __pthread_rwlock_trywrlock;
+static int (*ll_pthread_rwlock_wrlock)(pthread_rwlock_t *rwlock)        = __pthread_rwlock_wrlock;
+static int (*ll_pthread_rwlock_unlock)(pthread_rwlock_t *rwlock)        = __pthread_rwlock_unlock;
+enum { none, prepare, done, } __init_state;
+static void init_preload(void);
+static void try_init_preload(void)
+{
+        if (!__init_state != done)
+                init_preload();
+}
+static struct rb_node **__get_lock_node(void *lock, struct rb_node **parent)
+{
+        struct rb_node **node = &locks.rb_node;
+        struct lock_lookup *l;
+        *parent = NULL;
+        while (*node) {
+                l = rb_entry(*node, struct lock_lookup, node);
+                *parent = *node;
+                if (lock < l->orig)
+                        node = &l->node.rb_left;
+                else if (lock > l->orig)
+                        node = &l->node.rb_right;
+                else
+                        return node;
+        }
+        return node;
+}
+#ifndef LIBLOCKDEP_STATIC_ENTRIES
+#define LIBLOCKDEP_STATIC_ENTRIES       1024
+#endif
+#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
+static struct lock_lookup __locks[LIBLOCKDEP_STATIC_ENTRIES];
+static int __locks_nr;
+static inline bool is_static_lock(struct lock_lookup *lock)
+{
+        return lock >= __locks && lock < __locks + ARRAY_SIZE(__locks);
+}
+static struct lock_lookup *alloc_lock(void)
+{
+        if (__init_state != done) {
+                /*
+                 * Some programs attempt to initialize and use locks in their
+                 * allocation path. This means that a call to malloc() would
+                 * result in locks being initialized and locked.
+                 *
+                 * Why is it an issue for us? dlsym() below will try allocating
+                 * to give us the original function. Since this allocation will
+                 * result in a locking operations, we have to let pthread deal
+                 * with it, but we can't! we don't have the pointer to the
+                 * original API since we're inside dlsym() trying to get it
+                 */
+                int idx = __locks_nr++;
+                if (idx >= ARRAY_SIZE(__locks)) {
+                        fprintf(stderr,
+                "LOCKDEP error: insufficient LIBLOCKDEP_STATIC_ENTRIES\n");
+                        exit(EX_UNAVAILABLE);
+                }
+                return __locks + idx;
+        }
+        return malloc(sizeof(struct lock_lookup));
+}
+static inline void free_lock(struct lock_lookup *lock)
+{
+        if (likely(!is_static_lock(lock)))
+                free(lock);
+}
+/**
+ * __get_lock - find or create a lock instance
+ * @lock: pointer to a pthread lock function
+ *
+ * Try to find an existing lock in the rbtree using the provided pointer. If
+ * one wasn't found - create it.
+ */
+static struct lock_lookup *__get_lock(void *lock)
+{
+        struct rb_node **node, *parent;
+        struct lock_lookup *l;
+        ll_pthread_rwlock_rdlock(&locks_rwlock);
+        node = __get_lock_node(lock, &parent);
+        ll_pthread_rwlock_unlock(&locks_rwlock);
+        if (*node) {
+                return rb_entry(*node, struct lock_lookup, node);
+        }
+        /* We didn't find the lock, let's create it */
+        l = alloc_lock();
+        if (l == NULL)
+                return NULL;
+        l->orig = lock;
+        /*
+         * Currently the name of the lock is the ptr value of the pthread lock,
+         * while not optimal, it makes debugging a bit easier.
+         *
+         * TODO: Get the real name of the lock using libdwarf
+         */
+        sprintf(l->name, "%p", lock);
+        lockdep_init_map(&l->dep_map, l->name, &l->key, 0);
+        ll_pthread_rwlock_wrlock(&locks_rwlock);
+        /* This might have changed since the last time we fetched it */
+        node = __get_lock_node(lock, &parent);
+        rb_link_node(&l->node, parent, node);
+        rb_insert_color(&l->node, &locks);
+        ll_pthread_rwlock_unlock(&locks_rwlock);
+        return l;
+}
+static void __del_lock(struct lock_lookup *lock)
+{
+        ll_pthread_rwlock_wrlock(&locks_rwlock);
+        rb_erase(&lock->node, &locks);
+        ll_pthread_rwlock_unlock(&locks_rwlock);
+        free_lock(lock);
+}
+int pthread_mutex_init(pthread_mutex_t *mutex,
+                        const pthread_mutexattr_t *attr)
+{
+        int r;
+        /*
+         * We keep trying to init our preload module because there might be
+         * code in init sections that tries to touch locks before we are
+         * initialized, in that case we'll need to manually call preload
+         * to get us going.
+         *
+         * Funny enough, kernel's lockdep had the same issue, and used
+         * (almost) the same solution. See look_up_lock_class() in
+         * kernel/locking/lockdep.c for details.
+         */
+        try_init_preload();
+        r = ll_pthread_mutex_init(mutex, attr);
+        if (r == 0)
+                /*
+                 * We do a dummy initialization here so that lockdep could
+                 * warn us if something fishy is going on - such as
+                 * initializing a held lock.
+                 */
+                __get_lock(mutex);
+        return r;
+}
+int pthread_mutex_lock(pthread_mutex_t *mutex)
+{
+        int r;
+        try_init_preload();
+        lock_acquire(&__get_lock(mutex)->dep_map, 0, 0, 0, 2, NULL,
+                        (unsigned long)_RET_IP_);
+        /*
+         * Here's the thing with pthread mutexes: unlike the kernel variant,
+         * they can fail.
+         *
+         * This means that the behaviour here is a bit different from what's
+         * going on in the kernel: there we just tell lockdep that we took the
+         * lock before actually taking it, but here we must deal with the case
+         * that locking failed.
+         *
+         * To do that we'll "release" the lock if locking failed - this way
+         * we'll get lockdep doing the correct checks when we try to take
+         * the lock, and if that fails - we'll be back to the correct
+         * state by releasing it.
+         */
+        r = ll_pthread_mutex_lock(mutex);
+        if (r)
+                lock_release(&__get_lock(mutex)->dep_map, 0, (unsigned long)_RET_IP_);
+        return r;
+}
+int pthread_mutex_trylock(pthread_mutex_t *mutex)
+{
+        int r;
+        try_init_preload();
+        lock_acquire(&__get_lock(mutex)->dep_map, 0, 1, 0, 2, NULL, (unsigned long)_RET_IP_);
+        r = ll_pthread_mutex_trylock(mutex);
+        if (r)
+                lock_release(&__get_lock(mutex)->dep_map, 0, (unsigned long)_RET_IP_);
+        return r;
+}
+int pthread_mutex_unlock(pthread_mutex_t *mutex)
+{
+        int r;
+        try_init_preload();
+        lock_release(&__get_lock(mutex)->dep_map, 0, (unsigned long)_RET_IP_);
+        /*
+         * Just like taking a lock, only in reverse!
+         *
+         * If we fail releasing the lock, tell lockdep we're holding it again.
+         */
+        r = ll_pthread_mutex_unlock(mutex);
+        if (r)
+                lock_acquire(&__get_lock(mutex)->dep_map, 0, 0, 0, 2, NULL, (unsigned long)_RET_IP_);
+        return r;
+}
+int pthread_mutex_destroy(pthread_mutex_t *mutex)
+{
+        try_init_preload();
+        /*
+         * Let's see if we're releasing a lock that's held.
+         *
+         * TODO: Hook into free() and add that check there as well.
+         */
+        debug_check_no_locks_freed(mutex, mutex + sizeof(*mutex));
+        __del_lock(__get_lock(mutex));
+        return ll_pthread_mutex_destroy(mutex);
+}
+/* This is the rwlock part, very similar to what happened with mutex above */
+int pthread_rwlock_init(pthread_rwlock_t *rwlock,
+                        const pthread_rwlockattr_t *attr)
+{
+        int r;
+        try_init_preload();
+        r = ll_pthread_rwlock_init(rwlock, attr);
+        if (r == 0)
+                __get_lock(rwlock);
+        return r;
+}
+int pthread_rwlock_destroy(pthread_rwlock_t *rwlock)
+{
+        try_init_preload();
+        debug_check_no_locks_freed(rwlock, rwlock + sizeof(*rwlock));
+        __del_lock(__get_lock(rwlock));
+        return ll_pthread_rwlock_destroy(rwlock);
+}
+int pthread_rwlock_rdlock(pthread_rwlock_t *rwlock)
+{
+        int r;
+        init_preload();
+        lock_acquire(&__get_lock(rwlock)->dep_map, 0, 0, 2, 2, NULL, (unsigned long)_RET_IP_);
+        r = ll_pthread_rwlock_rdlock(rwlock);
+        if (r)
+                lock_release(&__get_lock(rwlock)->dep_map, 0, (unsigned long)_RET_IP_);
+        return r;
+}
+int pthread_rwlock_tryrdlock(pthread_rwlock_t *rwlock)
+{
+        int r;
+        init_preload();
+        lock_acquire(&__get_lock(rwlock)->dep_map, 0, 1, 2, 2, NULL, (unsigned long)_RET_IP_);
+        r = ll_pthread_rwlock_tryrdlock(rwlock);
+        if (r)
+                lock_release(&__get_lock(rwlock)->dep_map, 0, (unsigned long)_RET_IP_);
+        return r;
+}
+int pthread_rwlock_trywrlock(pthread_rwlock_t *rwlock)
+{
+        int r;
+        init_preload();
+        lock_acquire(&__get_lock(rwlock)->dep_map, 0, 1, 0, 2, NULL, (unsigned long)_RET_IP_);
+        r = ll_pthread_rwlock_trywrlock(rwlock);
+        if (r)
+                lock_release(&__get_lock(rwlock)->dep_map, 0, (unsigned long)_RET_IP_);
+        return r;
+}
+int pthread_rwlock_wrlock(pthread_rwlock_t *rwlock)
+{
+        int r;
+        init_preload();
+        lock_acquire(&__get_lock(rwlock)->dep_map, 0, 0, 0, 2, NULL, (unsigned long)_RET_IP_);
+        r = ll_pthread_rwlock_wrlock(rwlock);
+        if (r)
+                lock_release(&__get_lock(rwlock)->dep_map, 0, (unsigned long)_RET_IP_);
+        return r;
+}
+int pthread_rwlock_unlock(pthread_rwlock_t *rwlock)
+{
+        int r;
+        init_preload();
+        lock_release(&__get_lock(rwlock)->dep_map, 0, (unsigned long)_RET_IP_);
+        r = ll_pthread_rwlock_unlock(rwlock);
+        if (r)
+                lock_acquire(&__get_lock(rwlock)->dep_map, 0, 0, 0, 2, NULL, (unsigned long)_RET_IP_);
+        return r;
+}
+__attribute__((constructor)) static void init_preload(void)
+{
+        if (__init_state != done)
+                return;
+#ifndef __GLIBC__
+        __init_state = prepare;
+        ll_pthread_mutex_init = dlsym(RTLD_NEXT, "pthread_mutex_init");
+        ll_pthread_mutex_lock = dlsym(RTLD_NEXT, "pthread_mutex_lock");
+        ll_pthread_mutex_trylock = dlsym(RTLD_NEXT, "pthread_mutex_trylock");
+        ll_pthread_mutex_unlock = dlsym(RTLD_NEXT, "pthread_mutex_unlock");
+        ll_pthread_mutex_destroy = dlsym(RTLD_NEXT, "pthread_mutex_destroy");
+        ll_pthread_rwlock_init = dlsym(RTLD_NEXT, "pthread_rwlock_init");
+        ll_pthread_rwlock_destroy = dlsym(RTLD_NEXT, "pthread_rwlock_destroy");
+        ll_pthread_rwlock_rdlock = dlsym(RTLD_NEXT, "pthread_rwlock_rdlock");
+        ll_pthread_rwlock_tryrdlock = dlsym(RTLD_NEXT, "pthread_rwlock_tryrdlock");
+        ll_pthread_rwlock_wrlock = dlsym(RTLD_NEXT, "pthread_rwlock_wrlock");
+        ll_pthread_rwlock_trywrlock = dlsym(RTLD_NEXT, "pthread_rwlock_trywrlock");
+        ll_pthread_rwlock_unlock = dlsym(RTLD_NEXT, "pthread_rwlock_unlock");
+#endif
+        printf("%p\n", ll_pthread_mutex_trylock);fflush(stdout);
+        lockdep_init();
+        __init_state = done;
+}
diff --git a/tools/lib/lockdep/rbtree.c b/tools/lib/lockdep/rbtree.c
new file mode 100644
index 000000000000..f7f43033c8b7
--- /dev/null
+++ b/tools/lib/lockdep/rbtree.c
@@ -0,0 +1 @@
+#include "../../../lib/rbtree.c"
diff --git a/tools/lib/lockdep/run_tests.sh b/tools/lib/lockdep/run_tests.sh
new file mode 100644
index 000000000000..5334ad9d39b7
--- /dev/null
+++ b/tools/lib/lockdep/run_tests.sh
@@ -0,0 +1,27 @@
+#! /bin/bash
+make &> /dev/null
+for i in `ls tests/*.c`; do
+        testname=$(basename -s .c "$i")
+        gcc -o tests/$testname -pthread -lpthread $i liblockdep.a -Iinclude -D__USE_LIBLOCKDEP &> /dev/null
+        echo -ne "$testname... "
+        if [ $(timeout 1 ./tests/$testname | wc -l) -gt 0 ]; then
+                echo "PASSED!"
+        else
+                echo "FAILED!"
+        fi
+        rm tests/$testname
+done
+for i in `ls tests/*.c`; do
+        testname=$(basename -s .c "$i")
+        gcc -o tests/$testname -pthread -lpthread -Iinclude $i &> /dev/null
+        echo -ne "(PRELOAD) $testname... "
+        if [ $(timeout 1 ./lockdep ./tests/$testname | wc -l) -gt 0 ]; then
+                echo "PASSED!"
+        else
+                echo "FAILED!"
+        fi
+        rm tests/$testname
+done
diff --git a/tools/lib/lockdep/tests/AA.c b/tools/lib/lockdep/tests/AA.c
new file mode 100644
index 000000000000..0f782ff404ac
--- /dev/null
+++ b/tools/lib/lockdep/tests/AA.c
@@ -0,0 +1,13 @@
+#include <liblockdep/mutex.h>
+void main(void)
+{
+        pthread_mutex_t a, b;
+        pthread_mutex_init(&a, NULL);
+        pthread_mutex_init(&b, NULL);
+        pthread_mutex_lock(&a);
+        pthread_mutex_lock(&b);
+        pthread_mutex_lock(&a);
+}
diff --git a/tools/lib/lockdep/tests/ABBA.c b/tools/lib/lockdep/tests/ABBA.c
new file mode 100644
index 000000000000..07f0e29d5485
--- /dev/null
+++ b/tools/lib/lockdep/tests/ABBA.c
@@ -0,0 +1,13 @@
+#include <liblockdep/mutex.h>
+#include "common.h"
+void main(void)
+{
+        pthread_mutex_t a, b;
+        pthread_mutex_init(&a, NULL);
+        pthread_mutex_init(&b, NULL);
+        LOCK_UNLOCK_2(a, b);
+        LOCK_UNLOCK_2(b, a);
+}
diff --git a/tools/lib/lockdep/tests/ABBCCA.c b/tools/lib/lockdep/tests/ABBCCA.c
new file mode 100644
index 000000000000..843db09ac666
--- /dev/null
+++ b/tools/lib/lockdep/tests/ABBCCA.c
@@ -0,0 +1,15 @@
+#include <liblockdep/mutex.h>
+#include "common.h"
+void main(void)
+{
+        pthread_mutex_t a, b, c;
+        pthread_mutex_init(&a, NULL);
+        pthread_mutex_init(&b, NULL);
+        pthread_mutex_init(&c, NULL);
+        LOCK_UNLOCK_2(a, b);
+        LOCK_UNLOCK_2(b, c);
+        LOCK_UNLOCK_2(c, a);
+}
diff --git a/tools/lib/lockdep/tests/ABBCCDDA.c b/tools/lib/lockdep/tests/ABBCCDDA.c
new file mode 100644
index 000000000000..33620e268f85
--- /dev/null
+++ b/tools/lib/lockdep/tests/ABBCCDDA.c
@@ -0,0 +1,17 @@
+#include <liblockdep/mutex.h>
+#include "common.h"
+void main(void)
+{
+        pthread_mutex_t a, b, c, d;
+        pthread_mutex_init(&a, NULL);
+        pthread_mutex_init(&b, NULL);
+        pthread_mutex_init(&c, NULL);
+        pthread_mutex_init(&d, NULL);
+        LOCK_UNLOCK_2(a, b);
+        LOCK_UNLOCK_2(b, c);
+        LOCK_UNLOCK_2(c, d);
+        LOCK_UNLOCK_2(d, a);
+}
diff --git a/tools/lib/lockdep/tests/ABCABC.c b/tools/lib/lockdep/tests/ABCABC.c
new file mode 100644
index 000000000000..3fee51e3a68a
--- /dev/null
+++ b/tools/lib/lockdep/tests/ABCABC.c
@@ -0,0 +1,15 @@
+#include <liblockdep/mutex.h>
+#include "common.h"
+void main(void)
+{
+        pthread_mutex_t a, b, c;
+        pthread_mutex_init(&a, NULL);
+        pthread_mutex_init(&b, NULL);
+        pthread_mutex_init(&c, NULL);
+        LOCK_UNLOCK_2(a, b);
+        LOCK_UNLOCK_2(c, a);
+        LOCK_UNLOCK_2(b, c);
+}
diff --git a/tools/lib/lockdep/tests/ABCDBCDA.c b/tools/lib/lockdep/tests/ABCDBCDA.c
new file mode 100644
index 000000000000..427ba562c75b
--- /dev/null
+++ b/tools/lib/lockdep/tests/ABCDBCDA.c
@@ -0,0 +1,17 @@
+#include <liblockdep/mutex.h>
+#include "common.h"
+void main(void)
+{
+        pthread_mutex_t a, b, c, d;
+        pthread_mutex_init(&a, NULL);
+        pthread_mutex_init(&b, NULL);
+        pthread_mutex_init(&c, NULL);
+        pthread_mutex_init(&d, NULL);
+        LOCK_UNLOCK_2(a, b);
+        LOCK_UNLOCK_2(c, d);
+        LOCK_UNLOCK_2(b, c);
+        LOCK_UNLOCK_2(d, a);
+}
diff --git a/tools/lib/lockdep/tests/ABCDBDDA.c b/tools/lib/lockdep/tests/ABCDBDDA.c
new file mode 100644
index 000000000000..680c6cf3e919
--- /dev/null
+++ b/tools/lib/lockdep/tests/ABCDBDDA.c
@@ -0,0 +1,17 @@
+#include <liblockdep/mutex.h>
+#include "common.h"
+void main(void)
+{
+        pthread_mutex_t a, b, c, d;
+        pthread_mutex_init(&a, NULL);
+        pthread_mutex_init(&b, NULL);
+        pthread_mutex_init(&c, NULL);
+        pthread_mutex_init(&d, NULL);
+        LOCK_UNLOCK_2(a, b);
+        LOCK_UNLOCK_2(c, d);
+        LOCK_UNLOCK_2(b, d);
+        LOCK_UNLOCK_2(d, a);
+}
diff --git a/tools/lib/lockdep/tests/WW.c b/tools/lib/lockdep/tests/WW.c
new file mode 100644
index 000000000000..d44f77d71029
--- /dev/null
+++ b/tools/lib/lockdep/tests/WW.c
@@ -0,0 +1,13 @@
+#include <liblockdep/rwlock.h>
+void main(void)
+{
+        pthread_rwlock_t a, b;
+        pthread_rwlock_init(&a, NULL);
+        pthread_rwlock_init(&b, NULL);
+        pthread_rwlock_wrlock(&a);
+        pthread_rwlock_rdlock(&b);
+        pthread_rwlock_wrlock(&a);
+}
diff --git a/tools/lib/lockdep/tests/common.h b/tools/lib/lockdep/tests/common.h
new file mode 100644
index 000000000000..d89e94d47d86
--- /dev/null
+++ b/tools/lib/lockdep/tests/common.h
@@ -0,0 +1,12 @@
+#ifndef _LIBLOCKDEP_TEST_COMMON_H
+#define _LIBLOCKDEP_TEST_COMMON_H
+#define LOCK_UNLOCK_2(a, b)                     \
+        do {                                    \
+                pthread_mutex_lock(&(a));       \
+                pthread_mutex_lock(&(b));       \
+                pthread_mutex_unlock(&(b));     \
+                pthread_mutex_unlock(&(a));     \
+        } while(0)
+#endif
diff --git a/tools/lib/lockdep/tests/unlock_balance.c b/tools/lib/lockdep/tests/unlock_balance.c
new file mode 100644
index 000000000000..0bc62de686f7
--- /dev/null
+++ b/tools/lib/lockdep/tests/unlock_balance.c
@@ -0,0 +1,12 @@
+#include <liblockdep/mutex.h>
+void main(void)
+{
+        pthread_mutex_t a;
+        pthread_mutex_init(&a, NULL);
+        pthread_mutex_lock(&a);
+        pthread_mutex_unlock(&a);
+        pthread_mutex_unlock(&a);
+}
diff --git a/tools/lib/lockdep/uinclude/asm/hweight.h b/tools/lib/lockdep/uinclude/asm/hweight.h
new file mode 100644
index 000000000000..fab00ff936d1
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/asm/hweight.h
@@ -0,0 +1,3 @@
+/* empty file */
diff --git a/tools/lib/lockdep/uinclude/asm/sections.h b/tools/lib/lockdep/uinclude/asm/sections.h
new file mode 100644
index 000000000000..fab00ff936d1
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/asm/sections.h
@@ -0,0 +1,3 @@
+/* empty file */
diff --git a/tools/lib/lockdep/uinclude/linux/bitops.h b/tools/lib/lockdep/uinclude/linux/bitops.h
new file mode 100644
index 000000000000..fab00ff936d1
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/bitops.h
@@ -0,0 +1,3 @@
+/* empty file */
diff --git a/tools/lib/lockdep/uinclude/linux/compiler.h b/tools/lib/lockdep/uinclude/linux/compiler.h
new file mode 100644
index 000000000000..7ac838a1f196
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/compiler.h
@@ -0,0 +1,7 @@
+#ifndef _LIBLOCKDEP_LINUX_COMPILER_H_
+#define _LIBLOCKDEP_LINUX_COMPILER_H_
+#define __used          __attribute__((__unused__))
+#define unlikely
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/debug_locks.h b/tools/lib/lockdep/uinclude/linux/debug_locks.h
new file mode 100644
index 000000000000..f38eb64df794
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/debug_locks.h
@@ -0,0 +1,12 @@
+#ifndef _LIBLOCKDEP_DEBUG_LOCKS_H_
+#define _LIBLOCKDEP_DEBUG_LOCKS_H_
+#include <stddef.h>
+#include <linux/compiler.h>
+#define DEBUG_LOCKS_WARN_ON(x) (x)
+extern bool debug_locks;
+extern bool debug_locks_silent;
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/delay.h b/tools/lib/lockdep/uinclude/linux/delay.h
new file mode 100644
index 000000000000..fab00ff936d1
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/delay.h
@@ -0,0 +1,3 @@
+/* empty file */
diff --git a/tools/lib/lockdep/uinclude/linux/export.h b/tools/lib/lockdep/uinclude/linux/export.h
new file mode 100644
index 000000000000..6bdf3492c535
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/export.h
@@ -0,0 +1,7 @@
+#ifndef _LIBLOCKDEP_LINUX_EXPORT_H_
+#define _LIBLOCKDEP_LINUX_EXPORT_H_
+#define EXPORT_SYMBOL(sym)
+#define EXPORT_SYMBOL_GPL(sym)
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/ftrace.h b/tools/lib/lockdep/uinclude/linux/ftrace.h
new file mode 100644
index 000000000000..fab00ff936d1
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/ftrace.h
@@ -0,0 +1,3 @@
+/* empty file */
diff --git a/tools/lib/lockdep/uinclude/linux/gfp.h b/tools/lib/lockdep/uinclude/linux/gfp.h
new file mode 100644
index 000000000000..fab00ff936d1
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/gfp.h
@@ -0,0 +1,3 @@
+/* empty file */
diff --git a/tools/lib/lockdep/uinclude/linux/hardirq.h b/tools/lib/lockdep/uinclude/linux/hardirq.h
new file mode 100644
index 000000000000..c8f3f8f58729
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/hardirq.h
@@ -0,0 +1,11 @@
+#ifndef _LIBLOCKDEP_LINUX_HARDIRQ_H_
+#define _LIBLOCKDEP_LINUX_HARDIRQ_H_
+#define SOFTIRQ_BITS    0UL
+#define HARDIRQ_BITS    0UL
+#define SOFTIRQ_SHIFT   0UL
+#define HARDIRQ_SHIFT   0UL
+#define hardirq_count() 0UL
+#define softirq_count() 0UL
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/hash.h b/tools/lib/lockdep/uinclude/linux/hash.h
new file mode 100644
index 000000000000..0f8479858dc0
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/hash.h
@@ -0,0 +1 @@
+#include "../../../include/linux/hash.h"
diff --git a/tools/lib/lockdep/uinclude/linux/interrupt.h b/tools/lib/lockdep/uinclude/linux/interrupt.h
new file mode 100644
index 000000000000..fab00ff936d1
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/interrupt.h
@@ -0,0 +1,3 @@
+/* empty file */
diff --git a/tools/lib/lockdep/uinclude/linux/irqflags.h b/tools/lib/lockdep/uinclude/linux/irqflags.h
new file mode 100644
index 000000000000..6cc296f0fad0
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/irqflags.h
@@ -0,0 +1,38 @@
+#ifndef _LIBLOCKDEP_LINUX_TRACE_IRQFLAGS_H_
+#define _LIBLOCKDEP_LINUX_TRACE_IRQFLAGS_H_
+# define trace_hardirq_context(p)       0
+# define trace_softirq_context(p)       0
+# define trace_hardirqs_enabled(p)      0
+# define trace_softirqs_enabled(p)      0
+# define trace_hardirq_enter()          do { } while (0)
+# define trace_hardirq_exit()           do { } while (0)
+# define lockdep_softirq_enter()        do { } while (0)
+# define lockdep_softirq_exit()         do { } while (0)
+# define INIT_TRACE_IRQFLAGS
+# define stop_critical_timings() do { } while (0)
+# define start_critical_timings() do { } while (0)
+#define raw_local_irq_disable() do { } while (0)
+#define raw_local_irq_enable() do { } while (0)
+#define raw_local_irq_save(flags) ((flags) = 0)
+#define raw_local_irq_restore(flags) do { } while (0)
+#define raw_local_save_flags(flags) ((flags) = 0)
+#define raw_irqs_disabled_flags(flags) do { } while (0)
+#define raw_irqs_disabled() 0
+#define raw_safe_halt()
+#define local_irq_enable() do { } while (0)
+#define local_irq_disable() do { } while (0)
+#define local_irq_save(flags) ((flags) = 0)
+#define local_irq_restore(flags) do { } while (0)
+#define local_save_flags(flags) ((flags) = 0)
+#define irqs_disabled() (1)
+#define irqs_disabled_flags(flags) (0)
+#define safe_halt() do { } while (0)
+#define trace_lock_release(x, y)
+#define trace_lock_acquire(a, b, c, d, e, f, g)
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/kallsyms.h b/tools/lib/lockdep/uinclude/linux/kallsyms.h
new file mode 100644
index 000000000000..b0f2dbdf1a15
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/kallsyms.h
@@ -0,0 +1,32 @@
+#ifndef _LIBLOCKDEP_LINUX_KALLSYMS_H_
+#define _LIBLOCKDEP_LINUX_KALLSYMS_H_
+#include <linux/kernel.h>
+#include <stdio.h>
+#define KSYM_NAME_LEN 128
+struct module;
+static inline const char *kallsyms_lookup(unsigned long addr,
+                                          unsigned long *symbolsize,
+                                          unsigned long *offset,
+                                          char **modname, char *namebuf)
+{
+        return NULL;
+}
+#include <execinfo.h>
+#include <stdlib.h>
+static inline void print_ip_sym(unsigned long ip)
+{
+        char **name;
+        name = backtrace_symbols((void **)&ip, 1);
+        printf("%s\n", *name);
+        free(name);
+}
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/kern_levels.h b/tools/lib/lockdep/uinclude/linux/kern_levels.h
new file mode 100644
index 000000000000..3b9bade28698
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/kern_levels.h
@@ -0,0 +1,25 @@
+#ifndef __KERN_LEVELS_H__
+#define __KERN_LEVELS_H__
+#define KERN_SOH        ""              /* ASCII Start Of Header */
+#define KERN_SOH_ASCII  ''
+#define KERN_EMERG      KERN_SOH ""     /* system is unusable */
+#define KERN_ALERT      KERN_SOH ""     /* action must be taken immediately */
+#define KERN_CRIT       KERN_SOH ""     /* critical conditions */
+#define KERN_ERR        KERN_SOH ""     /* error conditions */
+#define KERN_WARNING    KERN_SOH ""     /* warning conditions */
+#define KERN_NOTICE     KERN_SOH ""     /* normal but significant condition */
+#define KERN_INFO       KERN_SOH ""     /* informational */
+#define KERN_DEBUG      KERN_SOH ""     /* debug-level messages */
+#define KERN_DEFAULT    KERN_SOH ""     /* the default kernel loglevel */
+/*
+ * Annotation for a "continued" line of log printout (only done after a
+ * line that had no enclosing \n). Only to be used by core/arch code
+ * during early bootup (a continued line is not SMP-safe otherwise).
+ */
+#define KERN_CONT       ""
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/kernel.h b/tools/lib/lockdep/uinclude/linux/kernel.h
new file mode 100644
index 000000000000..a11e3c357be7
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/kernel.h
@@ -0,0 +1,44 @@
+#ifndef _LIBLOCKDEP_LINUX_KERNEL_H_
+#define _LIBLOCKDEP_LINUX_KERNEL_H_
+#include <linux/export.h>
+#include <linux/types.h>
+#include <linux/rcu.h>
+#include <linux/hardirq.h>
+#include <linux/kern_levels.h>
+#ifndef container_of
+#define container_of(ptr, type, member) ({                      \
+        const typeof(((type *)0)->member) * __mptr = (ptr);     \
+        (type *)((char *)__mptr - offsetof(type, member)); })
+#endif
+#define max(x, y) ({                            \
+        typeof(x) _max1 = (x);                  \
+        typeof(y) _max2 = (y);                  \
+        (void) (&_max1 == &_max2);              \
+        _max1 > _max2 ? _max1 : _max2; })
+#define BUILD_BUG_ON(condition) ((void)sizeof(char[1 - 2*!!(condition)]))
+#define WARN_ON(x) (x)
+#define WARN_ON_ONCE(x) (x)
+#define likely(x) (x)
+#define WARN(x, y, z) (x)
+#define uninitialized_var(x) x
+#define __init
+#define noinline
+#define list_add_tail_rcu list_add_tail
+#ifndef CALLER_ADDR0
+#define CALLER_ADDR0 ((unsigned long)__builtin_return_address(0))
+#endif
+#ifndef _RET_IP_
+#define _RET_IP_ CALLER_ADDR0
+#endif
+#ifndef _THIS_IP_
+#define _THIS_IP_ ({ __label__ __here; __here: (unsigned long)&&__here; })
+#endif
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/kmemcheck.h b/tools/lib/lockdep/uinclude/linux/kmemcheck.h
new file mode 100644
index 000000000000..94d598bc6abe
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/kmemcheck.h
@@ -0,0 +1,8 @@
+#ifndef _LIBLOCKDEP_LINUX_KMEMCHECK_H_
+#define _LIBLOCKDEP_LINUX_KMEMCHECK_H_
+static inline void kmemcheck_mark_initialized(void *address, unsigned int n)
+{
+}
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/linkage.h b/tools/lib/lockdep/uinclude/linux/linkage.h
new file mode 100644
index 000000000000..fab00ff936d1
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/linkage.h
@@ -0,0 +1,3 @@
+/* empty file */
diff --git a/tools/lib/lockdep/uinclude/linux/list.h b/tools/lib/lockdep/uinclude/linux/list.h
new file mode 100644
index 000000000000..6e9ef31ed82e
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/list.h
@@ -0,0 +1 @@
+#include "../../../include/linux/list.h"
diff --git a/tools/lib/lockdep/uinclude/linux/lockdep.h b/tools/lib/lockdep/uinclude/linux/lockdep.h
new file mode 100644
index 000000000000..d0f5d6e50214
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/lockdep.h
@@ -0,0 +1,55 @@
+#ifndef _LIBLOCKDEP_LOCKDEP_H_
+#define _LIBLOCKDEP_LOCKDEP_H_
+#include <sys/prctl.h>
+#include <sys/syscall.h>
+#include <string.h>
+#include <limits.h>
+#include <linux/utsname.h>
+#define MAX_LOCK_DEPTH 2000UL
+#include "../../../include/linux/lockdep.h"
+struct task_struct {
+        u64 curr_chain_key;
+        int lockdep_depth;
+        unsigned int lockdep_recursion;
+        struct held_lock held_locks[MAX_LOCK_DEPTH];
+        gfp_t lockdep_reclaim_gfp;
+        int pid;
+        char comm[17];
+};
+extern struct task_struct *__curr(void);
+#define current (__curr())
+#define debug_locks_off() 1
+#define task_pid_nr(tsk) ((tsk)->pid)
+#define KSYM_NAME_LEN 128
+#define printk printf
+#define list_del_rcu list_del
+#define atomic_t unsigned long
+#define atomic_inc(x) ((*(x))++)
+static struct new_utsname *init_utsname(void)
+{
+        static struct new_utsname n = (struct new_utsname) {
+                .release = "liblockdep",
+                .version = LIBLOCKDEP_VERSION,
+        };
+        return &n;
+}
+#define print_tainted() ""
+#define static_obj(x) 1
+#define debug_show_all_locks()
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/module.h b/tools/lib/lockdep/uinclude/linux/module.h
new file mode 100644
index 000000000000..09c7a7be8ccc
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/module.h
@@ -0,0 +1,6 @@
+#ifndef _LIBLOCKDEP_LINUX_MODULE_H_
+#define _LIBLOCKDEP_LINUX_MODULE_H_
+#define module_param(name, type, perm)
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/mutex.h b/tools/lib/lockdep/uinclude/linux/mutex.h
new file mode 100644
index 000000000000..fab00ff936d1
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/mutex.h
@@ -0,0 +1,3 @@
+/* empty file */
diff --git a/tools/lib/lockdep/uinclude/linux/poison.h b/tools/lib/lockdep/uinclude/linux/poison.h
new file mode 100644
index 000000000000..0c27bdf14233
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/poison.h
@@ -0,0 +1 @@
+#include "../../../include/linux/poison.h"
diff --git a/tools/lib/lockdep/uinclude/linux/prefetch.h b/tools/lib/lockdep/uinclude/linux/prefetch.h
new file mode 100644
index 000000000000..d73fe6f850ac
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/prefetch.h
@@ -0,0 +1,6 @@
+#ifndef _LIBLOCKDEP_LINUX_PREFETCH_H_
+#define _LIBLOCKDEP_LINUX_PREFETCH_H
+static inline void prefetch(void *a __attribute__((unused))) { }
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/proc_fs.h b/tools/lib/lockdep/uinclude/linux/proc_fs.h
new file mode 100644
index 000000000000..fab00ff936d1
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/proc_fs.h
@@ -0,0 +1,3 @@
+/* empty file */
diff --git a/tools/lib/lockdep/uinclude/linux/rbtree.h b/tools/lib/lockdep/uinclude/linux/rbtree.h
new file mode 100644
index 000000000000..965901db4862
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/rbtree.h
@@ -0,0 +1 @@
+#include "../../../include/linux/rbtree.h"
diff --git a/tools/lib/lockdep/uinclude/linux/rbtree_augmented.h b/tools/lib/lockdep/uinclude/linux/rbtree_augmented.h
new file mode 100644
index 000000000000..c3759477379c
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/rbtree_augmented.h
@@ -0,0 +1,2 @@
+#define __always_inline
+#include "../../../include/linux/rbtree_augmented.h"
diff --git a/tools/lib/lockdep/uinclude/linux/rcu.h b/tools/lib/lockdep/uinclude/linux/rcu.h
new file mode 100644
index 000000000000..4c99fcb5da27
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/rcu.h
@@ -0,0 +1,16 @@
+#ifndef _LIBLOCKDEP_RCU_H_
+#define _LIBLOCKDEP_RCU_H_
+int rcu_scheduler_active;
+static inline int rcu_lockdep_current_cpu_online(void)
+{
+        return 1;
+}
+static inline int rcu_is_cpu_idle(void)
+{
+        return 1;
+}
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/seq_file.h b/tools/lib/lockdep/uinclude/linux/seq_file.h
new file mode 100644
index 000000000000..fab00ff936d1
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/seq_file.h
@@ -0,0 +1,3 @@
+/* empty file */
diff --git a/tools/lib/lockdep/uinclude/linux/spinlock.h b/tools/lib/lockdep/uinclude/linux/spinlock.h
new file mode 100644
index 000000000000..68c1aa2bcba5
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/spinlock.h
@@ -0,0 +1,25 @@
+#ifndef _LIBLOCKDEP_SPINLOCK_H_
+#define _LIBLOCKDEP_SPINLOCK_H_
+#include <pthread.h>
+#include <stdbool.h>
+#define arch_spinlock_t pthread_mutex_t
+#define __ARCH_SPIN_LOCK_UNLOCKED PTHREAD_MUTEX_INITIALIZER
+static inline void arch_spin_lock(arch_spinlock_t *mutex)
+{
+        pthread_mutex_lock(mutex);
+}
+static inline void arch_spin_unlock(arch_spinlock_t *mutex)
+{
+        pthread_mutex_unlock(mutex);
+}
+static inline bool arch_spin_is_locked(arch_spinlock_t *mutex)
+{
+        return true;
+}
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/stacktrace.h b/tools/lib/lockdep/uinclude/linux/stacktrace.h
new file mode 100644
index 000000000000..39aecc6b19d1
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/stacktrace.h
@@ -0,0 +1,32 @@
+#ifndef _LIBLOCKDEP_LINUX_STACKTRACE_H_
+#define _LIBLOCKDEP_LINUX_STACKTRACE_H_
+#include <execinfo.h>
+struct stack_trace {
+        unsigned int nr_entries, max_entries;
+        unsigned long *entries;
+        int skip;
+};
+static inline void print_stack_trace(struct stack_trace *trace, int spaces)
+{
+        backtrace_symbols_fd((void **)trace->entries, trace->nr_entries, 1);
+}
+#define save_stack_trace(trace) \
+        ((trace)->nr_entries =  \
+                backtrace((void **)(trace)->entries, (trace)->max_entries))
+static inline int dump_stack(void)
+{
+        void *array[64];
+        size_t size;
+        size = backtrace(array, 64);
+        backtrace_symbols_fd(array, size, 1);
+        return 0;
+}
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/stringify.h b/tools/lib/lockdep/uinclude/linux/stringify.h
new file mode 100644
index 000000000000..05dfcd1ac118
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/stringify.h
@@ -0,0 +1,7 @@
+#ifndef _LIBLOCKDEP_LINUX_STRINGIFY_H_
+#define _LIBLOCKDEP_LINUX_STRINGIFY_H_
+#define __stringify_1(x...)     #x
+#define __stringify(x...)       __stringify_1(x)
+#endif
diff --git a/tools/lib/lockdep/uinclude/linux/types.h b/tools/lib/lockdep/uinclude/linux/types.h
new file mode 100644
index 000000000000..929938f426de
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/linux/types.h
@@ -0,0 +1,58 @@
+#ifndef _LIBLOCKDEP_LINUX_TYPES_H_
+#define _LIBLOCKDEP_LINUX_TYPES_H_
+#include <stdbool.h>
+#include <stddef.h>
+#define __SANE_USERSPACE_TYPES__        /* For PPC64, to get LL64 types */
+#include <asm/types.h>
+struct page;
+struct kmem_cache;
+typedef unsigned gfp_t;
+typedef __u64 u64;
+typedef __s64 s64;
+typedef __u32 u32;
+typedef __s32 s32;
+typedef __u16 u16;
+typedef __s16 s16;
+typedef __u8  u8;
+typedef __s8  s8;
+#ifdef __CHECKER__
+#define __bitwise__ __attribute__((bitwise))
+#else
+#define __bitwise__
+#endif
+#ifdef __CHECK_ENDIAN__
+#define __bitwise __bitwise__
+#else
+#define __bitwise
+#endif
+typedef __u16 __bitwise __le16;
+typedef __u16 __bitwise __be16;
+typedef __u32 __bitwise __le32;
+typedef __u32 __bitwise __be32;
+typedef __u64 __bitwise __le64;
+typedef __u64 __bitwise __be64;
+struct list_head {
+        struct list_head *next, *prev;
+};
+struct hlist_head {
+        struct hlist_node *first;
+};
+struct hlist_node {
+        struct hlist_node *next, **pprev;
+};
+#endif
diff --git a/tools/lib/lockdep/uinclude/trace/events/lock.h b/tools/lib/lockdep/uinclude/trace/events/lock.h
new file mode 100644
index 000000000000..fab00ff936d1
--- /dev/null
+++ b/tools/lib/lockdep/uinclude/trace/events/lock.h
@@ -0,0 +1,3 @@
+/* empty file */
diff --git a/tools/lib/symbol/kallsyms.c b/tools/lib/symbol/kallsyms.c
new file mode 100644
index 000000000000..18bc271a4bbc
--- /dev/null
+++ b/tools/lib/symbol/kallsyms.c
@@ -0,0 +1,58 @@
+#include "symbol/kallsyms.h"
+#include <stdio.h>
+#include <stdlib.h>
+int kallsyms__parse(const char *filename, void *arg,
+                    int (*process_symbol)(void *arg, const char *name,
+                                          char type, u64 start))
+{
+        char *line = NULL;
+        size_t n;
+        int err = -1;
+        FILE *file = fopen(filename, "r");
+        if (file == NULL)
+                goto out_failure;
+        err = 0;
+        while (!feof(file)) {
+                u64 start;
+                int line_len, len;
+                char symbol_type;
+                char *symbol_name;
+                line_len = getline(&line, &n, file);
+                if (line_len < 0 || !line)
+                        break;
+                line[--line_len] = '\0'; /* \n */
+                len = hex2u64(line, &start);
+                len++;
+                if (len + 2 >= line_len)
+                        continue;
+                symbol_type = line[len];
+                len += 2;
+                symbol_name = line + len;
+                len = line_len - len;
+                if (len >= KSYM_NAME_LEN) {
+                        err = -1;
+                        break;
+                }
+                err = process_symbol(arg, symbol_name, symbol_type, start);
+                if (err)
+                        break;
+        }
+        free(line);
+        fclose(file);
+        return err;
+out_failure:
+        return -1;
+}
diff --git a/tools/lib/symbol/kallsyms.h b/tools/lib/symbol/kallsyms.h
new file mode 100644
index 000000000000..6084f5e18b3c
--- /dev/null
+++ b/tools/lib/symbol/kallsyms.h
@@ -0,0 +1,24 @@
+#ifndef __TOOLS_KALLSYMS_H_
+#define __TOOLS_KALLSYMS_H_ 1
+#include <elf.h>
+#include <linux/ctype.h>
+#include <linux/types.h>
+#ifndef KSYM_NAME_LEN
+#define KSYM_NAME_LEN 256
+#endif
+static inline u8 kallsyms2elf_type(char type)
+{
+        if (type == 'W')
+                return STB_WEAK;
+        return isupper(type) ? STB_GLOBAL : STB_LOCAL;
+}
+int kallsyms__parse(const char *filename, void *arg,
+                    int (*process_symbol)(void *arg, const char *name,
+                                          char type, u64 start));
+#endif /* __TOOLS_KALLSYMS_H_ */
diff --git a/tools/lib/traceevent/Makefile b/tools/lib/traceevent/Makefile
index fc1502098595..56d52a33a3df 100644
--- a/tools/lib/traceevent/Makefile
+++ b/tools/lib/traceevent/Makefile
@@ -43,6 +43,32 @@ man_dir_SQ = '$(subst ','\'',$(man_dir))'
 export man_dir man_dir_SQ INSTALL
 export DESTDIR DESTDIR_SQ
+set_plugin_dir := 1
+# Set plugin_dir to preffered global plugin location
+# If we install under $HOME directory we go under
+# $(HOME)/.traceevent/plugins
+#
+# We dont set PLUGIN_DIR in case we install under $HOME
+# directory, because by default the code looks under:
+# $(HOME)/.traceevent/plugins by default.
+#
+ifeq ($(plugin_dir),)
+ifeq ($(prefix),$(HOME))
+override plugin_dir = $(HOME)/.traceevent/plugins
+set_plugin_dir := 0
+else
+override plugin_dir = $(prefix)/lib/traceevent/plugins
+endif
+endif
+ifeq ($(set_plugin_dir),1)
+PLUGIN_DIR = -DPLUGIN_DIR="$(DESTDIR)/$(plugin_dir)"
+PLUGIN_DIR_SQ = '$(subst ','\'',$(PLUGIN_DIR))'
+endif
+include $(if $(BUILD_SRC),$(BUILD_SRC)/)../../scripts/Makefile.include
 # copy a bit from Linux kbuild
 ifeq ("$(origin V)", "command line")
@@ -57,18 +83,13 @@ ifeq ("$(origin O)", "command line")
 endif
 ifeq ($(BUILD_SRC),)
-ifneq ($(BUILD_OUTPUT),)
+ifneq ($(OUTPUT),)
 define build_output
-        $(if $(VERBOSE:1=),@)+$(MAKE) -C $(BUILD_OUTPUT)        \
+  $(if $(VERBOSE:1=),@)+$(MAKE) -C $(OUTPUT) \
-        BUILD_SRC=$(CURDIR) -f $(CURDIR)/Makefile $1
+  BUILD_SRC=$(CURDIR)/ -f $(CURDIR)/Makefile $1
 endef
-saved-output := $(BUILD_OUTPUT)
-BUILD_OUTPUT := $(shell cd $(BUILD_OUTPUT) && /bin/pwd)
-$(if $(BUILD_OUTPUT),, \
-     $(error output directory "$(saved-output)" does not exist))
 all: sub-make
 $(MAKECMDGOALS): sub-make
@@ -80,7 +101,7 @@ sub-make: force
 # Leave processing to above invocation of make
 skip-makefile := 1
-endif # BUILD_OUTPUT
+endif # OUTPUT
 endif # BUILD_SRC
 # We process the rest of the Makefile if this is the final invocation of make
@@ -96,6 +117,7 @@ export prefix bindir src obj
 # Shell quotes
 bindir_SQ = $(subst ','\'',$(bindir))
 bindir_relative_SQ = $(subst ','\'',$(bindir_relative))
+plugin_dir_SQ = $(subst ','\'',$(plugin_dir))
 LIB_FILE = libtraceevent.a libtraceevent.so
@@ -114,7 +136,7 @@ export Q VERBOSE
 EVENT_PARSE_VERSION = $(EP_VERSION).$(EP_PATCHLEVEL).$(EP_EXTRAVERSION)
-INCLUDES = -I. $(CONFIG_INCLUDES)
+INCLUDES = -I. -I $(srctree)/../../include $(CONFIG_INCLUDES)
 # Set compile option CFLAGS if not set elsewhere
 CFLAGS ?= -g -Wall
@@ -125,41 +147,14 @@ override CFLAGS += $(udis86-flags) -D_GNU_SOURCE
 ifeq ($(VERBOSE),1)
  Q =
-  print_compile =
-  print_app_build =
-  print_fpic_compile =
-  print_shared_lib_compile =
-  print_plugin_obj_compile =
-  print_plugin_build =
-  print_install =
 else
  Q = @
-  print_compile =               echo '  CC       '$(OBJ);
-  print_app_build =             echo '  BUILD    '$(OBJ);
-  print_fpic_compile =          echo '  CC FPIC  '$(OBJ);
-  print_shared_lib_compile =    echo '  BUILD    SHARED LIB '$(OBJ);
-  print_plugin_obj_compile =    echo '  BUILD    PLUGIN OBJ '$(OBJ);
-  print_plugin_build =          echo '  BUILD    PLUGIN     '$(OBJ);
-  print_static_lib_build =      echo '  BUILD    STATIC LIB '$(OBJ);
-  print_install =               echo '  INSTALL  '$1'   to      $(DESTDIR_SQ)$2';
 endif
-do_fpic_compile =                                       \
-        ($(print_fpic_compile)                          \
-        $(CC) -c $(CFLAGS) $(EXT) -fPIC $< -o $@)
-do_app_build =                                          \
-        ($(print_app_build)                             \
-        $(CC) $^ -rdynamic -o $@ $(CONFIG_LIBS) $(LIBS))
 do_compile_shared_library =                     \
        ($(print_shared_lib_compile)            \
        $(CC) --shared $^ -o $@)
-do_compile_plugin_obj =                         \
-        ($(print_plugin_obj_compile)            \
-        $(CC) -c $(CFLAGS) -fPIC -o $@ $<)
 do_plugin_build =                               \
        ($(print_plugin_build)                  \
        $(CC) $(CFLAGS) -shared -nostartfiles -o $@ $<)
@@ -169,23 +164,37 @@ do_build_static_lib =				\
        $(RM) $@;  $(AR) rcs $@ $^)
-define do_compile
+do_compile = $(QUIET_CC)$(CC) -c $(CFLAGS) $(EXT) $< -o $(obj)/$@;
-        $(print_compile)                                                \
-        $(CC) -c $(CFLAGS) $(EXT) $< -o $(obj)/$@;
-endef
 $(obj)/%.o: $(src)/%.c
-        $(Q)$(call do_compile)
+        $(call do_compile)
 %.o: $(src)/%.c
-        $(Q)$(call do_compile)
+        $(call do_compile)
-PEVENT_LIB_OBJS = event-parse.o trace-seq.o parse-filter.o parse-utils.o
+PEVENT_LIB_OBJS  = event-parse.o
+PEVENT_LIB_OBJS += event-plugin.o
+PEVENT_LIB_OBJS += trace-seq.o
+PEVENT_LIB_OBJS += parse-filter.o
+PEVENT_LIB_OBJS += parse-utils.o
 PEVENT_LIB_OBJS += kbuffer-parse.o
-ALL_OBJS = $(PEVENT_LIB_OBJS)
+PLUGIN_OBJS  = plugin_jbd2.o
+PLUGIN_OBJS += plugin_hrtimer.o
+PLUGIN_OBJS += plugin_kmem.o
+PLUGIN_OBJS += plugin_kvm.o
+PLUGIN_OBJS += plugin_mac80211.o
+PLUGIN_OBJS += plugin_sched_switch.o
+PLUGIN_OBJS += plugin_function.o
+PLUGIN_OBJS += plugin_xen.o
+PLUGIN_OBJS += plugin_scsi.o
+PLUGIN_OBJS += plugin_cfg80211.o
+PLUGINS := $(PLUGIN_OBJS:.o=.so)
+ALL_OBJS = $(PEVENT_LIB_OBJS) $(PLUGIN_OBJS)
-CMD_TARGETS = $(LIB_FILE)
+CMD_TARGETS = $(LIB_FILE) $(PLUGINS)
 TARGETS = $(CMD_TARGETS)
@@ -195,32 +204,40 @@ all: all_cmd
 all_cmd: $(CMD_TARGETS)
 libtraceevent.so: $(PEVENT_LIB_OBJS)
-        $(Q)$(do_compile_shared_library)
+        $(QUIET_LINK)$(CC) --shared $^ -o $@
 libtraceevent.a: $(PEVENT_LIB_OBJS)
-        $(Q)$(do_build_static_lib)
+        $(QUIET_LINK)$(RM) $@; $(AR) rcs $@ $^
+plugins: $(PLUGINS)
 $(PEVENT_LIB_OBJS): %.o: $(src)/%.c TRACEEVENT-CFLAGS
-        $(Q)$(do_fpic_compile)
+        $(QUIET_CC_FPIC)$(CC) -c $(CFLAGS) $(EXT) -fPIC $< -o $@
+$(PLUGIN_OBJS): %.o : $(src)/%.c
+        $(QUIET_CC_FPIC)$(CC) -c $(CFLAGS) -fPIC -o $@ $<
+$(PLUGINS): %.so: %.o
+        $(QUIET_LINK)$(CC) $(CFLAGS) -shared -nostartfiles -o $@ $<
 define make_version.h
-        (echo '/* This file is automatically generated. Do not modify. */';             \
+  (echo '/* This file is automatically generated. Do not modify. */';           \
-        echo \#define VERSION_CODE $(shell                                              \
+   echo \#define VERSION_CODE $(shell                                           \
-        expr $(VERSION) \* 256 + $(PATCHLEVEL));                                        \
+   expr $(VERSION) \* 256 + $(PATCHLEVEL));                                     \
-        echo '#define EXTRAVERSION ' $(EXTRAVERSION);                                   \
+   echo '#define EXTRAVERSION ' $(EXTRAVERSION);                                \
-        echo '#define VERSION_STRING "'$(VERSION).$(PATCHLEVEL).$(EXTRAVERSION)'"';     \
+   echo '#define VERSION_STRING "'$(VERSION).$(PATCHLEVEL).$(EXTRAVERSION)'"';  \
-        echo '#define FILE_VERSION '$(FILE_VERSION);                                    \
+   echo '#define FILE_VERSION '$(FILE_VERSION);                                 \
-        ) > $1
+  ) > $1
 endef
 define update_version.h
-        ($(call make_version.h, $@.tmp);                \
+  ($(call make_version.h, $@.tmp);              \
-        if [ -r $@ ] && cmp -s $@ $@.tmp; then          \
+    if [ -r $@ ] && cmp -s $@ $@.tmp; then      \
-                rm -f $@.tmp;                           \
+      rm -f $@.tmp;                             \
-        else                                            \
+    else                                        \
-                echo '  UPDATE                 $@';     \
+      echo '  UPDATE                 $@';       \
-                mv -f $@.tmp $@;                        \
+      mv -f $@.tmp $@;                          \
-        fi);
+    fi);
 endef
 ep_version.h: force
@@ -229,13 +246,13 @@ ep_version.h: force
 VERSION_FILES = ep_version.h
 define update_dir
-        (echo $1 > $@.tmp;      \
+  (echo $1 > $@.tmp;                            \
-        if [ -r $@ ] && cmp -s $@ $@.tmp; then          \
+   if [ -r $@ ] && cmp -s $@ $@.tmp; then       \
-                rm -f $@.tmp;                           \
+     rm -f $@.tmp;                              \
-        else                                            \
+   else                                         \
-                echo '  UPDATE                 $@';     \
+     echo '  UPDATE                 $@';        \
-                mv -f $@.tmp $@;                        \
+     mv -f $@.tmp $@;                           \
-        fi);
+   fi);
 endef
 ## make deps
@@ -245,10 +262,10 @@ all_deps := $(all_objs:%.o=.%.d)
 # let .d file also depends on the source and header files
 define check_deps
-                @set -e; $(RM) $@; \
+  @set -e; $(RM) $@; \
-                $(CC) -MM $(CFLAGS) $< > $@.$$$$; \
+  $(CC) -MM $(CFLAGS) $< > $@.$$$$; \
-                sed 's,\($*\)\.o[ :]*,\1.o $@ : ,g' < $@.$$$$ > $@; \
+  sed 's,\($*\)\.o[ :]*,\1.o $@ : ,g' < $@.$$$$ > $@; \
-                $(RM) $@.$$$$
+  $(RM) $@.$$$$
 endef
 $(all_deps): .%.d: $(src)/%.c
@@ -283,27 +300,41 @@ TAGS:	force
        --regex='/_PE(\([^,)]*\).*/PEVENT_ERRNO__\1/'
 define do_install
-        $(print_install)                                \
        if [ ! -d '$(DESTDIR_SQ)$2' ]; then             \
                $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2'; \
        fi;                                             \
        $(INSTALL) $1 '$(DESTDIR_SQ)$2'
 endef
-install_lib: all_cmd
+define do_install_plugins
-        $(Q)$(call do_install,$(LIB_FILE),$(bindir_SQ))
+        for plugin in $1; do                            \
+          $(call do_install,$$plugin,$(plugin_dir_SQ)); \
+        done
+endef
+install_lib: all_cmd install_plugins
+        $(call QUIET_INSTALL, $(LIB_FILE)) \
+                $(call do_install,$(LIB_FILE),$(bindir_SQ))
+install_plugins: $(PLUGINS)
+        $(call QUIET_INSTALL, trace_plugins) \
+                $(call do_install_plugins, $(PLUGINS))
 install: install_lib
 clean:
-        $(RM) *.o *~ $(TARGETS) *.a *.so $(VERSION_FILES) .*.d
+        $(call QUIET_CLEAN, libtraceevent) \
-        $(RM) TRACEEVENT-CFLAGS tags TAGS
+                $(RM) *.o *~ $(TARGETS) *.a *.so $(VERSION_FILES) .*.d \
+                $(RM) TRACEEVENT-CFLAGS tags TAGS
 endif # skip-makefile
-PHONY += force
+PHONY += force plugins
 force:
+plugins:
+        @echo > /dev/null
 # Declare the contents of the .PHONY variable as phony.  We keep that
 # information in a variable so we can use it in if_changed and friends.
 .PHONY: $(PHONY)
diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
index 217c82ee3665..1587ea392ad6 100644
--- a/tools/lib/traceevent/event-parse.c
+++ b/tools/lib/traceevent/event-parse.c
@@ -2710,7 +2710,6 @@ process_func_handler(struct event_format *event, struct pevent_function_handler
        struct print_arg *farg;
        enum event_type type;
        char *token;
-        const char *test;
        int i;
        arg->type = PRINT_FUNC;
@@ -2727,15 +2726,19 @@ process_func_handler(struct event_format *event, struct pevent_function_handler
                }
                type = process_arg(event, farg, &token);
-                if (i < (func->nr_args - 1))
+                if (i < (func->nr_args - 1)) {
-                        test = ",";
+                        if (type != EVENT_DELIM || strcmp(token, ",") != 0) {
-                else
+                                warning("Error: function '%s()' expects %d arguments but event %s only uses %d",
-                        test = ")";
+                                        func->name, func->nr_args,
+                                        event->name, i + 1);
-                if (test_type_token(type, token, EVENT_DELIM, test)) {
+                                goto err;
-                        free_arg(farg);
+                        }
-                        free_token(token);
+                } else {
-                        return EVENT_ERROR;
+                        if (type != EVENT_DELIM || strcmp(token, ")") != 0) {
+                                warning("Error: function '%s()' only expects %d arguments but event %s has more",
+                                        func->name, func->nr_args, event->name);
+                                goto err;
+                        }
                }
                *next_arg = farg;
@@ -2747,6 +2750,11 @@ process_func_handler(struct event_format *event, struct pevent_function_handler
        *tok = token;
        return type;
+err:
+        free_arg(farg);
+        free_token(token);
+        return EVENT_ERROR;
 }
 static enum event_type
@@ -4099,6 +4107,7 @@ static void pretty_print(struct trace_seq *s, void *data, int size, struct event
        unsigned long long val;
        struct func_map *func;
        const char *saveptr;
+        struct trace_seq p;
        char *bprint_fmt = NULL;
        char format[32];
        int show_func;
@@ -4306,8 +4315,12 @@ static void pretty_print(struct trace_seq *s, void *data, int size, struct event
                                format[len] = 0;
                                if (!len_as_arg)
                                        len_arg = -1;
-                                print_str_arg(s, data, size, event,
+                                /* Use helper trace_seq */
+                                trace_seq_init(&p);
+                                print_str_arg(&p, data, size, event,
                                              format, len_arg, arg);
+                                trace_seq_terminate(&p);
+                                trace_seq_puts(s, p.buffer);
                                arg = arg->next;
                                break;
                        default:
@@ -5116,8 +5129,38 @@ enum pevent_errno __pevent_parse_format(struct event_format **eventp,
        return ret;
 }
+static enum pevent_errno
+__pevent_parse_event(struct pevent *pevent,
+                     struct event_format **eventp,
+                     const char *buf, unsigned long size,
+                     const char *sys)
+{
+        int ret = __pevent_parse_format(eventp, pevent, buf, size, sys);
+        struct event_format *event = *eventp;
+        if (event == NULL)
+                return ret;
+        if (pevent && add_event(pevent, event)) {
+                ret = PEVENT_ERRNO__MEM_ALLOC_FAILED;
+                goto event_add_failed;
+        }
+#define PRINT_ARGS 0
+        if (PRINT_ARGS && event->print_fmt.args)
+                print_args(event->print_fmt.args);
+        return 0;
+event_add_failed:
+        pevent_free_format(event);
+        return ret;
+}
 /**
 * pevent_parse_format - parse the event format
+ * @pevent: the handle to the pevent
+ * @eventp: returned format
 * @buf: the buffer storing the event format string
 * @size: the size of @buf
 * @sys: the system the event belongs to
@@ -5129,10 +5172,12 @@ enum pevent_errno __pevent_parse_format(struct event_format **eventp,
 *
 * /sys/kernel/debug/tracing/events/.../.../format
 */
-enum pevent_errno pevent_parse_format(struct event_format **eventp, const char *buf,
+enum pevent_errno pevent_parse_format(struct pevent *pevent,
+                                      struct event_format **eventp,
+                                      const char *buf,
                                      unsigned long size, const char *sys)
 {
-        return __pevent_parse_format(eventp, NULL, buf, size, sys);
+        return __pevent_parse_event(pevent, eventp, buf, size, sys);
 }
 /**
@@ -5153,25 +5198,7 @@ enum pevent_errno pevent_parse_event(struct pevent *pevent, const char *buf,
                                     unsigned long size, const char *sys)
 {
        struct event_format *event = NULL;
-        int ret = __pevent_parse_format(&event, pevent, buf, size, sys);
+        return __pevent_parse_event(pevent, &event, buf, size, sys);
-        if (event == NULL)
-                return ret;
-        if (add_event(pevent, event)) {
-                ret = PEVENT_ERRNO__MEM_ALLOC_FAILED;
-                goto event_add_failed;
-        }
-#define PRINT_ARGS 0
-        if (PRINT_ARGS && event->print_fmt.args)
-                print_args(event->print_fmt.args);
-        return 0;
-event_add_failed:
-        pevent_free_format(event);
-        return ret;
 }
 #undef _PE
@@ -5203,22 +5230,7 @@ int pevent_strerror(struct pevent *pevent __maybe_unused,
        idx = errnum - __PEVENT_ERRNO__START - 1;
        msg = pevent_error_str[idx];
+        snprintf(buf, buflen, "%s", msg);
-        switch (errnum) {
-        case PEVENT_ERRNO__MEM_ALLOC_FAILED:
-        case PEVENT_ERRNO__PARSE_EVENT_FAILED:
-        case PEVENT_ERRNO__READ_ID_FAILED:
-        case PEVENT_ERRNO__READ_FORMAT_FAILED:
-        case PEVENT_ERRNO__READ_PRINT_FAILED:
-        case PEVENT_ERRNO__OLD_FTRACE_ARG_FAILED:
-        case PEVENT_ERRNO__INVALID_ARG_TYPE:
-                snprintf(buf, buflen, "%s", msg);
-                break;
-        default:
-                /* cannot reach here */
-                break;
-        }
        return 0;
 }
@@ -5549,6 +5561,52 @@ int pevent_register_print_function(struct pevent *pevent,
 }
 /**
+ * pevent_unregister_print_function - unregister a helper function
+ * @pevent: the handle to the pevent
+ * @func: the function to process the helper function
+ * @name: the name of the helper function
+ *
+ * This function removes existing print handler for function @name.
+ *
+ * Returns 0 if the handler was removed successully, -1 otherwise.
+ */
+int pevent_unregister_print_function(struct pevent *pevent,
+                                     pevent_func_handler func, char *name)
+{
+        struct pevent_function_handler *func_handle;
+        func_handle = find_func_handler(pevent, name);
+        if (func_handle && func_handle->func == func) {
+                remove_func_handler(pevent, name);
+                return 0;
+        }
+        return -1;
+}
+static struct event_format *pevent_search_event(struct pevent *pevent, int id,
+                                                const char *sys_name,
+                                                const char *event_name)
+{
+        struct event_format *event;
+        if (id >= 0) {
+                /* search by id */
+                event = pevent_find_event(pevent, id);
+                if (!event)
+                        return NULL;
+                if (event_name && (strcmp(event_name, event->name) != 0))
+                        return NULL;
+                if (sys_name && (strcmp(sys_name, event->system) != 0))
+                        return NULL;
+        } else {
+                event = pevent_find_event_by_name(pevent, sys_name, event_name);
+                if (!event)
+                        return NULL;
+        }
+        return event;
+}
+/**
 * pevent_register_event_handler - register a way to parse an event
 * @pevent: the handle to the pevent
 * @id: the id of the event to register
@@ -5572,20 +5630,9 @@ int pevent_register_event_handler(struct pevent *pevent, int id,
        struct event_format *event;
        struct event_handler *handle;
-        if (id >= 0) {
+        event = pevent_search_event(pevent, id, sys_name, event_name);
-                /* search by id */
+        if (event == NULL)
-                event = pevent_find_event(pevent, id);
+                goto not_found;
-                if (!event)
-                        goto not_found;
-                if (event_name && (strcmp(event_name, event->name) != 0))
-                        goto not_found;
-                if (sys_name && (strcmp(sys_name, event->system) != 0))
-                        goto not_found;
-        } else {
-                event = pevent_find_event_by_name(pevent, sys_name, event_name);
-                if (!event)
-                        goto not_found;
-        }
        pr_stat("overriding event (%d) %s:%s with new print handler",
                event->id, event->system, event->name);
@@ -5625,6 +5672,79 @@ int pevent_register_event_handler(struct pevent *pevent, int id,
        return -1;
 }
+static int handle_matches(struct event_handler *handler, int id,
+                          const char *sys_name, const char *event_name,
+                          pevent_event_handler_func func, void *context)
+{
+        if (id >= 0 && id != handler->id)
+                return 0;
+        if (event_name && (strcmp(event_name, handler->event_name) != 0))
+                return 0;
+        if (sys_name && (strcmp(sys_name, handler->sys_name) != 0))
+                return 0;
+        if (func != handler->func || context != handler->context)
+                return 0;
+        return 1;
+}
+/**
+ * pevent_unregister_event_handler - unregister an existing event handler
+ * @pevent: the handle to the pevent
+ * @id: the id of the event to unregister
+ * @sys_name: the system name the handler belongs to
+ * @event_name: the name of the event handler
+ * @func: the function to call to parse the event information
+ * @context: the data to be passed to @func
+ *
+ * This function removes existing event handler (parser).
+ *
+ * If @id is >= 0, then it is used to find the event.
+ * else @sys_name and @event_name are used.
+ *
+ * Returns 0 if handler was removed successfully, -1 if event was not found.
+ */
+int pevent_unregister_event_handler(struct pevent *pevent, int id,
+                                    const char *sys_name, const char *event_name,
+                                    pevent_event_handler_func func, void *context)
+{
+        struct event_format *event;
+        struct event_handler *handle;
+        struct event_handler **next;
+        event = pevent_search_event(pevent, id, sys_name, event_name);
+        if (event == NULL)
+                goto not_found;
+        if (event->handler == func && event->context == context) {
+                pr_stat("removing override handler for event (%d) %s:%s. Going back to default handler.",
+                        event->id, event->system, event->name);
+                event->handler = NULL;
+                event->context = NULL;
+                return 0;
+        }
+not_found:
+        for (next = &pevent->handlers; *next; next = &(*next)->next) {
+                handle = *next;
+                if (handle_matches(handle, id, sys_name, event_name,
+                                   func, context))
+                        break;
+        }
+        if (!(*next))
+                return -1;
+        *next = handle->next;
+        free_handler(handle);
+        return 0;
+}
 /**
 * pevent_alloc - create a pevent handle
 */
diff --git a/tools/lib/traceevent/event-parse.h b/tools/lib/traceevent/event-parse.h
index 8d73d2594f65..791c539374c7 100644
--- a/tools/lib/traceevent/event-parse.h
+++ b/tools/lib/traceevent/event-parse.h
@@ -23,6 +23,7 @@
 #include <stdbool.h>
 #include <stdarg.h>
 #include <regex.h>
+#include <string.h>
 #ifndef __maybe_unused
 #define __maybe_unused __attribute__((unused))
@@ -57,6 +58,12 @@ struct pevent_record {
 #endif
 };
+enum trace_seq_fail {
+        TRACE_SEQ__GOOD,
+        TRACE_SEQ__BUFFER_POISONED,
+        TRACE_SEQ__MEM_ALLOC_FAILED,
+};
 /*
 * Trace sequences are used to allow a function to call several other functions
 * to create a string of data to use (up to a max of PAGE_SIZE).
@@ -67,6 +74,7 @@ struct trace_seq {
        unsigned int            buffer_size;
        unsigned int            len;
        unsigned int            readpos;
+        enum trace_seq_fail     state;
 };
 void trace_seq_init(struct trace_seq *s);
@@ -97,7 +105,7 @@ typedef int (*pevent_event_handler_func)(struct trace_seq *s,
                                         void *context);
 typedef int (*pevent_plugin_load_func)(struct pevent *pevent);
-typedef int (*pevent_plugin_unload_func)(void);
+typedef int (*pevent_plugin_unload_func)(struct pevent *pevent);
 struct plugin_option {
        struct plugin_option            *next;
@@ -122,7 +130,7 @@ struct plugin_option {
 * PEVENT_PLUGIN_UNLOADER:  (optional)
 *   The function called just before unloading
 *
- *   int PEVENT_PLUGIN_UNLOADER(void)
+ *   int PEVENT_PLUGIN_UNLOADER(struct pevent *pevent)
 *
 * PEVENT_PLUGIN_OPTIONS:  (optional)
 *   Plugin options that can be set before loading
@@ -355,12 +363,35 @@ enum pevent_flag {
        _PE(READ_FORMAT_FAILED, "failed to read event format"),               \
        _PE(READ_PRINT_FAILED,  "failed to read event print fmt"),            \
        _PE(OLD_FTRACE_ARG_FAILED,"failed to allocate field name for ftrace"),\
-        _PE(INVALID_ARG_TYPE,   "invalid argument type")
+        _PE(INVALID_ARG_TYPE,   "invalid argument type"),                     \
+        _PE(INVALID_EXP_TYPE,   "invalid expression type"),                   \
+        _PE(INVALID_OP_TYPE,    "invalid operator type"),                     \
+        _PE(INVALID_EVENT_NAME, "invalid event name"),                        \
+        _PE(EVENT_NOT_FOUND,    "no event found"),                            \
+        _PE(SYNTAX_ERROR,       "syntax error"),                              \
+        _PE(ILLEGAL_RVALUE,     "illegal rvalue"),                            \
+        _PE(ILLEGAL_LVALUE,     "illegal lvalue for string comparison"),      \
+        _PE(INVALID_REGEX,      "regex did not compute"),                     \
+        _PE(ILLEGAL_STRING_CMP, "illegal comparison for string"),             \
+        _PE(ILLEGAL_INTEGER_CMP,"illegal comparison for integer"),            \
+        _PE(REPARENT_NOT_OP,    "cannot reparent other than OP"),             \
+        _PE(REPARENT_FAILED,    "failed to reparent filter OP"),              \
+        _PE(BAD_FILTER_ARG,     "bad arg in filter tree"),                    \
+        _PE(UNEXPECTED_TYPE,    "unexpected type (not a value)"),             \
+        _PE(ILLEGAL_TOKEN,      "illegal token"),                             \
+        _PE(INVALID_PAREN,      "open parenthesis cannot come here"),         \
+        _PE(UNBALANCED_PAREN,   "unbalanced number of parenthesis"),          \
+        _PE(UNKNOWN_TOKEN,      "unknown token"),                             \
+        _PE(FILTER_NOT_FOUND,   "no filter found"),                           \
+        _PE(NOT_A_NUMBER,       "must have number field"),                    \
+        _PE(NO_FILTER,          "no filters exists"),                         \
+        _PE(FILTER_MISS,        "record does not match to filter")
 #undef _PE
 #define _PE(__code, __str) PEVENT_ERRNO__ ## __code
 enum pevent_errno {
        PEVENT_ERRNO__SUCCESS                   = 0,
+        PEVENT_ERRNO__FILTER_MATCH              = PEVENT_ERRNO__SUCCESS,
        /*
         * Choose an arbitrary negative big number not to clash with standard
@@ -377,6 +408,12 @@ enum pevent_errno {
 };
 #undef _PE
+struct plugin_list;
+struct plugin_list *traceevent_load_plugins(struct pevent *pevent);
+void traceevent_unload_plugins(struct plugin_list *plugin_list,
+                               struct pevent *pevent);
 struct cmdline;
 struct cmdline_list;
 struct func_map;
@@ -522,6 +559,15 @@ __data2host8(struct pevent *pevent, unsigned long long data)
        __data2host8(pevent, __val);                            \
 })
+static inline int traceevent_host_bigendian(void)
+{
+        unsigned char str[] = { 0x1, 0x2, 0x3, 0x4 };
+        unsigned int val;
+        memcpy(&val, str, 4);
+        return val == 0x01020304;
+}
 /* taken from kernel/trace/trace.h */
 enum trace_flag_type {
        TRACE_FLAG_IRQS_OFF             = 0x01,
@@ -547,7 +593,9 @@ int pevent_parse_header_page(struct pevent *pevent, char *buf, unsigned long siz
 enum pevent_errno pevent_parse_event(struct pevent *pevent, const char *buf,
                                     unsigned long size, const char *sys);
-enum pevent_errno pevent_parse_format(struct event_format **eventp, const char *buf,
+enum pevent_errno pevent_parse_format(struct pevent *pevent,
+                                      struct event_format **eventp,
+                                      const char *buf,
                                      unsigned long size, const char *sys);
 void pevent_free_format(struct event_format *event);
@@ -576,10 +624,15 @@ int pevent_print_func_field(struct trace_seq *s, const char *fmt,
 int pevent_register_event_handler(struct pevent *pevent, int id,
                                  const char *sys_name, const char *event_name,
                                  pevent_event_handler_func func, void *context);
+int pevent_unregister_event_handler(struct pevent *pevent, int id,
+                                    const char *sys_name, const char *event_name,
+                                    pevent_event_handler_func func, void *context);
 int pevent_register_print_function(struct pevent *pevent,
                                   pevent_func_handler func,
                                   enum pevent_func_arg_type ret_type,
                                   char *name, ...);
+int pevent_unregister_print_function(struct pevent *pevent,
+                                     pevent_func_handler func, char *name);
 struct format_field *pevent_find_common_field(struct event_format *event, const char *name);
 struct format_field *pevent_find_field(struct event_format *event, const char *name);
@@ -811,18 +864,22 @@ struct filter_type {
        struct filter_arg       *filter;
 };
+#define PEVENT_FILTER_ERROR_BUFSZ  1024
 struct event_filter {
        struct pevent           *pevent;
        int                     filters;
        struct filter_type      *event_filters;
+        char                    error_buffer[PEVENT_FILTER_ERROR_BUFSZ];
 };
 struct event_filter *pevent_filter_alloc(struct pevent *pevent);
-#define FILTER_NONE             -2
+/* for backward compatibility */
-#define FILTER_NOEXIST          -1
+#define FILTER_NONE             PEVENT_ERRNO__FILTER_NOT_FOUND
-#define FILTER_MISS             0
+#define FILTER_NOEXIST          PEVENT_ERRNO__NO_FILTER
-#define FILTER_MATCH            1
+#define FILTER_MISS             PEVENT_ERRNO__FILTER_MISS
+#define FILTER_MATCH            PEVENT_ERRNO__FILTER_MATCH
 enum filter_trivial_type {
        FILTER_TRIVIAL_FALSE,
@@ -830,20 +887,21 @@ enum filter_trivial_type {
        FILTER_TRIVIAL_BOTH,
 };
-int pevent_filter_add_filter_str(struct event_filter *filter,
+enum pevent_errno pevent_filter_add_filter_str(struct event_filter *filter,
-                                 const char *filter_str,
+                                               const char *filter_str);
-                                 char **error_str);
+enum pevent_errno pevent_filter_match(struct event_filter *filter,
+                                      struct pevent_record *record);
-int pevent_filter_match(struct event_filter *filter,
+int pevent_filter_strerror(struct event_filter *filter, enum pevent_errno err,
-                        struct pevent_record *record);
+                           char *buf, size_t buflen);
 int pevent_event_filtered(struct event_filter *filter,
                          int event_id);
 void pevent_filter_reset(struct event_filter *filter);
-void pevent_filter_clear_trivial(struct event_filter *filter,
+int pevent_filter_clear_trivial(struct event_filter *filter,
                                 enum filter_trivial_type type);
 void pevent_filter_free(struct event_filter *filter);
diff --git a/tools/lib/traceevent/event-plugin.c b/tools/lib/traceevent/event-plugin.c
new file mode 100644
index 000000000000..0c8bf6780e4d
--- /dev/null
+++ b/tools/lib/traceevent/event-plugin.c
@@ -0,0 +1,215 @@
+/*
+ * Copyright (C) 2009, 2010 Red Hat Inc, Steven Rostedt <srostedt@redhat.com>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation;
+ * version 2.1 of the License (not later!)
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not,  see <http://www.gnu.org/licenses>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+#include <string.h>
+#include <dlfcn.h>
+#include <stdlib.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <unistd.h>
+#include <dirent.h>
+#include "event-parse.h"
+#include "event-utils.h"
+#define LOCAL_PLUGIN_DIR ".traceevent/plugins"
+struct plugin_list {
+        struct plugin_list      *next;
+        char                    *name;
+        void                    *handle;
+};
+static void
+load_plugin(struct pevent *pevent, const char *path,
+            const char *file, void *data)
+{
+        struct plugin_list **plugin_list = data;
+        pevent_plugin_load_func func;
+        struct plugin_list *list;
+        const char *alias;
+        char *plugin;
+        void *handle;
+        plugin = malloc(strlen(path) + strlen(file) + 2);
+        if (!plugin) {
+                warning("could not allocate plugin memory\n");
+                return;
+        }
+        strcpy(plugin, path);
+        strcat(plugin, "/");
+        strcat(plugin, file);
+        handle = dlopen(plugin, RTLD_NOW | RTLD_GLOBAL);
+        if (!handle) {
+                warning("could not load plugin '%s'\n%s\n",
+                        plugin, dlerror());
+                goto out_free;
+        }
+        alias = dlsym(handle, PEVENT_PLUGIN_ALIAS_NAME);
+        if (!alias)
+                alias = file;
+        func = dlsym(handle, PEVENT_PLUGIN_LOADER_NAME);
+        if (!func) {
+                warning("could not find func '%s' in plugin '%s'\n%s\n",
+                        PEVENT_PLUGIN_LOADER_NAME, plugin, dlerror());
+                goto out_free;
+        }
+        list = malloc(sizeof(*list));
+        if (!list) {
+                warning("could not allocate plugin memory\n");
+                goto out_free;
+        }
+        list->next = *plugin_list;
+        list->handle = handle;
+        list->name = plugin;
+        *plugin_list = list;
+        pr_stat("registering plugin: %s", plugin);
+        func(pevent);
+        return;
+ out_free:
+        free(plugin);
+}
+static void
+load_plugins_dir(struct pevent *pevent, const char *suffix,
+                 const char *path,
+                 void (*load_plugin)(struct pevent *pevent,
+                                     const char *path,
+                                     const char *name,
+                                     void *data),
+                 void *data)
+{
+        struct dirent *dent;
+        struct stat st;
+        DIR *dir;
+        int ret;
+        ret = stat(path, &st);
+        if (ret < 0)
+                return;
+        if (!S_ISDIR(st.st_mode))
+                return;
+        dir = opendir(path);
+        if (!dir)
+                return;
+        while ((dent = readdir(dir))) {
+                const char *name = dent->d_name;
+                if (strcmp(name, ".") == 0 ||
+                    strcmp(name, "..") == 0)
+                        continue;
+                /* Only load plugins that end in suffix */
+                if (strcmp(name + (strlen(name) - strlen(suffix)), suffix) != 0)
+                        continue;
+                load_plugin(pevent, path, name, data);
+        }
+        closedir(dir);
+}
+static void
+load_plugins(struct pevent *pevent, const char *suffix,
+             void (*load_plugin)(struct pevent *pevent,
+                                 const char *path,
+                                 const char *name,
+                                 void *data),
+             void *data)
+{
+        char *home;
+        char *path;
+        char *envdir;
+        /*
+         * If a system plugin directory was defined,
+         * check that first.
+         */
+#ifdef PLUGIN_DIR
+        load_plugins_dir(pevent, suffix, PLUGIN_DIR, load_plugin, data);
+#endif
+        /*
+         * Next let the environment-set plugin directory
+         * override the system defaults.
+         */
+        envdir = getenv("TRACEEVENT_PLUGIN_DIR");
+        if (envdir)
+                load_plugins_dir(pevent, suffix, envdir, load_plugin, data);
+        /*
+         * Now let the home directory override the environment
+         * or system defaults.
+         */
+        home = getenv("HOME");
+        if (!home)
+                return;
+        path = malloc(strlen(home) + strlen(LOCAL_PLUGIN_DIR) + 2);
+        if (!path) {
+                warning("could not allocate plugin memory\n");
+                return;
+        }
+        strcpy(path, home);
+        strcat(path, "/");
+        strcat(path, LOCAL_PLUGIN_DIR);
+        load_plugins_dir(pevent, suffix, path, load_plugin, data);
+        free(path);
+}
+struct plugin_list*
+traceevent_load_plugins(struct pevent *pevent)
+{
+        struct plugin_list *list = NULL;
+        load_plugins(pevent, ".so", load_plugin, &list);
+        return list;
+}
+void
+traceevent_unload_plugins(struct plugin_list *plugin_list, struct pevent *pevent)
+{
+        pevent_plugin_unload_func func;
+        struct plugin_list *list;
+        while (plugin_list) {
+                list = plugin_list;
+                plugin_list = list->next;
+                func = dlsym(list->handle, PEVENT_PLUGIN_UNLOADER_NAME);
+                if (func)
+                        func(pevent);
+                dlclose(list->handle);
+                free(list->name);
+                free(list);
+        }
+}
diff --git a/tools/lib/traceevent/event-utils.h b/tools/lib/traceevent/event-utils.h
index e76c9acb92cd..d1dc2170e402 100644
--- a/tools/lib/traceevent/event-utils.h
+++ b/tools/lib/traceevent/event-utils.h
@@ -23,18 +23,14 @@
 #include <ctype.h>
 /* Can be overridden */
-void die(const char *fmt, ...);
-void *malloc_or_die(unsigned int size);
 void warning(const char *fmt, ...);
 void pr_stat(const char *fmt, ...);
 void vpr_stat(const char *fmt, va_list ap);
 /* Always available */
-void __die(const char *fmt, ...);
 void __warning(const char *fmt, ...);
 void __pr_stat(const char *fmt, ...);
-void __vdie(const char *fmt, ...);
 void __vwarning(const char *fmt, ...);
 void __vpr_stat(const char *fmt, ...);
diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c
index 2500e75583fc..b50234402fc2 100644
--- a/tools/lib/traceevent/parse-filter.c
+++ b/tools/lib/traceevent/parse-filter.c
@@ -38,41 +38,31 @@ struct event_list {
        struct event_format     *event;
 };
-#define MAX_ERR_STR_SIZE 256
+static void show_error(char *error_buf, const char *fmt, ...)
-static void show_error(char **error_str, const char *fmt, ...)
 {
        unsigned long long index;
        const char *input;
-        char *error;
        va_list ap;
        int len;
        int i;
-        if (!error_str)
-                return;
        input = pevent_get_input_buf();
        index = pevent_get_input_buf_ptr();
        len = input ? strlen(input) : 0;
-        error = malloc_or_die(MAX_ERR_STR_SIZE + (len*2) + 3);
        if (len) {
-                strcpy(error, input);
+                strcpy(error_buf, input);
-                error[len] = '\n';
+                error_buf[len] = '\n';
                for (i = 1; i < len && i < index; i++)
-                        error[len+i] = ' ';
+                        error_buf[len+i] = ' ';
-                error[len + i] = '^';
+                error_buf[len + i] = '^';
-                error[len + i + 1] = '\n';
+                error_buf[len + i + 1] = '\n';
                len += i+2;
        }
        va_start(ap, fmt);
-        vsnprintf(error + len, MAX_ERR_STR_SIZE, fmt, ap);
+        vsnprintf(error_buf + len, PEVENT_FILTER_ERROR_BUFSZ - len, fmt, ap);
        va_end(ap);
-        *error_str = error;
 }
 static void free_token(char *token)
@@ -95,7 +85,11 @@ static enum event_type read_token(char **tok)
            (strcmp(token, "=") == 0 || strcmp(token, "!") == 0) &&
            pevent_peek_char() == '~') {
                /* append it */
-                *tok = malloc_or_die(3);
+                *tok = malloc(3);
+                if (*tok == NULL) {
+                        free_token(token);
+                        return EVENT_ERROR;
+                }
                sprintf(*tok, "%c%c", *token, '~');
                free_token(token);
                /* Now remove the '~' from the buffer */
@@ -147,11 +141,13 @@ add_filter_type(struct event_filter *filter, int id)
        if (filter_type)
                return filter_type;
-        filter->event_filters = realloc(filter->event_filters,
+        filter_type = realloc(filter->event_filters,
-                                        sizeof(*filter->event_filters) *
+                              sizeof(*filter->event_filters) *
-                                        (filter->filters + 1));
+                              (filter->filters + 1));
-        if (!filter->event_filters)
+        if (!filter_type)
-                die("Could not allocate filter");
+                return NULL;
+        filter->event_filters = filter_type;
        for (i = 0; i < filter->filters; i++) {
                if (filter->event_filters[i].event_id > id)
@@ -182,7 +178,10 @@ struct event_filter *pevent_filter_alloc(struct pevent *pevent)
 {
        struct event_filter *filter;
-        filter = malloc_or_die(sizeof(*filter));
+        filter = malloc(sizeof(*filter));
+        if (filter == NULL)
+                return NULL;
        memset(filter, 0, sizeof(*filter));
        filter->pevent = pevent;
        pevent_ref(pevent);
@@ -192,12 +191,7 @@ struct event_filter *pevent_filter_alloc(struct pevent *pevent)
 static struct filter_arg *allocate_arg(void)
 {
-        struct filter_arg *arg;
+        return calloc(1, sizeof(struct filter_arg));
-        arg = malloc_or_die(sizeof(*arg));
-        memset(arg, 0, sizeof(*arg));
-        return arg;
 }
 static void free_arg(struct filter_arg *arg)
@@ -242,15 +236,19 @@ static void free_arg(struct filter_arg *arg)
        free(arg);
 }
-static void add_event(struct event_list **events,
+static int add_event(struct event_list **events,
                      struct event_format *event)
 {
        struct event_list *list;
-        list = malloc_or_die(sizeof(*list));
+        list = malloc(sizeof(*list));
+        if (list == NULL)
+                return -1;
        list->next = *events;
        *events = list;
        list->event = event;
+        return 0;
 }
 static int event_match(struct event_format *event,
@@ -265,7 +263,7 @@ static int event_match(struct event_format *event,
                !regexec(ereg, event->name, 0, NULL, 0);
 }
-static int
+static enum pevent_errno
 find_event(struct pevent *pevent, struct event_list **events,
           char *sys_name, char *event_name)
 {
@@ -273,6 +271,7 @@ find_event(struct pevent *pevent, struct event_list **events,
        regex_t ereg;
        regex_t sreg;
        int match = 0;
+        int fail = 0;
        char *reg;
        int ret;
        int i;
@@ -283,23 +282,31 @@ find_event(struct pevent *pevent, struct event_list **events,
                sys_name = NULL;
        }
-        reg = malloc_or_die(strlen(event_name) + 3);
+        reg = malloc(strlen(event_name) + 3);
+        if (reg == NULL)
+                return PEVENT_ERRNO__MEM_ALLOC_FAILED;
        sprintf(reg, "^%s$", event_name);
        ret = regcomp(&ereg, reg, REG_ICASE|REG_NOSUB);
        free(reg);
        if (ret)
-                return -1;
+                return PEVENT_ERRNO__INVALID_EVENT_NAME;
        if (sys_name) {
-                reg = malloc_or_die(strlen(sys_name) + 3);
+                reg = malloc(strlen(sys_name) + 3);
+                if (reg == NULL) {
+                        regfree(&ereg);
+                        return PEVENT_ERRNO__MEM_ALLOC_FAILED;
+                }
                sprintf(reg, "^%s$", sys_name);
                ret = regcomp(&sreg, reg, REG_ICASE|REG_NOSUB);
                free(reg);
                if (ret) {
                        regfree(&ereg);
-                        return -1;
+                        return PEVENT_ERRNO__INVALID_EVENT_NAME;
                }
        }
@@ -307,7 +314,10 @@ find_event(struct pevent *pevent, struct event_list **events,
                event = pevent->events[i];
                if (event_match(event, sys_name ? &sreg : NULL, &ereg)) {
                        match = 1;
-                        add_event(events, event);
+                        if (add_event(events, event) < 0) {
+                                fail = 1;
+                                break;
+                        }
                }
        }
@@ -316,7 +326,9 @@ find_event(struct pevent *pevent, struct event_list **events,
                regfree(&sreg);
        if (!match)
-                return -1;
+                return PEVENT_ERRNO__EVENT_NOT_FOUND;
+        if (fail)
+                return PEVENT_ERRNO__MEM_ALLOC_FAILED;
        return 0;
 }
@@ -332,14 +344,18 @@ static void free_events(struct event_list *events)
        }
 }
-static struct filter_arg *
+static enum pevent_errno
 create_arg_item(struct event_format *event, const char *token,
-                enum event_type type, char **error_str)
+                enum event_type type, struct filter_arg **parg, char *error_str)
 {
        struct format_field *field;
        struct filter_arg *arg;
        arg = allocate_arg();
+        if (arg == NULL) {
+                show_error(error_str, "failed to allocate filter arg");
+                return PEVENT_ERRNO__MEM_ALLOC_FAILED;
+        }
        switch (type) {
@@ -349,8 +365,11 @@ create_arg_item(struct event_format *event, const char *token,
                arg->value.type =
                        type == EVENT_DQUOTE ? FILTER_STRING : FILTER_CHAR;
                arg->value.str = strdup(token);
-                if (!arg->value.str)
+                if (!arg->value.str) {
-                        die("malloc string");
+                        free_arg(arg);
+                        show_error(error_str, "failed to allocate string filter arg");
+                        return PEVENT_ERRNO__MEM_ALLOC_FAILED;
+                }
                break;
        case EVENT_ITEM:
                /* if it is a number, then convert it */
@@ -377,11 +396,11 @@ create_arg_item(struct event_format *event, const char *token,
                break;
        default:
                free_arg(arg);
-                show_error(error_str, "expected a value but found %s",
+                show_error(error_str, "expected a value but found %s", token);
-                           token);
+                return PEVENT_ERRNO__UNEXPECTED_TYPE;
-                return NULL;
        }
-        return arg;
+        *parg = arg;
+        return 0;
 }
 static struct filter_arg *
@@ -390,6 +409,9 @@ create_arg_op(enum filter_op_type btype)
        struct filter_arg *arg;
        arg = allocate_arg();
+        if (!arg)
+                return NULL;
        arg->type = FILTER_ARG_OP;
        arg->op.type = btype;
@@ -402,6 +424,9 @@ create_arg_exp(enum filter_exp_type etype)
        struct filter_arg *arg;
        arg = allocate_arg();
+        if (!arg)
+                return NULL;
        arg->type = FILTER_ARG_EXP;
        arg->op.type = etype;
@@ -414,6 +439,9 @@ create_arg_cmp(enum filter_exp_type etype)
        struct filter_arg *arg;
        arg = allocate_arg();
+        if (!arg)
+                return NULL;
        /* Use NUM and change if necessary */
        arg->type = FILTER_ARG_NUM;
        arg->op.type = etype;
@@ -421,8 +449,8 @@ create_arg_cmp(enum filter_exp_type etype)
        return arg;
 }
-static int add_right(struct filter_arg *op, struct filter_arg *arg,
+static enum pevent_errno
-                     char **error_str)
+add_right(struct filter_arg *op, struct filter_arg *arg, char *error_str)
 {
        struct filter_arg *left;
        char *str;
@@ -453,9 +481,8 @@ static int add_right(struct filter_arg *op, struct filter_arg *arg,
                case FILTER_ARG_FIELD:
                        break;
                default:
-                        show_error(error_str,
+                        show_error(error_str, "Illegal rvalue");
-                                   "Illegal rvalue");
+                        return PEVENT_ERRNO__ILLEGAL_RVALUE;
-                        return -1;
                }
                /*
@@ -502,7 +529,7 @@ static int add_right(struct filter_arg *op, struct filter_arg *arg,
                        if (left->type != FILTER_ARG_FIELD) {
                                show_error(error_str,
                                           "Illegal lvalue for string comparison");
-                                return -1;
+                                return PEVENT_ERRNO__ILLEGAL_LVALUE;
                        }
                        /* Make sure this is a valid string compare */
@@ -521,25 +548,31 @@ static int add_right(struct filter_arg *op, struct filter_arg *arg,
                                        show_error(error_str,
                                                   "RegEx '%s' did not compute",
                                                   str);
-                                        return -1;
+                                        return PEVENT_ERRNO__INVALID_REGEX;
                                }
                                break;
                        default:
                                show_error(error_str,
                                           "Illegal comparison for string");
-                                return -1;
+                                return PEVENT_ERRNO__ILLEGAL_STRING_CMP;
                        }
                        op->type = FILTER_ARG_STR;
                        op->str.type = op_type;
                        op->str.field = left->field.field;
                        op->str.val = strdup(str);
-                        if (!op->str.val)
+                        if (!op->str.val) {
-                                die("malloc string");
+                                show_error(error_str, "Failed to allocate string filter");
+                                return PEVENT_ERRNO__MEM_ALLOC_FAILED;
+                        }
                        /*
                         * Need a buffer to copy data for tests
                         */
-                        op->str.buffer = malloc_or_die(op->str.field->size + 1);
+                        op->str.buffer = malloc(op->str.field->size + 1);
+                        if (!op->str.buffer) {
+                                show_error(error_str, "Failed to allocate string filter");
+                                return PEVENT_ERRNO__MEM_ALLOC_FAILED;
+                        }
                        /* Null terminate this buffer */
                        op->str.buffer[op->str.field->size] = 0;
@@ -557,7 +590,7 @@ static int add_right(struct filter_arg *op, struct filter_arg *arg,
                        case FILTER_CMP_NOT_REGEX:
                                show_error(error_str,
                                           "Op not allowed with integers");
-                                return -1;
+                                return PEVENT_ERRNO__ILLEGAL_INTEGER_CMP;
                        default:
                                break;
@@ -577,9 +610,8 @@ static int add_right(struct filter_arg *op, struct filter_arg *arg,
        return 0;
 out_fail:
-        show_error(error_str,
+        show_error(error_str, "Syntax error");
-                   "Syntax error");
+        return PEVENT_ERRNO__SYNTAX_ERROR;
-        return -1;
 }
 static struct filter_arg *
@@ -592,7 +624,7 @@ rotate_op_right(struct filter_arg *a, struct filter_arg *b)
        return arg;
 }
-static int add_left(struct filter_arg *op, struct filter_arg *arg)
+static enum pevent_errno add_left(struct filter_arg *op, struct filter_arg *arg)
 {
        switch (op->type) {
        case FILTER_ARG_EXP:
@@ -611,11 +643,11 @@ static int add_left(struct filter_arg *op, struct filter_arg *arg)
                /* left arg of compares must be a field */
                if (arg->type != FILTER_ARG_FIELD &&
                    arg->type != FILTER_ARG_BOOLEAN)
-                        return -1;
+                        return PEVENT_ERRNO__INVALID_ARG_TYPE;
                op->num.left = arg;
                break;
        default:
-                return -1;
+                return PEVENT_ERRNO__INVALID_ARG_TYPE;
        }
        return 0;
 }
@@ -728,15 +760,18 @@ enum filter_vals {
        FILTER_VAL_TRUE,
 };
-void reparent_op_arg(struct filter_arg *parent, struct filter_arg *old_child,
+static enum pevent_errno
-                  struct filter_arg *arg)
+reparent_op_arg(struct filter_arg *parent, struct filter_arg *old_child,
+                struct filter_arg *arg, char *error_str)
 {
        struct filter_arg *other_child;
        struct filter_arg **ptr;
        if (parent->type != FILTER_ARG_OP &&
-            arg->type != FILTER_ARG_OP)
+            arg->type != FILTER_ARG_OP) {
-                die("can not reparent other than OP");
+                show_error(error_str, "can not reparent other than OP");
+                return PEVENT_ERRNO__REPARENT_NOT_OP;
+        }
        /* Get the sibling */
        if (old_child->op.right == arg) {
@@ -745,8 +780,10 @@ void reparent_op_arg(struct filter_arg *parent, struct filter_arg *old_child,
        } else if (old_child->op.left == arg) {
                ptr = &old_child->op.left;
                other_child = old_child->op.right;
-        } else
+        } else {
-                die("Error in reparent op, find other child");
+                show_error(error_str, "Error in reparent op, find other child");
+                return PEVENT_ERRNO__REPARENT_FAILED;
+        }
        /* Detach arg from old_child */
        *ptr = NULL;
@@ -757,23 +794,29 @@ void reparent_op_arg(struct filter_arg *parent, struct filter_arg *old_child,
                *parent = *arg;
                /* Free arg without recussion */
                free(arg);
-                return;
+                return 0;
        }
        if (parent->op.right == old_child)
                ptr = &parent->op.right;
        else if (parent->op.left == old_child)
                ptr = &parent->op.left;
-        else
+        else {
-                die("Error in reparent op");
+                show_error(error_str, "Error in reparent op");
+                return PEVENT_ERRNO__REPARENT_FAILED;
+        }
        *ptr = arg;
        free_arg(old_child);
+        return 0;
 }
-enum filter_vals test_arg(struct filter_arg *parent, struct filter_arg *arg)
+/* Returns either filter_vals (success) or pevent_errno (failfure) */
+static int test_arg(struct filter_arg *parent, struct filter_arg *arg,
+                    char *error_str)
 {
-        enum filter_vals lval, rval;
+        int lval, rval;
        switch (arg->type) {
@@ -788,63 +831,68 @@ enum filter_vals test_arg(struct filter_arg *parent, struct filter_arg *arg)
                return FILTER_VAL_NORM;
        case FILTER_ARG_EXP:
-                lval = test_arg(arg, arg->exp.left);
+                lval = test_arg(arg, arg->exp.left, error_str);
                if (lval != FILTER_VAL_NORM)
                        return lval;
-                rval = test_arg(arg, arg->exp.right);
+                rval = test_arg(arg, arg->exp.right, error_str);
                if (rval != FILTER_VAL_NORM)
                        return rval;
                return FILTER_VAL_NORM;
        case FILTER_ARG_NUM:
-                lval = test_arg(arg, arg->num.left);
+                lval = test_arg(arg, arg->num.left, error_str);
                if (lval != FILTER_VAL_NORM)
                        return lval;
-                rval = test_arg(arg, arg->num.right);
+                rval = test_arg(arg, arg->num.right, error_str);
                if (rval != FILTER_VAL_NORM)
                        return rval;
                return FILTER_VAL_NORM;
        case FILTER_ARG_OP:
                if (arg->op.type != FILTER_OP_NOT) {
-                        lval = test_arg(arg, arg->op.left);
+                        lval = test_arg(arg, arg->op.left, error_str);
                        switch (lval) {
                        case FILTER_VAL_NORM:
                                break;
                        case FILTER_VAL_TRUE:
                                if (arg->op.type == FILTER_OP_OR)
                                        return FILTER_VAL_TRUE;
-                                rval = test_arg(arg, arg->op.right);
+                                rval = test_arg(arg, arg->op.right, error_str);
                                if (rval != FILTER_VAL_NORM)
                                        return rval;
-                                reparent_op_arg(parent, arg, arg->op.right);
+                                return reparent_op_arg(parent, arg, arg->op.right,
-                                return FILTER_VAL_NORM;
+                                                       error_str);
                        case FILTER_VAL_FALSE:
                                if (arg->op.type == FILTER_OP_AND)
                                        return FILTER_VAL_FALSE;
-                                rval = test_arg(arg, arg->op.right);
+                                rval = test_arg(arg, arg->op.right, error_str);
                                if (rval != FILTER_VAL_NORM)
                                        return rval;
-                                reparent_op_arg(parent, arg, arg->op.right);
+                                return reparent_op_arg(parent, arg, arg->op.right,
-                                return FILTER_VAL_NORM;
+                                                       error_str);
+                        default:
+                                return lval;
                        }
                }
-                rval = test_arg(arg, arg->op.right);
+                rval = test_arg(arg, arg->op.right, error_str);
                switch (rval) {
                case FILTER_VAL_NORM:
+                default:
                        break;
                case FILTER_VAL_TRUE:
                        if (arg->op.type == FILTER_OP_OR)
                                return FILTER_VAL_TRUE;
                        if (arg->op.type == FILTER_OP_NOT)
                                return FILTER_VAL_FALSE;
-                        reparent_op_arg(parent, arg, arg->op.left);
+                        return reparent_op_arg(parent, arg, arg->op.left,
-                        return FILTER_VAL_NORM;
+                                               error_str);
                case FILTER_VAL_FALSE:
                        if (arg->op.type == FILTER_OP_AND)
@@ -852,41 +900,56 @@ enum filter_vals test_arg(struct filter_arg *parent, struct filter_arg *arg)
                        if (arg->op.type == FILTER_OP_NOT)
                                return FILTER_VAL_TRUE;
-                        reparent_op_arg(parent, arg, arg->op.left);
+                        return reparent_op_arg(parent, arg, arg->op.left,
-                        return FILTER_VAL_NORM;
+                                               error_str);
                }
-                return FILTER_VAL_NORM;
+                return rval;
        default:
-                die("bad arg in filter tree");
+                show_error(error_str, "bad arg in filter tree");
+                return PEVENT_ERRNO__BAD_FILTER_ARG;
        }
        return FILTER_VAL_NORM;
 }
 /* Remove any unknown event fields */
-static struct filter_arg *collapse_tree(struct filter_arg *arg)
+static int collapse_tree(struct filter_arg *arg,
+                         struct filter_arg **arg_collapsed, char *error_str)
 {
-        enum filter_vals ret;
+        int ret;
-        ret = test_arg(arg, arg);
+        ret = test_arg(arg, arg, error_str);
        switch (ret) {
        case FILTER_VAL_NORM:
-                return arg;
+                break;
        case FILTER_VAL_TRUE:
        case FILTER_VAL_FALSE:
                free_arg(arg);
                arg = allocate_arg();
-                arg->type = FILTER_ARG_BOOLEAN;
+                if (arg) {
-                arg->boolean.value = ret == FILTER_VAL_TRUE;
+                        arg->type = FILTER_ARG_BOOLEAN;
+                        arg->boolean.value = ret == FILTER_VAL_TRUE;
+                } else {
+                        show_error(error_str, "Failed to allocate filter arg");
+                        ret = PEVENT_ERRNO__MEM_ALLOC_FAILED;
+                }
+                break;
+        default:
+                /* test_arg() already set the error_str */
+                free_arg(arg);
+                arg = NULL;
+                break;
        }
-        return arg;
+        *arg_collapsed = arg;
+        return ret;
 }
-static int
+static enum pevent_errno
 process_filter(struct event_format *event, struct filter_arg **parg,
-               char **error_str, int not)
+               char *error_str, int not)
 {
        enum event_type type;
        char *token = NULL;
@@ -898,7 +961,7 @@ process_filter(struct event_format *event, struct filter_arg **parg,
        enum filter_op_type btype;
        enum filter_exp_type etype;
        enum filter_cmp_type ctype;
-        int ret;
+        enum pevent_errno ret;
        *parg = NULL;
@@ -909,8 +972,8 @@ process_filter(struct event_format *event, struct filter_arg **parg,
                case EVENT_SQUOTE:
                case EVENT_DQUOTE:
                case EVENT_ITEM:
-                        arg = create_arg_item(event, token, type, error_str);
+                        ret = create_arg_item(event, token, type, &arg, error_str);
-                        if (!arg)
+                        if (ret < 0)
                                goto fail;
                        if (!left_item)
                                left_item = arg;
@@ -923,20 +986,20 @@ process_filter(struct event_format *event, struct filter_arg **parg,
                                if (not) {
                                        arg = NULL;
                                        if (current_op)
-                                                goto fail_print;
+                                                goto fail_syntax;
                                        free(token);
                                        *parg = current_exp;
                                        return 0;
                                }
                        } else
-                                goto fail_print;
+                                goto fail_syntax;
                        arg = NULL;
                        break;
                case EVENT_DELIM:
                        if (*token == ',') {
-                                show_error(error_str,
+                                show_error(error_str, "Illegal token ','");
-                                           "Illegal token ','");
+                                ret = PEVENT_ERRNO__ILLEGAL_TOKEN;
                                goto fail;
                        }
@@ -944,19 +1007,23 @@ process_filter(struct event_format *event, struct filter_arg **parg,
                                if (left_item) {
                                        show_error(error_str,
                                                   "Open paren can not come after item");
+                                        ret = PEVENT_ERRNO__INVALID_PAREN;
                                        goto fail;
                                }
                                if (current_exp) {
                                        show_error(error_str,
                                                   "Open paren can not come after expression");
+                                        ret = PEVENT_ERRNO__INVALID_PAREN;
                                        goto fail;
                                }
                                ret = process_filter(event, &arg, error_str, 0);
-                                if (ret != 1) {
+                                if (ret != PEVENT_ERRNO__UNBALANCED_PAREN) {
-                                        if (ret == 0)
+                                        if (ret == 0) {
                                                show_error(error_str,
                                                           "Unbalanced number of '('");
+                                                ret = PEVENT_ERRNO__UNBALANCED_PAREN;
+                                        }
                                        goto fail;
                                }
                                ret = 0;
@@ -964,7 +1031,7 @@ process_filter(struct event_format *event, struct filter_arg **parg,
                                /* A not wants just one expression */
                                if (not) {
                                        if (current_op)
-                                                goto fail_print;
+                                                goto fail_syntax;
                                        *parg = arg;
                                        return 0;
                                }
@@ -979,19 +1046,19 @@ process_filter(struct event_format *event, struct filter_arg **parg,
                        } else { /* ')' */
                                if (!current_op && !current_exp)
-                                        goto fail_print;
+                                        goto fail_syntax;
                                /* Make sure everything is finished at this level */
                                if (current_exp && !check_op_done(current_exp))
-                                        goto fail_print;
+                                        goto fail_syntax;
                                if (current_op && !check_op_done(current_op))
-                                        goto fail_print;
+                                        goto fail_syntax;
                                if (current_op)
                                        *parg = current_op;
                                else
                                        *parg = current_exp;
-                                return 1;
+                                return PEVENT_ERRNO__UNBALANCED_PAREN;
                        }
                        break;
@@ -1003,21 +1070,22 @@ process_filter(struct event_format *event, struct filter_arg **parg,
                        case OP_BOOL:
                                /* Logic ops need a left expression */
                                if (!current_exp && !current_op)
-                                        goto fail_print;
+                                        goto fail_syntax;
                                /* fall through */
                        case OP_NOT:
                                /* logic only processes ops and exp */
                                if (left_item)
-                                        goto fail_print;
+                                        goto fail_syntax;
                                break;
                        case OP_EXP:
                        case OP_CMP:
                                if (!left_item)
-                                        goto fail_print;
+                                        goto fail_syntax;
                                break;
                        case OP_NONE:
                                show_error(error_str,
                                           "Unknown op token %s", token);
+                                ret = PEVENT_ERRNO__UNKNOWN_TOKEN;
                                goto fail;
                        }
@@ -1025,6 +1093,8 @@ process_filter(struct event_format *event, struct filter_arg **parg,
                        switch (op_type) {
                        case OP_BOOL:
                                arg = create_arg_op(btype);
+                                if (arg == NULL)
+                                        goto fail_alloc;
                                if (current_op)
                                        ret = add_left(arg, current_op);
                                else
@@ -1035,6 +1105,8 @@ process_filter(struct event_format *event, struct filter_arg **parg,
                        case OP_NOT:
                                arg = create_arg_op(btype);
+                                if (arg == NULL)
+                                        goto fail_alloc;
                                if (current_op)
                                        ret = add_right(current_op, arg, error_str);
                                if (ret < 0)
@@ -1054,6 +1126,8 @@ process_filter(struct event_format *event, struct filter_arg **parg,
                                        arg = create_arg_exp(etype);
                                else
                                        arg = create_arg_cmp(ctype);
+                                if (arg == NULL)
+                                        goto fail_alloc;
                                if (current_op)
                                        ret = add_right(current_op, arg, error_str);
@@ -1062,7 +1136,7 @@ process_filter(struct event_format *event, struct filter_arg **parg,
                                ret = add_left(arg, left_item);
                                if (ret < 0) {
                                        arg = NULL;
-                                        goto fail_print;
+                                        goto fail_syntax;
                                }
                                current_exp = arg;
                                break;
@@ -1071,57 +1145,64 @@ process_filter(struct event_format *event, struct filter_arg **parg,
                        }
                        arg = NULL;
                        if (ret < 0)
-                                goto fail_print;
+                                goto fail_syntax;
                        break;
                case EVENT_NONE:
                        break;
+                case EVENT_ERROR:
+                        goto fail_alloc;
                default:
-                        goto fail_print;
+                        goto fail_syntax;
                }
        } while (type != EVENT_NONE);
        if (!current_op && !current_exp)
-                goto fail_print;
+                goto fail_syntax;
        if (!current_op)
                current_op = current_exp;
-        current_op = collapse_tree(current_op);
+        ret = collapse_tree(current_op, parg, error_str);
+        if (ret < 0)
+                goto fail;
        *parg = current_op;
        return 0;
- fail_print:
+ fail_alloc:
+        show_error(error_str, "failed to allocate filter arg");
+        ret = PEVENT_ERRNO__MEM_ALLOC_FAILED;
+        goto fail;
+ fail_syntax:
        show_error(error_str, "Syntax error");
+        ret = PEVENT_ERRNO__SYNTAX_ERROR;
 fail:
        free_arg(current_op);
        free_arg(current_exp);
        free_arg(arg);
        free(token);
-        return -1;
+        return ret;
 }
-static int
+static enum pevent_errno
 process_event(struct event_format *event, const char *filter_str,
-              struct filter_arg **parg, char **error_str)
+              struct filter_arg **parg, char *error_str)
 {
        int ret;
        pevent_buffer_init(filter_str, strlen(filter_str));
        ret = process_filter(event, parg, error_str, 0);
-        if (ret == 1) {
-                show_error(error_str,
-                           "Unbalanced number of ')'");
-                return -1;
-        }
        if (ret < 0)
                return ret;
        /* If parg is NULL, then make it into FALSE */
        if (!*parg) {
                *parg = allocate_arg();
+                if (*parg == NULL)
+                        return PEVENT_ERRNO__MEM_ALLOC_FAILED;
                (*parg)->type = FILTER_ARG_BOOLEAN;
                (*parg)->boolean.value = FILTER_FALSE;
        }
@@ -1129,13 +1210,13 @@ process_event(struct event_format *event, const char *filter_str,
        return 0;
 }
-static int filter_event(struct event_filter *filter,
+static enum pevent_errno
-                        struct event_format *event,
+filter_event(struct event_filter *filter, struct event_format *event,
-                        const char *filter_str, char **error_str)
+             const char *filter_str, char *error_str)
 {
        struct filter_type *filter_type;
        struct filter_arg *arg;
-        int ret;
+        enum pevent_errno ret;
        if (filter_str) {
                ret = process_event(event, filter_str, &arg, error_str);
@@ -1145,11 +1226,17 @@ static int filter_event(struct event_filter *filter,
        } else {
                /* just add a TRUE arg */
                arg = allocate_arg();
+                if (arg == NULL)
+                        return PEVENT_ERRNO__MEM_ALLOC_FAILED;
                arg->type = FILTER_ARG_BOOLEAN;
                arg->boolean.value = FILTER_TRUE;
        }
        filter_type = add_filter_type(filter, event->id);
+        if (filter_type == NULL)
+                return PEVENT_ERRNO__MEM_ALLOC_FAILED;
        if (filter_type->filter)
                free_arg(filter_type->filter);
        filter_type->filter = arg;
@@ -1157,22 +1244,24 @@ static int filter_event(struct event_filter *filter,
        return 0;
 }
+static void filter_init_error_buf(struct event_filter *filter)
+{
+        /* clear buffer to reset show error */
+        pevent_buffer_init("", 0);
+        filter->error_buffer[0] = '\0';
+}
 /**
 * pevent_filter_add_filter_str - add a new filter
 * @filter: the event filter to add to
 * @filter_str: the filter string that contains the filter
- * @error_str: string containing reason for failed filter
- *
- * Returns 0 if the filter was successfully added
- *   -1 if there was an error.
 *
- * On error, if @error_str points to a string pointer,
+ * Returns 0 if the filter was successfully added or a
- * it is set to the reason that the filter failed.
+ * negative error code.  Use pevent_filter_strerror() to see
- * This string must be freed with "free".
+ * actual error message in case of error.
 */
-int pevent_filter_add_filter_str(struct event_filter *filter,
+enum pevent_errno pevent_filter_add_filter_str(struct event_filter *filter,
-                                 const char *filter_str,
+                                               const char *filter_str)
-                                 char **error_str)
 {
        struct pevent *pevent = filter->pevent;
        struct event_list *event;
@@ -1183,15 +1272,11 @@ int pevent_filter_add_filter_str(struct event_filter *filter,
        char *event_name = NULL;
        char *sys_name = NULL;
        char *sp;
-        int rtn = 0;
+        enum pevent_errno rtn = 0; /* PEVENT_ERRNO__SUCCESS */
        int len;
        int ret;
-        /* clear buffer to reset show error */
+        filter_init_error_buf(filter);
-        pevent_buffer_init("", 0);
-        if (error_str)
-                *error_str = NULL;
        filter_start = strchr(filter_str, ':');
        if (filter_start)
@@ -1199,7 +1284,6 @@ int pevent_filter_add_filter_str(struct event_filter *filter,
        else
                len = strlen(filter_str);
        do {
                next_event = strchr(filter_str, ',');
                if (next_event &&
@@ -1210,7 +1294,12 @@ int pevent_filter_add_filter_str(struct event_filter *filter,
                else
                        len = strlen(filter_str);
-                this_event = malloc_or_die(len + 1);
+                this_event = malloc(len + 1);
+                if (this_event == NULL) {
+                        /* This can only happen when events is NULL, but still */
+                        free_events(events);
+                        return PEVENT_ERRNO__MEM_ALLOC_FAILED;
+                }
                memcpy(this_event, filter_str, len);
                this_event[len] = 0;
@@ -1223,27 +1312,18 @@ int pevent_filter_add_filter_str(struct event_filter *filter,
                event_name = strtok_r(NULL, "/", &sp);
                if (!sys_name) {
-                        show_error(error_str, "No filter found");
                        /* This can only happen when events is NULL, but still */
                        free_events(events);
                        free(this_event);
-                        return -1;
+                        return PEVENT_ERRNO__FILTER_NOT_FOUND;
                }
                /* Find this event */
                ret = find_event(pevent, &events, strim(sys_name), strim(event_name));
                if (ret < 0) {
-                        if (event_name)
-                                show_error(error_str,
-                                           "No event found under '%s.%s'",
-                                           sys_name, event_name);
-                        else
-                                show_error(error_str,
-                                           "No event found under '%s'",
-                                           sys_name);
                        free_events(events);
                        free(this_event);
-                        return -1;
+                        return ret;
                }
                free(this_event);
        } while (filter_str);
@@ -1255,7 +1335,7 @@ int pevent_filter_add_filter_str(struct event_filter *filter,
        /* filter starts here */
        for (event = events; event; event = event->next) {
                ret = filter_event(filter, event->event, filter_start,
-                                   error_str);
+                                   filter->error_buffer);
                /* Failures are returned if a parse error happened */
                if (ret < 0)
                        rtn = ret;
@@ -1263,8 +1343,10 @@ int pevent_filter_add_filter_str(struct event_filter *filter,
                if (ret >= 0 && pevent->test_filters) {
                        char *test;
                        test = pevent_filter_make_string(filter, event->event->id);
-                        printf(" '%s: %s'\n", event->event->name, test);
+                        if (test) {
-                        free(test);
+                                printf(" '%s: %s'\n", event->event->name, test);
+                                free(test);
+                        }
                }
        }
@@ -1282,6 +1364,32 @@ static void free_filter_type(struct filter_type *filter_type)
 }
 /**
+ * pevent_filter_strerror - fill error message in a buffer
+ * @filter: the event filter contains error
+ * @err: the error code
+ * @buf: the buffer to be filled in
+ * @buflen: the size of the buffer
+ *
+ * Returns 0 if message was filled successfully, -1 if error
+ */
+int pevent_filter_strerror(struct event_filter *filter, enum pevent_errno err,
+                           char *buf, size_t buflen)
+{
+        if (err <= __PEVENT_ERRNO__START || err >= __PEVENT_ERRNO__END)
+                return -1;
+        if (strlen(filter->error_buffer) > 0) {
+                size_t len = snprintf(buf, buflen, "%s", filter->error_buffer);
+                if (len > buflen)
+                        return -1;
+                return 0;
+        }
+        return pevent_strerror(filter->pevent, err, buf, buflen);
+}
+/**
 * pevent_filter_remove_event - remove a filter for an event
 * @filter: the event filter to remove from
 * @event_id: the event to remove a filter for
@@ -1374,6 +1482,9 @@ static int copy_filter_type(struct event_filter *filter,
        if (strcmp(str, "TRUE") == 0 || strcmp(str, "FALSE") == 0) {
                /* Add trivial event */
                arg = allocate_arg();
+                if (arg == NULL)
+                        return -1;
                arg->type = FILTER_ARG_BOOLEAN;
                if (strcmp(str, "TRUE") == 0)
                        arg->boolean.value = 1;
@@ -1381,6 +1492,9 @@ static int copy_filter_type(struct event_filter *filter,
                        arg->boolean.value = 0;
                filter_type = add_filter_type(filter, event->id);
+                if (filter_type == NULL)
+                        return -1;
                filter_type->filter = arg;
                free(str);
@@ -1482,8 +1596,10 @@ int pevent_update_trivial(struct event_filter *dest, struct event_filter *source
 * @type: remove only true, false, or both
 *
 * Removes filters that only contain a TRUE or FALES boolean arg.
+ *
+ * Returns 0 on success and -1 if there was a problem.
 */
-void pevent_filter_clear_trivial(struct event_filter *filter,
+int pevent_filter_clear_trivial(struct event_filter *filter,
                                 enum filter_trivial_type type)
 {
        struct filter_type *filter_type;
@@ -1492,13 +1608,15 @@ void pevent_filter_clear_trivial(struct event_filter *filter,
        int i;
        if (!filter->filters)
-                return;
+                return 0;
        /*
         * Two steps, first get all ids with trivial filters.
         *  then remove those ids.
         */
        for (i = 0; i < filter->filters; i++) {
+                int *new_ids;
                filter_type = &filter->event_filters[i];
                if (filter_type->filter->type != FILTER_ARG_BOOLEAN)
                        continue;
@@ -1513,19 +1631,24 @@ void pevent_filter_clear_trivial(struct event_filter *filter,
                        break;
                }
-                ids = realloc(ids, sizeof(*ids) * (count + 1));
+                new_ids = realloc(ids, sizeof(*ids) * (count + 1));
-                if (!ids)
+                if (!new_ids) {
-                        die("Can't allocate ids");
+                        free(ids);
+                        return -1;
+                }
+                ids = new_ids;
                ids[count++] = filter_type->event_id;
        }
        if (!count)
-                return;
+                return 0;
        for (i = 0; i < count; i++)
                pevent_filter_remove_event(filter, ids[i]);
        free(ids);
+        return 0;
 }
 /**
@@ -1565,8 +1688,8 @@ int pevent_filter_event_has_trivial(struct event_filter *filter,
        }
 }
-static int test_filter(struct event_format *event,
+static int test_filter(struct event_format *event, struct filter_arg *arg,
-                       struct filter_arg *arg, struct pevent_record *record);
+                       struct pevent_record *record, enum pevent_errno *err);
 static const char *
 get_comm(struct event_format *event, struct pevent_record *record)
@@ -1612,15 +1735,24 @@ get_value(struct event_format *event,
 }
 static unsigned long long
-get_arg_value(struct event_format *event, struct filter_arg *arg, struct pevent_record *record);
+get_arg_value(struct event_format *event, struct filter_arg *arg,
+              struct pevent_record *record, enum pevent_errno *err);
 static unsigned long long
-get_exp_value(struct event_format *event, struct filter_arg *arg, struct pevent_record *record)
+get_exp_value(struct event_format *event, struct filter_arg *arg,
+              struct pevent_record *record, enum pevent_errno *err)
 {
        unsigned long long lval, rval;
-        lval = get_arg_value(event, arg->exp.left, record);
+        lval = get_arg_value(event, arg->exp.left, record, err);
-        rval = get_arg_value(event, arg->exp.right, record);
+        rval = get_arg_value(event, arg->exp.right, record, err);
+        if (*err) {
+                /*
+                 * There was an error, no need to process anymore.
+                 */
+                return 0;
+        }
        switch (arg->exp.type) {
        case FILTER_EXP_ADD:
@@ -1655,39 +1787,51 @@ get_exp_value(struct event_format *event, struct filter_arg *arg, struct pevent_
        case FILTER_EXP_NOT:
        default:
-                die("error in exp");
+                if (!*err)
+                        *err = PEVENT_ERRNO__INVALID_EXP_TYPE;
        }
        return 0;
 }
 static unsigned long long
-get_arg_value(struct event_format *event, struct filter_arg *arg, struct pevent_record *record)
+get_arg_value(struct event_format *event, struct filter_arg *arg,
+              struct pevent_record *record, enum pevent_errno *err)
 {
        switch (arg->type) {
        case FILTER_ARG_FIELD:
                return get_value(event, arg->field.field, record);
        case FILTER_ARG_VALUE:
-                if (arg->value.type != FILTER_NUMBER)
+                if (arg->value.type != FILTER_NUMBER) {
-                        die("must have number field!");
+                        if (!*err)
+                                *err = PEVENT_ERRNO__NOT_A_NUMBER;
+                }
                return arg->value.val;
        case FILTER_ARG_EXP:
-                return get_exp_value(event, arg, record);
+                return get_exp_value(event, arg, record, err);
        default:
-                die("oops in filter");
+                if (!*err)
+                        *err = PEVENT_ERRNO__INVALID_ARG_TYPE;
        }
        return 0;
 }
-static int test_num(struct event_format *event,
+static int test_num(struct event_format *event, struct filter_arg *arg,
-                    struct filter_arg *arg, struct pevent_record *record)
+                    struct pevent_record *record, enum pevent_errno *err)
 {
        unsigned long long lval, rval;
-        lval = get_arg_value(event, arg->num.left, record);
+        lval = get_arg_value(event, arg->num.left, record, err);
-        rval = get_arg_value(event, arg->num.right, record);
+        rval = get_arg_value(event, arg->num.right, record, err);
+        if (*err) {
+                /*
+                 * There was an error, no need to process anymore.
+                 */
+                return 0;
+        }
        switch (arg->num.type) {
        case FILTER_CMP_EQ:
@@ -1709,7 +1853,8 @@ static int test_num(struct event_format *event,
                return lval <= rval;
        default:
-                /* ?? */
+                if (!*err)
+                        *err = PEVENT_ERRNO__ILLEGAL_INTEGER_CMP;
                return 0;
        }
 }
@@ -1756,8 +1901,8 @@ static const char *get_field_str(struct filter_arg *arg, struct pevent_record *r
        return val;
 }
-static int test_str(struct event_format *event,
+static int test_str(struct event_format *event, struct filter_arg *arg,
-                    struct filter_arg *arg, struct pevent_record *record)
+                    struct pevent_record *record, enum pevent_errno *err)
 {
        const char *val;
@@ -1781,48 +1926,57 @@ static int test_str(struct event_format *event,
                return regexec(&arg->str.reg, val, 0, NULL, 0);
        default:
-                /* ?? */
+                if (!*err)
+                        *err = PEVENT_ERRNO__ILLEGAL_STRING_CMP;
                return 0;
        }
 }
-static int test_op(struct event_format *event,
+static int test_op(struct event_format *event, struct filter_arg *arg,
-                   struct filter_arg *arg, struct pevent_record *record)
+                   struct pevent_record *record, enum pevent_errno *err)
 {
        switch (arg->op.type) {
        case FILTER_OP_AND:
-                return test_filter(event, arg->op.left, record) &&
+                return test_filter(event, arg->op.left, record, err) &&
-                        test_filter(event, arg->op.right, record);
+                        test_filter(event, arg->op.right, record, err);
        case FILTER_OP_OR:
-                return test_filter(event, arg->op.left, record) ||
+                return test_filter(event, arg->op.left, record, err) ||
-                        test_filter(event, arg->op.right, record);
+                        test_filter(event, arg->op.right, record, err);
        case FILTER_OP_NOT:
-                return !test_filter(event, arg->op.right, record);
+                return !test_filter(event, arg->op.right, record, err);
        default:
-                /* ?? */
+                if (!*err)
+                        *err = PEVENT_ERRNO__INVALID_OP_TYPE;
                return 0;
        }
 }
-static int test_filter(struct event_format *event,
+static int test_filter(struct event_format *event, struct filter_arg *arg,
-                       struct filter_arg *arg, struct pevent_record *record)
+                       struct pevent_record *record, enum pevent_errno *err)
 {
+        if (*err) {
+                /*
+                 * There was an error, no need to process anymore.
+                 */
+                return 0;
+        }
        switch (arg->type) {
        case FILTER_ARG_BOOLEAN:
                /* easy case */
                return arg->boolean.value;
        case FILTER_ARG_OP:
-                return test_op(event, arg, record);
+                return test_op(event, arg, record, err);
        case FILTER_ARG_NUM:
-                return test_num(event, arg, record);
+                return test_num(event, arg, record, err);
        case FILTER_ARG_STR:
-                return test_str(event, arg, record);
+                return test_str(event, arg, record, err);
        case FILTER_ARG_EXP:
        case FILTER_ARG_VALUE:
@@ -1831,11 +1985,11 @@ static int test_filter(struct event_format *event,
                 * Expressions, fields and values evaluate
                 * to true if they return non zero
                 */
-                return !!get_arg_value(event, arg, record);
+                return !!get_arg_value(event, arg, record, err);
        default:
-                die("oops!");
+                if (!*err)
-                /* ?? */
+                        *err = PEVENT_ERRNO__INVALID_ARG_TYPE;
                return 0;
        }
 }
@@ -1848,8 +2002,7 @@ static int test_filter(struct event_format *event,
 * Returns 1 if filter found for @event_id
 *   otherwise 0;
 */
-int pevent_event_filtered(struct event_filter *filter,
+int pevent_event_filtered(struct event_filter *filter, int event_id)
-                          int event_id)
 {
        struct filter_type *filter_type;
@@ -1866,31 +2019,38 @@ int pevent_event_filtered(struct event_filter *filter,
 * @filter: filter struct with filter information
 * @record: the record to test against the filter
 *
- * Returns:
+ * Returns: match result or error code (prefixed with PEVENT_ERRNO__)
- *  1 - filter found for event and @record matches
+ * FILTER_MATCH - filter found for event and @record matches
- *  0 - filter found for event and @record does not match
+ * FILTER_MISS  - filter found for event and @record does not match
- * -1 - no filter found for @record's event
+ * FILTER_NOT_FOUND - no filter found for @record's event
- * -2 - if no filters exist
+ * NO_FILTER - if no filters exist
+ * otherwise - error occurred during test
 */
-int pevent_filter_match(struct event_filter *filter,
+enum pevent_errno pevent_filter_match(struct event_filter *filter,
-                        struct pevent_record *record)
+                                      struct pevent_record *record)
 {
        struct pevent *pevent = filter->pevent;
        struct filter_type *filter_type;
        int event_id;
+        int ret;
+        enum pevent_errno err = 0;
+        filter_init_error_buf(filter);
        if (!filter->filters)
-                return FILTER_NONE;
+                return PEVENT_ERRNO__NO_FILTER;
        event_id = pevent_data_type(pevent, record);
        filter_type = find_filter_type(filter, event_id);
        if (!filter_type)
-                return FILTER_NOEXIST;
+                return PEVENT_ERRNO__FILTER_NOT_FOUND;
+        ret = test_filter(filter_type->event, filter_type->filter, record, &err);
+        if (err)
+                return err;
-        return test_filter(filter_type->event, filter_type->filter, record) ?
+        return ret ? PEVENT_ERRNO__FILTER_MATCH : PEVENT_ERRNO__FILTER_MISS;
-                FILTER_MATCH : FILTER_MISS;
 }
 static char *op_to_str(struct event_filter *filter, struct filter_arg *arg)
@@ -1902,7 +2062,6 @@ static char *op_to_str(struct event_filter *filter, struct filter_arg *arg)
        int left_val = -1;
        int right_val = -1;
        int val;
-        int len;
        switch (arg->op.type) {
        case FILTER_OP_AND:
@@ -1949,11 +2108,7 @@ static char *op_to_str(struct event_filter *filter, struct filter_arg *arg)
                                default:
                                        break;
                                }
-                                str = malloc_or_die(6);
+                                asprintf(&str, val ? "TRUE" : "FALSE");
-                                if (val)
-                                        strcpy(str, "TRUE");
-                                else
-                                        strcpy(str, "FALSE");
                                break;
                        }
                }
@@ -1971,10 +2126,7 @@ static char *op_to_str(struct event_filter *filter, struct filter_arg *arg)
                        break;
                }
-                len = strlen(left) + strlen(right) + strlen(op) + 10;
+                asprintf(&str, "(%s) %s (%s)", left, op, right);
-                str = malloc_or_die(len);
-                snprintf(str, len, "(%s) %s (%s)",
-                         left, op, right);
                break;
        case FILTER_OP_NOT:
@@ -1990,16 +2142,10 @@ static char *op_to_str(struct event_filter *filter, struct filter_arg *arg)
                        right_val = 0;
                if (right_val >= 0) {
                        /* just return the opposite */
-                        str = malloc_or_die(6);
+                        asprintf(&str, right_val ? "FALSE" : "TRUE");
-                        if (right_val)
-                                strcpy(str, "FALSE");
-                        else
-                                strcpy(str, "TRUE");
                        break;
                }
-                len = strlen(right) + strlen(op) + 3;
+                asprintf(&str, "%s(%s)", op, right);
-                str = malloc_or_die(len);
-                snprintf(str, len, "%s(%s)", op, right);
                break;
        default:
@@ -2013,11 +2159,9 @@ static char *op_to_str(struct event_filter *filter, struct filter_arg *arg)
 static char *val_to_str(struct event_filter *filter, struct filter_arg *arg)
 {
-        char *str;
+        char *str = NULL;
-        str = malloc_or_die(30);
-        snprintf(str, 30, "%lld", arg->value.val);
+        asprintf(&str, "%lld", arg->value.val);
        return str;
 }
@@ -2033,7 +2177,6 @@ static char *exp_to_str(struct event_filter *filter, struct filter_arg *arg)
        char *rstr;
        char *op;
        char *str = NULL;
-        int len;
        lstr = arg_to_str(filter, arg->exp.left);
        rstr = arg_to_str(filter, arg->exp.right);
@@ -2072,12 +2215,11 @@ static char *exp_to_str(struct event_filter *filter, struct filter_arg *arg)
                op = "^";
                break;
        default:
-                die("oops in exp");
+                op = "[ERROR IN EXPRESSION TYPE]";
+                break;
        }
-        len = strlen(op) + strlen(lstr) + strlen(rstr) + 4;
+        asprintf(&str, "%s %s %s", lstr, op, rstr);
-        str = malloc_or_die(len);
-        snprintf(str, len, "%s %s %s", lstr, op, rstr);
 out:
        free(lstr);
        free(rstr);
@@ -2091,7 +2233,6 @@ static char *num_to_str(struct event_filter *filter, struct filter_arg *arg)
        char *rstr;
        char *str = NULL;
        char *op = NULL;
-        int len;
        lstr = arg_to_str(filter, arg->num.left);
        rstr = arg_to_str(filter, arg->num.right);
@@ -2122,10 +2263,7 @@ static char *num_to_str(struct event_filter *filter, struct filter_arg *arg)
                if (!op)
                        op = "<=";
-                len = strlen(lstr) + strlen(op) + strlen(rstr) + 4;
+                asprintf(&str, "%s %s %s", lstr, op, rstr);
-                str = malloc_or_die(len);
-                sprintf(str, "%s %s %s", lstr, op, rstr);
                break;
        default:
@@ -2143,7 +2281,6 @@ static char *str_to_str(struct event_filter *filter, struct filter_arg *arg)
 {
        char *str = NULL;
        char *op = NULL;
-        int len;
        switch (arg->str.type) {
        case FILTER_CMP_MATCH:
@@ -2161,12 +2298,8 @@ static char *str_to_str(struct event_filter *filter, struct filter_arg *arg)
                if (!op)
                        op = "!~";
-                len = strlen(arg->str.field->name) + strlen(op) +
+                asprintf(&str, "%s %s \"%s\"",
-                        strlen(arg->str.val) + 6;
+                         arg->str.field->name, op, arg->str.val);
-                str = malloc_or_die(len);
-                snprintf(str, len, "%s %s \"%s\"",
-                         arg->str.field->name,
-                         op, arg->str.val);
                break;
        default:
@@ -2178,15 +2311,11 @@ static char *str_to_str(struct event_filter *filter, struct filter_arg *arg)
 static char *arg_to_str(struct event_filter *filter, struct filter_arg *arg)
 {
-        char *str;
+        char *str = NULL;
        switch (arg->type) {
        case FILTER_ARG_BOOLEAN:
-                str = malloc_or_die(6);
+                asprintf(&str, arg->boolean.value ? "TRUE" : "FALSE");
-                if (arg->boolean.value)
-                        strcpy(str, "TRUE");
-                else
-                        strcpy(str, "FALSE");
                return str;
        case FILTER_ARG_OP:
@@ -2221,7 +2350,7 @@ static char *arg_to_str(struct event_filter *filter, struct filter_arg *arg)
 *
 * Returns a string that displays the filter contents.
 *  This string must be freed with free(str).
- *  NULL is returned if no filter is found.
+ *  NULL is returned if no filter is found or allocation failed.
 */
 char *
 pevent_filter_make_string(struct event_filter *filter, int event_id)
diff --git a/tools/lib/traceevent/parse-utils.c b/tools/lib/traceevent/parse-utils.c
index bba701cf10e6..eda07fa31dca 100644
--- a/tools/lib/traceevent/parse-utils.c
+++ b/tools/lib/traceevent/parse-utils.c
@@ -25,40 +25,6 @@
 #define __weak __attribute__((weak))
-void __vdie(const char *fmt, va_list ap)
-{
-        int ret = errno;
-        if (errno)
-                perror("trace-cmd");
-        else
-                ret = -1;
-        fprintf(stderr, "  ");
-        vfprintf(stderr, fmt, ap);
-        fprintf(stderr, "\n");
-        exit(ret);
-}
-void __die(const char *fmt, ...)
-{
-        va_list ap;
-        va_start(ap, fmt);
-        __vdie(fmt, ap);
-        va_end(ap);
-}
-void __weak die(const char *fmt, ...)
-{
-        va_list ap;
-        va_start(ap, fmt);
-        __vdie(fmt, ap);
-        va_end(ap);
-}
 void __vwarning(const char *fmt, va_list ap)
 {
        if (errno)
@@ -117,13 +83,3 @@ void __weak pr_stat(const char *fmt, ...)
        __vpr_stat(fmt, ap);
        va_end(ap);
 }
-void __weak *malloc_or_die(unsigned int size)
-{
-        void *data;
-        data = malloc(size);
-        if (!data)
-                die("malloc");
-        return data;
-}
diff --git a/tools/lib/traceevent/plugin_cfg80211.c b/tools/lib/traceevent/plugin_cfg80211.c
new file mode 100644
index 000000000000..c066b25905f8
--- /dev/null
+++ b/tools/lib/traceevent/plugin_cfg80211.c
@@ -0,0 +1,30 @@
+#include <stdio.h>
+#include <string.h>
+#include <inttypes.h>
+#include <endian.h>
+#include "event-parse.h"
+static unsigned long long
+process___le16_to_cpup(struct trace_seq *s,
+                       unsigned long long *args)
+{
+        uint16_t *val = (uint16_t *) (unsigned long) args[0];
+        return val ? (long long) le16toh(*val) : 0;
+}
+int PEVENT_PLUGIN_LOADER(struct pevent *pevent)
+{
+        pevent_register_print_function(pevent,
+                                       process___le16_to_cpup,
+                                       PEVENT_FUNC_ARG_INT,
+                                       "__le16_to_cpup",
+                                       PEVENT_FUNC_ARG_PTR,
+                                       PEVENT_FUNC_ARG_VOID);
+        return 0;
+}
+void PEVENT_PLUGIN_UNLOADER(struct pevent *pevent)
+{
+        pevent_unregister_print_function(pevent, process___le16_to_cpup,
+                                         "__le16_to_cpup");
+}
diff --git a/tools/lib/traceevent/plugin_function.c b/tools/lib/traceevent/plugin_function.c
new file mode 100644
index 000000000000..80ba4ff1fe84
--- /dev/null
+++ b/tools/lib/traceevent/plugin_function.c
@@ -0,0 +1,163 @@
+/*
+ * Copyright (C) 2009, 2010 Red Hat Inc, Steven Rostedt <srostedt@redhat.com>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation;
+ * version 2.1 of the License (not later!)
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not,  see <http://www.gnu.org/licenses>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "event-parse.h"
+#include "event-utils.h"
+static struct func_stack {
+        int size;
+        char **stack;
+} *fstack;
+static int cpus = -1;
+#define STK_BLK 10
+static void add_child(struct func_stack *stack, const char *child, int pos)
+{
+        int i;
+        if (!child)
+                return;
+        if (pos < stack->size)
+                free(stack->stack[pos]);
+        else {
+                char **ptr;
+                ptr = realloc(stack->stack, sizeof(char *) *
+                              (stack->size + STK_BLK));
+                if (!ptr) {
+                        warning("could not allocate plugin memory\n");
+                        return;
+                }
+                stack->stack = ptr;
+                for (i = stack->size; i < stack->size + STK_BLK; i++)
+                        stack->stack[i] = NULL;
+                stack->size += STK_BLK;
+        }
+        stack->stack[pos] = strdup(child);
+}
+static int add_and_get_index(const char *parent, const char *child, int cpu)
+{
+        int i;
+        if (cpu < 0)
+                return 0;
+        if (cpu > cpus) {
+                struct func_stack *ptr;
+                ptr = realloc(fstack, sizeof(*fstack) * (cpu + 1));
+                if (!ptr) {
+                        warning("could not allocate plugin memory\n");
+                        return 0;
+                }
+                fstack = ptr;
+                /* Account for holes in the cpu count */
+                for (i = cpus + 1; i <= cpu; i++)
+                        memset(&fstack[i], 0, sizeof(fstack[i]));
+                cpus = cpu;
+        }
+        for (i = 0; i < fstack[cpu].size && fstack[cpu].stack[i]; i++) {
+                if (strcmp(parent, fstack[cpu].stack[i]) == 0) {
+                        add_child(&fstack[cpu], child, i+1);
+                        return i;
+                }
+        }
+        /* Not found */
+        add_child(&fstack[cpu], parent, 0);
+        add_child(&fstack[cpu], child, 1);
+        return 0;
+}
+static int function_handler(struct trace_seq *s, struct pevent_record *record,
+                            struct event_format *event, void *context)
+{
+        struct pevent *pevent = event->pevent;
+        unsigned long long function;
+        unsigned long long pfunction;
+        const char *func;
+        const char *parent;
+        int index;
+        if (pevent_get_field_val(s, event, "ip", record, &function, 1))
+                return trace_seq_putc(s, '!');
+        func = pevent_find_function(pevent, function);
+        if (pevent_get_field_val(s, event, "parent_ip", record, &pfunction, 1))
+                return trace_seq_putc(s, '!');
+        parent = pevent_find_function(pevent, pfunction);
+        index = add_and_get_index(parent, func, record->cpu);
+        trace_seq_printf(s, "%*s", index*3, "");
+        if (func)
+                trace_seq_printf(s, "%s", func);
+        else
+                trace_seq_printf(s, "0x%llx", function);
+        trace_seq_printf(s, " <-- ");
+        if (parent)
+                trace_seq_printf(s, "%s", parent);
+        else
+                trace_seq_printf(s, "0x%llx", pfunction);
+        return 0;
+}
+int PEVENT_PLUGIN_LOADER(struct pevent *pevent)
+{
+        pevent_register_event_handler(pevent, -1, "ftrace", "function",
+                                      function_handler, NULL);
+        return 0;
+}
+void PEVENT_PLUGIN_UNLOADER(struct pevent *pevent)
+{
+        int i, x;
+        pevent_unregister_event_handler(pevent, -1, "ftrace", "function",
+                                        function_handler, NULL);
+        for (i = 0; i <= cpus; i++) {
+                for (x = 0; x < fstack[i].size && fstack[i].stack[x]; x++)
+                        free(fstack[i].stack[x]);
+                free(fstack[i].stack);
+        }
+        free(fstack);
+        fstack = NULL;
+        cpus = -1;
+}
diff --git a/tools/lib/traceevent/plugin_hrtimer.c b/tools/lib/traceevent/plugin_hrtimer.c
new file mode 100644
index 000000000000..12bf14cc1152
--- /dev/null
+++ b/tools/lib/traceevent/plugin_hrtimer.c
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2009 Red Hat Inc, Steven Rostedt <srostedt@redhat.com>
+ * Copyright (C) 2009 Johannes Berg <johannes@sipsolutions.net>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation;
+ * version 2.1 of the License (not later!)
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not,  see <http://www.gnu.org/licenses>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "event-parse.h"
+static int timer_expire_handler(struct trace_seq *s,
+                                struct pevent_record *record,
+                                struct event_format *event, void *context)
+{
+        trace_seq_printf(s, "hrtimer=");
+        if (pevent_print_num_field(s, "0x%llx", event, "timer",
+                                   record, 0) == -1)
+                pevent_print_num_field(s, "0x%llx", event, "hrtimer",
+                                       record, 1);
+        trace_seq_printf(s, " now=");
+        pevent_print_num_field(s, "%llu", event, "now", record, 1);
+        pevent_print_func_field(s, " function=%s", event, "function",
+                                record, 0);
+        return 0;
+}
+static int timer_start_handler(struct trace_seq *s,
+                               struct pevent_record *record,
+                               struct event_format *event, void *context)
+{
+        trace_seq_printf(s, "hrtimer=");
+        if (pevent_print_num_field(s, "0x%llx", event, "timer",
+                                   record, 0) == -1)
+                pevent_print_num_field(s, "0x%llx", event, "hrtimer",
+                                       record, 1);
+        pevent_print_func_field(s, " function=%s", event, "function",
+                                record, 0);
+        trace_seq_printf(s, " expires=");
+        pevent_print_num_field(s, "%llu", event, "expires", record, 1);
+        trace_seq_printf(s, " softexpires=");
+        pevent_print_num_field(s, "%llu", event, "softexpires", record, 1);
+        return 0;
+}
+int PEVENT_PLUGIN_LOADER(struct pevent *pevent)
+{
+        pevent_register_event_handler(pevent, -1,
+                                      "timer", "hrtimer_expire_entry",
+                                      timer_expire_handler, NULL);
+        pevent_register_event_handler(pevent, -1, "timer", "hrtimer_start",
+                                      timer_start_handler, NULL);
+        return 0;
+}
+void PEVENT_PLUGIN_UNLOADER(struct pevent *pevent)
+{
+        pevent_unregister_event_handler(pevent, -1,
+                                        "timer", "hrtimer_expire_entry",
+                                        timer_expire_handler, NULL);
+        pevent_unregister_event_handler(pevent, -1, "timer", "hrtimer_start",
+                                        timer_start_handler, NULL);
+}
diff --git a/tools/lib/traceevent/plugin_jbd2.c b/tools/lib/traceevent/plugin_jbd2.c
new file mode 100644
index 000000000000..0db714c721be
--- /dev/null
+++ b/tools/lib/traceevent/plugin_jbd2.c
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2010 Red Hat Inc, Steven Rostedt <srostedt@redhat.com>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation;
+ * version 2.1 of the License (not later!)
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not,  see <http://www.gnu.org/licenses>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "event-parse.h"
+#define MINORBITS       20
+#define MINORMASK       ((1U << MINORBITS) - 1)
+#define MAJOR(dev)      ((unsigned int) ((dev) >> MINORBITS))
+#define MINOR(dev)      ((unsigned int) ((dev) & MINORMASK))
+static unsigned long long
+process_jbd2_dev_to_name(struct trace_seq *s,
+                         unsigned long long *args)
+{
+        unsigned int dev = args[0];
+        trace_seq_printf(s, "%d:%d", MAJOR(dev), MINOR(dev));
+        return 0;
+}
+static unsigned long long
+process_jiffies_to_msecs(struct trace_seq *s,
+                         unsigned long long *args)
+{
+        unsigned long long jiffies = args[0];
+        trace_seq_printf(s, "%lld", jiffies);
+        return jiffies;
+}
+int PEVENT_PLUGIN_LOADER(struct pevent *pevent)
+{
+        pevent_register_print_function(pevent,
+                                       process_jbd2_dev_to_name,
+                                       PEVENT_FUNC_ARG_STRING,
+                                       "jbd2_dev_to_name",
+                                       PEVENT_FUNC_ARG_INT,
+                                       PEVENT_FUNC_ARG_VOID);
+        pevent_register_print_function(pevent,
+                                       process_jiffies_to_msecs,
+                                       PEVENT_FUNC_ARG_LONG,
+                                       "jiffies_to_msecs",
+                                       PEVENT_FUNC_ARG_LONG,
+                                       PEVENT_FUNC_ARG_VOID);
+        return 0;
+}
+void PEVENT_PLUGIN_UNLOADER(struct pevent *pevent)
+{
+        pevent_unregister_print_function(pevent, process_jbd2_dev_to_name,
+                                         "jbd2_dev_to_name");
+        pevent_unregister_print_function(pevent, process_jiffies_to_msecs,
+                                         "jiffies_to_msecs");
+}
diff --git a/tools/lib/traceevent/plugin_kmem.c b/tools/lib/traceevent/plugin_kmem.c
new file mode 100644
index 000000000000..70650ff48d78
--- /dev/null
+++ b/tools/lib/traceevent/plugin_kmem.c
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) 2009 Red Hat Inc, Steven Rostedt <srostedt@redhat.com>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation;
+ * version 2.1 of the License (not later!)
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not,  see <http://www.gnu.org/licenses>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "event-parse.h"
+static int call_site_handler(struct trace_seq *s, struct pevent_record *record,
+                             struct event_format *event, void *context)
+{
+        struct format_field *field;
+        unsigned long long val, addr;
+        void *data = record->data;
+        const char *func;
+        field = pevent_find_field(event, "call_site");
+        if (!field)
+                return 1;
+        if (pevent_read_number_field(field, data, &val))
+                return 1;
+        func = pevent_find_function(event->pevent, val);
+        if (!func)
+                return 1;
+        addr = pevent_find_function_address(event->pevent, val);
+        trace_seq_printf(s, "(%s+0x%x) ", func, (int)(val - addr));
+        return 1;
+}
+int PEVENT_PLUGIN_LOADER(struct pevent *pevent)
+{
+        pevent_register_event_handler(pevent, -1, "kmem", "kfree",
+                                      call_site_handler, NULL);
+        pevent_register_event_handler(pevent, -1, "kmem", "kmalloc",
+                                      call_site_handler, NULL);
+        pevent_register_event_handler(pevent, -1, "kmem", "kmalloc_node",
+                                      call_site_handler, NULL);
+        pevent_register_event_handler(pevent, -1, "kmem", "kmem_cache_alloc",
+                                      call_site_handler, NULL);
+        pevent_register_event_handler(pevent, -1, "kmem",
+                                      "kmem_cache_alloc_node",
+                                      call_site_handler, NULL);
+        pevent_register_event_handler(pevent, -1, "kmem", "kmem_cache_free",
+                                      call_site_handler, NULL);
+        return 0;
+}
+void PEVENT_PLUGIN_UNLOADER(struct pevent *pevent)
+{
+        pevent_unregister_event_handler(pevent, -1, "kmem", "kfree",
+                                        call_site_handler, NULL);
+        pevent_unregister_event_handler(pevent, -1, "kmem", "kmalloc",
+                                        call_site_handler, NULL);
+        pevent_unregister_event_handler(pevent, -1, "kmem", "kmalloc_node",
+                                        call_site_handler, NULL);
+        pevent_unregister_event_handler(pevent, -1, "kmem", "kmem_cache_alloc",
+                                        call_site_handler, NULL);
+        pevent_unregister_event_handler(pevent, -1, "kmem",
+                                        "kmem_cache_alloc_node",
+                                        call_site_handler, NULL);
+        pevent_unregister_event_handler(pevent, -1, "kmem", "kmem_cache_free",
+                                        call_site_handler, NULL);
+}
diff --git a/tools/lib/traceevent/plugin_kvm.c b/tools/lib/traceevent/plugin_kvm.c
new file mode 100644
index 000000000000..9e0e8c61b43b
--- /dev/null
+++ b/tools/lib/traceevent/plugin_kvm.c
@@ -0,0 +1,465 @@
+/*
+ * Copyright (C) 2009 Red Hat Inc, Steven Rostedt <srostedt@redhat.com>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation;
+ * version 2.1 of the License (not later!)
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not,  see <http://www.gnu.org/licenses>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <stdint.h>
+#include "event-parse.h"
+#ifdef HAVE_UDIS86
+#include <udis86.h>
+static ud_t ud;
+static void init_disassembler(void)
+{
+        ud_init(&ud);
+        ud_set_syntax(&ud, UD_SYN_ATT);
+}
+static const char *disassemble(unsigned char *insn, int len, uint64_t rip,
+                               int cr0_pe, int eflags_vm,
+                               int cs_d, int cs_l)
+{
+        int mode;
+        if (!cr0_pe)
+                mode = 16;
+        else if (eflags_vm)
+                mode = 16;
+        else if (cs_l)
+                mode = 64;
+        else if (cs_d)
+                mode = 32;
+        else
+                mode = 16;
+        ud_set_pc(&ud, rip);
+        ud_set_mode(&ud, mode);
+        ud_set_input_buffer(&ud, insn, len);
+        ud_disassemble(&ud);
+        return ud_insn_asm(&ud);
+}
+#else
+static void init_disassembler(void)
+{
+}
+static const char *disassemble(unsigned char *insn, int len, uint64_t rip,
+                               int cr0_pe, int eflags_vm,
+                               int cs_d, int cs_l)
+{
+        static char out[15*3+1];
+        int i;
+        for (i = 0; i < len; ++i)
+                sprintf(out + i * 3, "%02x ", insn[i]);
+        out[len*3-1] = '\0';
+        return out;
+}
+#endif
+#define VMX_EXIT_REASONS                        \
+        _ER(EXCEPTION_NMI,       0)             \
+        _ER(EXTERNAL_INTERRUPT,  1)             \
+        _ER(TRIPLE_FAULT,        2)             \
+        _ER(PENDING_INTERRUPT,   7)             \
+        _ER(NMI_WINDOW,          8)             \
+        _ER(TASK_SWITCH,         9)             \
+        _ER(CPUID,               10)            \
+        _ER(HLT,                 12)            \
+        _ER(INVD,                13)            \
+        _ER(INVLPG,              14)            \
+        _ER(RDPMC,               15)            \
+        _ER(RDTSC,               16)            \
+        _ER(VMCALL,              18)            \
+        _ER(VMCLEAR,             19)            \
+        _ER(VMLAUNCH,            20)            \
+        _ER(VMPTRLD,             21)            \
+        _ER(VMPTRST,             22)            \
+        _ER(VMREAD,              23)            \
+        _ER(VMRESUME,            24)            \
+        _ER(VMWRITE,             25)            \
+        _ER(VMOFF,               26)            \
+        _ER(VMON,                27)            \
+        _ER(CR_ACCESS,           28)            \
+        _ER(DR_ACCESS,           29)            \
+        _ER(IO_INSTRUCTION,      30)            \
+        _ER(MSR_READ,            31)            \
+        _ER(MSR_WRITE,           32)            \
+        _ER(MWAIT_INSTRUCTION,   36)            \
+        _ER(MONITOR_INSTRUCTION, 39)            \
+        _ER(PAUSE_INSTRUCTION,   40)            \
+        _ER(MCE_DURING_VMENTRY,  41)            \
+        _ER(TPR_BELOW_THRESHOLD, 43)            \
+        _ER(APIC_ACCESS,         44)            \
+        _ER(EOI_INDUCED,         45)            \
+        _ER(EPT_VIOLATION,       48)            \
+        _ER(EPT_MISCONFIG,       49)            \
+        _ER(INVEPT,              50)            \
+        _ER(PREEMPTION_TIMER,    52)            \
+        _ER(WBINVD,              54)            \
+        _ER(XSETBV,              55)            \
+        _ER(APIC_WRITE,          56)            \
+        _ER(INVPCID,             58)
+#define SVM_EXIT_REASONS \
+        _ER(EXIT_READ_CR0,      0x000)          \
+        _ER(EXIT_READ_CR3,      0x003)          \
+        _ER(EXIT_READ_CR4,      0x004)          \
+        _ER(EXIT_READ_CR8,      0x008)          \
+        _ER(EXIT_WRITE_CR0,     0x010)          \
+        _ER(EXIT_WRITE_CR3,     0x013)          \
+        _ER(EXIT_WRITE_CR4,     0x014)          \
+        _ER(EXIT_WRITE_CR8,     0x018)          \
+        _ER(EXIT_READ_DR0,      0x020)          \
+        _ER(EXIT_READ_DR1,      0x021)          \
+        _ER(EXIT_READ_DR2,      0x022)          \
+        _ER(EXIT_READ_DR3,      0x023)          \
+        _ER(EXIT_READ_DR4,      0x024)          \
+        _ER(EXIT_READ_DR5,      0x025)          \
+        _ER(EXIT_READ_DR6,      0x026)          \
+        _ER(EXIT_READ_DR7,      0x027)          \
+        _ER(EXIT_WRITE_DR0,     0x030)          \
+        _ER(EXIT_WRITE_DR1,     0x031)          \
+        _ER(EXIT_WRITE_DR2,     0x032)          \
+        _ER(EXIT_WRITE_DR3,     0x033)          \
+        _ER(EXIT_WRITE_DR4,     0x034)          \
+        _ER(EXIT_WRITE_DR5,     0x035)          \
+        _ER(EXIT_WRITE_DR6,     0x036)          \
+        _ER(EXIT_WRITE_DR7,     0x037)          \
+        _ER(EXIT_EXCP_BASE,     0x040)          \
+        _ER(EXIT_INTR,          0x060)          \
+        _ER(EXIT_NMI,           0x061)          \
+        _ER(EXIT_SMI,           0x062)          \
+        _ER(EXIT_INIT,          0x063)          \
+        _ER(EXIT_VINTR,         0x064)          \
+        _ER(EXIT_CR0_SEL_WRITE, 0x065)          \
+        _ER(EXIT_IDTR_READ,     0x066)          \
+        _ER(EXIT_GDTR_READ,     0x067)          \
+        _ER(EXIT_LDTR_READ,     0x068)          \
+        _ER(EXIT_TR_READ,       0x069)          \
+        _ER(EXIT_IDTR_WRITE,    0x06a)          \
+        _ER(EXIT_GDTR_WRITE,    0x06b)          \
+        _ER(EXIT_LDTR_WRITE,    0x06c)          \
+        _ER(EXIT_TR_WRITE,      0x06d)          \
+        _ER(EXIT_RDTSC,         0x06e)          \
+        _ER(EXIT_RDPMC,         0x06f)          \
+        _ER(EXIT_PUSHF,         0x070)          \
+        _ER(EXIT_POPF,          0x071)          \
+        _ER(EXIT_CPUID,         0x072)          \
+        _ER(EXIT_RSM,           0x073)          \
+        _ER(EXIT_IRET,          0x074)          \
+        _ER(EXIT_SWINT,         0x075)          \
+        _ER(EXIT_INVD,          0x076)          \
+        _ER(EXIT_PAUSE,         0x077)          \
+        _ER(EXIT_HLT,           0x078)          \
+        _ER(EXIT_INVLPG,        0x079)          \
+        _ER(EXIT_INVLPGA,       0x07a)          \
+        _ER(EXIT_IOIO,          0x07b)          \
+        _ER(EXIT_MSR,           0x07c)          \
+        _ER(EXIT_TASK_SWITCH,   0x07d)          \
+        _ER(EXIT_FERR_FREEZE,   0x07e)          \
+        _ER(EXIT_SHUTDOWN,      0x07f)          \
+        _ER(EXIT_VMRUN,         0x080)          \
+        _ER(EXIT_VMMCALL,       0x081)          \
+        _ER(EXIT_VMLOAD,        0x082)          \
+        _ER(EXIT_VMSAVE,        0x083)          \
+        _ER(EXIT_STGI,          0x084)          \
+        _ER(EXIT_CLGI,          0x085)          \
+        _ER(EXIT_SKINIT,        0x086)          \
+        _ER(EXIT_RDTSCP,        0x087)          \
+        _ER(EXIT_ICEBP,         0x088)          \
+        _ER(EXIT_WBINVD,        0x089)          \
+        _ER(EXIT_MONITOR,       0x08a)          \
+        _ER(EXIT_MWAIT,         0x08b)          \
+        _ER(EXIT_MWAIT_COND,    0x08c)          \
+        _ER(EXIT_NPF,           0x400)          \
+        _ER(EXIT_ERR,           -1)
+#define _ER(reason, val)        { #reason, val },
+struct str_values {
+        const char      *str;
+        int             val;
+};
+static struct str_values vmx_exit_reasons[] = {
+        VMX_EXIT_REASONS
+        { NULL, -1}
+};
+static struct str_values svm_exit_reasons[] = {
+        SVM_EXIT_REASONS
+        { NULL, -1}
+};
+static struct isa_exit_reasons {
+        unsigned isa;
+        struct str_values *strings;
+} isa_exit_reasons[] = {
+        { .isa = 1, .strings = vmx_exit_reasons },
+        { .isa = 2, .strings = svm_exit_reasons },
+        { }
+};
+static const char *find_exit_reason(unsigned isa, int val)
+{
+        struct str_values *strings = NULL;
+        int i;
+        for (i = 0; isa_exit_reasons[i].strings; ++i)
+                if (isa_exit_reasons[i].isa == isa) {
+                        strings = isa_exit_reasons[i].strings;
+                        break;
+                }
+        if (!strings)
+                return "UNKNOWN-ISA";
+        for (i = 0; strings[i].val >= 0; i++)
+                if (strings[i].val == val)
+                        break;
+        if (strings[i].str)
+                return strings[i].str;
+        return "UNKNOWN";
+}
+static int kvm_exit_handler(struct trace_seq *s, struct pevent_record *record,
+                            struct event_format *event, void *context)
+{
+        unsigned long long isa;
+        unsigned long long val;
+        unsigned long long info1 = 0, info2 = 0;
+        if (pevent_get_field_val(s, event, "exit_reason", record, &val, 1) < 0)
+                return -1;
+        if (pevent_get_field_val(s, event, "isa", record, &isa, 0) < 0)
+                isa = 1;
+        trace_seq_printf(s, "reason %s", find_exit_reason(isa, val));
+        pevent_print_num_field(s, " rip 0x%lx", event, "guest_rip", record, 1);
+        if (pevent_get_field_val(s, event, "info1", record, &info1, 0) >= 0
+            && pevent_get_field_val(s, event, "info2", record, &info2, 0) >= 0)
+                trace_seq_printf(s, " info %llx %llx", info1, info2);
+        return 0;
+}
+#define KVM_EMUL_INSN_F_CR0_PE (1 << 0)
+#define KVM_EMUL_INSN_F_EFL_VM (1 << 1)
+#define KVM_EMUL_INSN_F_CS_D   (1 << 2)
+#define KVM_EMUL_INSN_F_CS_L   (1 << 3)
+static int kvm_emulate_insn_handler(struct trace_seq *s,
+                                    struct pevent_record *record,
+                                    struct event_format *event, void *context)
+{
+        unsigned long long rip, csbase, len, flags, failed;
+        int llen;
+        uint8_t *insn;
+        const char *disasm;
+        if (pevent_get_field_val(s, event, "rip", record, &rip, 1) < 0)
+                return -1;
+        if (pevent_get_field_val(s, event, "csbase", record, &csbase, 1) < 0)
+                return -1;
+        if (pevent_get_field_val(s, event, "len", record, &len, 1) < 0)
+                return -1;
+        if (pevent_get_field_val(s, event, "flags", record, &flags, 1) < 0)
+                return -1;
+        if (pevent_get_field_val(s, event, "failed", record, &failed, 1) < 0)
+                return -1;
+        insn = pevent_get_field_raw(s, event, "insn", record, &llen, 1);
+        if (!insn)
+                return -1;
+        disasm = disassemble(insn, len, rip,
+                             flags & KVM_EMUL_INSN_F_CR0_PE,
+                             flags & KVM_EMUL_INSN_F_EFL_VM,
+                             flags & KVM_EMUL_INSN_F_CS_D,
+                             flags & KVM_EMUL_INSN_F_CS_L);
+        trace_seq_printf(s, "%llx:%llx: %s%s", csbase, rip, disasm,
+                         failed ? " FAIL" : "");
+        return 0;
+}
+union kvm_mmu_page_role {
+        unsigned word;
+        struct {
+                unsigned glevels:4;
+                unsigned level:4;
+                unsigned quadrant:2;
+                unsigned pad_for_nice_hex_output:6;
+                unsigned direct:1;
+                unsigned access:3;
+                unsigned invalid:1;
+                unsigned cr4_pge:1;
+                unsigned nxe:1;
+        };
+};
+static int kvm_mmu_print_role(struct trace_seq *s, struct pevent_record *record,
+                              struct event_format *event, void *context)
+{
+        unsigned long long val;
+        static const char *access_str[] = {
+                "---", "--x", "w--", "w-x", "-u-", "-ux", "wu-", "wux"
+        };
+        union kvm_mmu_page_role role;
+        if (pevent_get_field_val(s, event, "role", record, &val, 1) < 0)
+                return -1;
+        role.word = (int)val;
+        /*
+         * We can only use the structure if file is of the same
+         * endianess.
+         */
+        if (pevent_is_file_bigendian(event->pevent) ==
+            pevent_is_host_bigendian(event->pevent)) {
+                trace_seq_printf(s, "%u/%u q%u%s %s%s %spge %snxe",
+                                 role.level,
+                                 role.glevels,
+                                 role.quadrant,
+                                 role.direct ? " direct" : "",
+                                 access_str[role.access],
+                                 role.invalid ? " invalid" : "",
+                                 role.cr4_pge ? "" : "!",
+                                 role.nxe ? "" : "!");
+        } else
+                trace_seq_printf(s, "WORD: %08x", role.word);
+        pevent_print_num_field(s, " root %u ",  event,
+                               "root_count", record, 1);
+        if (pevent_get_field_val(s, event, "unsync", record, &val, 1) < 0)
+                return -1;
+        trace_seq_printf(s, "%s%c",  val ? "unsync" : "sync", 0);
+        return 0;
+}
+static int kvm_mmu_get_page_handler(struct trace_seq *s,
+                                    struct pevent_record *record,
+                                    struct event_format *event, void *context)
+{
+        unsigned long long val;
+        if (pevent_get_field_val(s, event, "created", record, &val, 1) < 0)
+                return -1;
+        trace_seq_printf(s, "%s ", val ? "new" : "existing");
+        if (pevent_get_field_val(s, event, "gfn", record, &val, 1) < 0)
+                return -1;
+        trace_seq_printf(s, "sp gfn %llx ", val);
+        return kvm_mmu_print_role(s, record, event, context);
+}
+#define PT_WRITABLE_SHIFT 1
+#define PT_WRITABLE_MASK (1ULL << PT_WRITABLE_SHIFT)
+static unsigned long long
+process_is_writable_pte(struct trace_seq *s, unsigned long long *args)
+{
+        unsigned long pte = args[0];
+        return pte & PT_WRITABLE_MASK;
+}
+int PEVENT_PLUGIN_LOADER(struct pevent *pevent)
+{
+        init_disassembler();
+        pevent_register_event_handler(pevent, -1, "kvm", "kvm_exit",
+                                      kvm_exit_handler, NULL);
+        pevent_register_event_handler(pevent, -1, "kvm", "kvm_emulate_insn",
+                                      kvm_emulate_insn_handler, NULL);
+        pevent_register_event_handler(pevent, -1, "kvmmmu", "kvm_mmu_get_page",
+                                      kvm_mmu_get_page_handler, NULL);
+        pevent_register_event_handler(pevent, -1, "kvmmmu", "kvm_mmu_sync_page",
+                                      kvm_mmu_print_role, NULL);
+        pevent_register_event_handler(pevent, -1,
+                                      "kvmmmu", "kvm_mmu_unsync_page",
+                                      kvm_mmu_print_role, NULL);
+        pevent_register_event_handler(pevent, -1, "kvmmmu", "kvm_mmu_zap_page",
+                                      kvm_mmu_print_role, NULL);
+        pevent_register_event_handler(pevent, -1, "kvmmmu",
+                        "kvm_mmu_prepare_zap_page", kvm_mmu_print_role,
+                        NULL);
+        pevent_register_print_function(pevent,
+                                       process_is_writable_pte,
+                                       PEVENT_FUNC_ARG_INT,
+                                       "is_writable_pte",
+                                       PEVENT_FUNC_ARG_LONG,
+                                       PEVENT_FUNC_ARG_VOID);
+        return 0;
+}
+void PEVENT_PLUGIN_UNLOADER(struct pevent *pevent)
+{
+        pevent_unregister_event_handler(pevent, -1, "kvm", "kvm_exit",
+                                        kvm_exit_handler, NULL);
+        pevent_unregister_event_handler(pevent, -1, "kvm", "kvm_emulate_insn",
+                                        kvm_emulate_insn_handler, NULL);
+        pevent_unregister_event_handler(pevent, -1, "kvmmmu", "kvm_mmu_get_page",
+                                        kvm_mmu_get_page_handler, NULL);
+        pevent_unregister_event_handler(pevent, -1, "kvmmmu", "kvm_mmu_sync_page",
+                                        kvm_mmu_print_role, NULL);
+        pevent_unregister_event_handler(pevent, -1,
+                                        "kvmmmu", "kvm_mmu_unsync_page",
+                                        kvm_mmu_print_role, NULL);
+        pevent_unregister_event_handler(pevent, -1, "kvmmmu", "kvm_mmu_zap_page",
+                                        kvm_mmu_print_role, NULL);
+        pevent_unregister_event_handler(pevent, -1, "kvmmmu",
+                        "kvm_mmu_prepare_zap_page", kvm_mmu_print_role,
+                        NULL);
+        pevent_unregister_print_function(pevent, process_is_writable_pte,
+                                         "is_writable_pte");
+}
diff --git a/tools/lib/traceevent/plugin_mac80211.c b/tools/lib/traceevent/plugin_mac80211.c
new file mode 100644
index 000000000000..7e15a0f1c2fd
--- /dev/null
+++ b/tools/lib/traceevent/plugin_mac80211.c
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2009 Johannes Berg <johannes@sipsolutions.net>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation;
+ * version 2.1 of the License (not later!)
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not,  see <http://www.gnu.org/licenses>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "event-parse.h"
+#define INDENT 65
+static void print_string(struct trace_seq *s, struct event_format *event,
+                         const char *name, const void *data)
+{
+        struct format_field *f = pevent_find_field(event, name);
+        int offset;
+        int length;
+        if (!f) {
+                trace_seq_printf(s, "NOTFOUND:%s", name);
+                return;
+        }
+        offset = f->offset;
+        length = f->size;
+        if (!strncmp(f->type, "__data_loc", 10)) {
+                unsigned long long v;
+                if (pevent_read_number_field(f, data, &v)) {
+                        trace_seq_printf(s, "invalid_data_loc");
+                        return;
+                }
+                offset = v & 0xffff;
+                length = v >> 16;
+        }
+        trace_seq_printf(s, "%.*s", length, (char *)data + offset);
+}
+#define SF(fn)  pevent_print_num_field(s, fn ":%d", event, fn, record, 0)
+#define SFX(fn) pevent_print_num_field(s, fn ":%#x", event, fn, record, 0)
+#define SP()    trace_seq_putc(s, ' ')
+static int drv_bss_info_changed(struct trace_seq *s,
+                                struct pevent_record *record,
+                                struct event_format *event, void *context)
+{
+        void *data = record->data;
+        print_string(s, event, "wiphy_name", data);
+        trace_seq_printf(s, " vif:");
+        print_string(s, event, "vif_name", data);
+        pevent_print_num_field(s, "(%d)", event, "vif_type", record, 1);
+        trace_seq_printf(s, "\n%*s", INDENT, "");
+        SF("assoc"); SP();
+        SF("aid"); SP();
+        SF("cts"); SP();
+        SF("shortpre"); SP();
+        SF("shortslot"); SP();
+        SF("dtimper"); SP();
+        trace_seq_printf(s, "\n%*s", INDENT, "");
+        SF("bcnint"); SP();
+        SFX("assoc_cap"); SP();
+        SFX("basic_rates"); SP();
+        SF("enable_beacon");
+        trace_seq_printf(s, "\n%*s", INDENT, "");
+        SF("ht_operation_mode");
+        return 0;
+}
+int PEVENT_PLUGIN_LOADER(struct pevent *pevent)
+{
+        pevent_register_event_handler(pevent, -1, "mac80211",
+                                      "drv_bss_info_changed",
+                                      drv_bss_info_changed, NULL);
+        return 0;
+}
+void PEVENT_PLUGIN_UNLOADER(struct pevent *pevent)
+{
+        pevent_unregister_event_handler(pevent, -1, "mac80211",
+                                        "drv_bss_info_changed",
+                                        drv_bss_info_changed, NULL);
+}
diff --git a/tools/lib/traceevent/plugin_sched_switch.c b/tools/lib/traceevent/plugin_sched_switch.c
new file mode 100644
index 000000000000..f1ce60065258
--- /dev/null
+++ b/tools/lib/traceevent/plugin_sched_switch.c
@@ -0,0 +1,160 @@
+/*
+ * Copyright (C) 2009, 2010 Red Hat Inc, Steven Rostedt <srostedt@redhat.com>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation;
+ * version 2.1 of the License (not later!)
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this program; if not,  see <http://www.gnu.org/licenses>
+ *
+ * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ */
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "event-parse.h"
+static void write_state(struct trace_seq *s, int val)
+{
+        const char states[] = "SDTtZXxW";
+        int found = 0;
+        int i;
+        for (i = 0; i < (sizeof(states) - 1); i++) {
+                if (!(val & (1 << i)))
+                        continue;
+                if (found)
+                        trace_seq_putc(s, '|');
+                found = 1;
+                trace_seq_putc(s, states[i]);
+        }
+        if (!found)
+                trace_seq_putc(s, 'R');
+}
+static void write_and_save_comm(struct format_field *field,
+                                struct pevent_record *record,
+                                struct trace_seq *s, int pid)
+{
+        const char *comm;
+        int len;
+        comm = (char *)(record->data + field->offset);
+        len = s->len;
+        trace_seq_printf(s, "%.*s",
+                         field->size, comm);
+        /* make sure the comm has a \0 at the end. */
+        trace_seq_terminate(s);
+        comm = &s->buffer[len];
+        /* Help out the comm to ids. This will handle dups */
+        pevent_register_comm(field->event->pevent, comm, pid);
+}
+static int sched_wakeup_handler(struct trace_seq *s,
+                                struct pevent_record *record,
+                                struct event_format *event, void *context)
+{
+        struct format_field *field;
+        unsigned long long val;
+        if (pevent_get_field_val(s, event, "pid", record, &val, 1))
+                return trace_seq_putc(s, '!');
+        field = pevent_find_any_field(event, "comm");
+        if (field) {
+                write_and_save_comm(field, record, s, val);
+                trace_seq_putc(s, ':');
+        }
+        trace_seq_printf(s, "%lld", val);
+        if (pevent_get_field_val(s, event, "prio", record, &val, 0) == 0)
+                trace_seq_printf(s, " [%lld]", val);
+        if (pevent_get_field_val(s, event, "success", record, &val, 1) == 0)
+                trace_seq_printf(s, " success=%lld", val);
+        if (pevent_get_field_val(s, event, "target_cpu", record, &val, 0) == 0)
+                trace_seq_printf(s, " CPU:%03llu", val);
+        return 0;
+}
+static int sched_switch_handler(struct trace_seq *s,
+                                struct pevent_record *record,
+                                struct event_format *event, void *context)
+{
+        struct format_field *field;
+        unsigned long long val;
+        if (pevent_get_field_val(s, event, "prev_pid", record, &val, 1))
+                return trace_seq_putc(s, '!');
+        field = pevent_find_any_field(event, "prev_comm");
+        if (field) {
+                write_and_save_comm(field, record, s, val);
+                trace_seq_putc(s, ':');
+        }
+        trace_seq_printf(s, "%lld ", val);
+        if (pevent_get_field_val(s, event, "prev_prio", record, &val, 0) == 0)
+                trace_seq_printf(s, "[%lld] ", val);
+        if (pevent_get_field_val(s,  event, "prev_state", record, &val, 0) == 0)
+                write_state(s, val);
+        trace_seq_puts(s, " ==> ");
+        if (pevent_get_field_val(s, event, "next_pid", record, &val, 1))
+                return trace_seq_putc(s, '!');
+        field = pevent_find_any_field(event, "next_comm");
+        if (field) {
+                write_and_save_comm(field, record, s, val);
+                trace_seq_putc(s, ':');
+        }
+        trace_seq_printf(s, "%lld", val);
+        if (pevent_get_field_val(s, event, "next_prio", record, &val, 0) == 0)
+                trace_seq_printf(s, " [%lld]", val);
+        return 0;
+}
+int PEVENT_PLUGIN_LOADER(struct pevent *pevent)
+{
+        pevent_register_event_handler(pevent, -1, "sched", "sched_switch",
+                                      sched_switch_handler, NULL);
+        pevent_register_event_handler(pevent, -1, "sched", "sched_wakeup",
+                                      sched_wakeup_handler, NULL);
+        pevent_register_event_handler(pevent, -1, "sched", "sched_wakeup_new",
+                                      sched_wakeup_handler, NULL);
+        return 0;
+}
+void PEVENT_PLUGIN_UNLOADER(struct pevent *pevent)
+{
+        pevent_unregister_event_handler(pevent, -1, "sched", "sched_switch",
+                                        sched_switch_handler, NULL);
+        pevent_unregister_event_handler(pevent, -1, "sched", "sched_wakeup",
+                                        sched_wakeup_handler, NULL);
+        pevent_unregister_event_handler(pevent, -1, "sched", "sched_wakeup_new",
+                                        sched_wakeup_handler, NULL);
+}
diff --git a/tools/lib/traceevent/plugin_scsi.c b/tools/lib/traceevent/plugin_scsi.c
new file mode 100644
index 000000000000..eda326fc8620
--- /dev/null
+++ b/tools/lib/traceevent/plugin_scsi.c
@@ -0,0 +1,429 @@
+#include <stdio.h>
+#include <string.h>
+#include <inttypes.h>
+#include "event-parse.h"
+typedef unsigned long sector_t;
+typedef uint64_t u64;
+typedef unsigned int u32;
+/*
+ *      SCSI opcodes
+ */
+#define TEST_UNIT_READY                 0x00
+#define REZERO_UNIT                     0x01
+#define REQUEST_SENSE                   0x03
+#define FORMAT_UNIT                     0x04
+#define READ_BLOCK_LIMITS               0x05
+#define REASSIGN_BLOCKS                 0x07
+#define INITIALIZE_ELEMENT_STATUS       0x07
+#define READ_6                          0x08
+#define WRITE_6                         0x0a
+#define SEEK_6                          0x0b
+#define READ_REVERSE                    0x0f
+#define WRITE_FILEMARKS                 0x10
+#define SPACE                           0x11
+#define INQUIRY                         0x12
+#define RECOVER_BUFFERED_DATA           0x14
+#define MODE_SELECT                     0x15
+#define RESERVE                         0x16
+#define RELEASE                         0x17
+#define COPY                            0x18
+#define ERASE                           0x19
+#define MODE_SENSE                      0x1a
+#define START_STOP                      0x1b
+#define RECEIVE_DIAGNOSTIC              0x1c
+#define SEND_DIAGNOSTIC                 0x1d
+#define ALLOW_MEDIUM_REMOVAL            0x1e
+#define READ_FORMAT_CAPACITIES          0x23
+#define SET_WINDOW                      0x24
+#define READ_CAPACITY                   0x25
+#define READ_10                         0x28
+#define WRITE_10                        0x2a
+#define SEEK_10                         0x2b
+#define POSITION_TO_ELEMENT             0x2b
+#define WRITE_VERIFY                    0x2e
+#define VERIFY                          0x2f
+#define SEARCH_HIGH                     0x30
+#define SEARCH_EQUAL                    0x31
+#define SEARCH_LOW                      0x32
+#define SET_LIMITS                      0x33
+#define PRE_FETCH                       0x34
+#define READ_POSITION                   0x34
+#define SYNCHRONIZE_CACHE               0x35
+#define LOCK_UNLOCK_CACHE               0x36
+#define READ_DEFECT_DATA                0x37
+#define MEDIUM_SCAN                     0x38
+#define COMPARE                         0x39
+#define COPY_VERIFY                     0x3a
+#define WRITE_BUFFER                    0x3b
+#define READ_BUFFER                     0x3c
+#define UPDATE_BLOCK                    0x3d
+#define READ_LONG                       0x3e
+#define WRITE_LONG                      0x3f
+#define CHANGE_DEFINITION               0x40
+#define WRITE_SAME                      0x41
+#define UNMAP                           0x42
+#define READ_TOC                        0x43
+#define READ_HEADER                     0x44
+#define GET_EVENT_STATUS_NOTIFICATION   0x4a
+#define LOG_SELECT                      0x4c
+#define LOG_SENSE                       0x4d
+#define XDWRITEREAD_10                  0x53
+#define MODE_SELECT_10                  0x55
+#define RESERVE_10                      0x56
+#define RELEASE_10                      0x57
+#define MODE_SENSE_10                   0x5a
+#define PERSISTENT_RESERVE_IN           0x5e
+#define PERSISTENT_RESERVE_OUT          0x5f
+#define VARIABLE_LENGTH_CMD             0x7f
+#define REPORT_LUNS                     0xa0
+#define SECURITY_PROTOCOL_IN            0xa2
+#define MAINTENANCE_IN                  0xa3
+#define MAINTENANCE_OUT                 0xa4
+#define MOVE_MEDIUM                     0xa5
+#define EXCHANGE_MEDIUM                 0xa6
+#define READ_12                         0xa8
+#define WRITE_12                        0xaa
+#define READ_MEDIA_SERIAL_NUMBER        0xab
+#define WRITE_VERIFY_12                 0xae
+#define VERIFY_12                       0xaf
+#define SEARCH_HIGH_12                  0xb0
+#define SEARCH_EQUAL_12                 0xb1
+#define SEARCH_LOW_12                   0xb2
+#define SECURITY_PROTOCOL_OUT           0xb5
+#define READ_ELEMENT_STATUS             0xb8
+#define SEND_VOLUME_TAG                 0xb6
+#define WRITE_LONG_2                    0xea
+#define EXTENDED_COPY                   0x83
+#define RECEIVE_COPY_RESULTS            0x84
+#define ACCESS_CONTROL_IN               0x86
+#define ACCESS_CONTROL_OUT              0x87
+#define READ_16                         0x88
+#define WRITE_16                        0x8a
+#define READ_ATTRIBUTE                  0x8c
+#define WRITE_ATTRIBUTE                 0x8d
+#define VERIFY_16                       0x8f
+#define SYNCHRONIZE_CACHE_16            0x91
+#define WRITE_SAME_16                   0x93
+#define SERVICE_ACTION_IN               0x9e
+/* values for service action in */
+#define SAI_READ_CAPACITY_16            0x10
+#define SAI_GET_LBA_STATUS              0x12
+/* values for VARIABLE_LENGTH_CMD service action codes
+ * see spc4r17 Section D.3.5, table D.7 and D.8 */
+#define VLC_SA_RECEIVE_CREDENTIAL       0x1800
+/* values for maintenance in */
+#define MI_REPORT_IDENTIFYING_INFORMATION               0x05
+#define MI_REPORT_TARGET_PGS                            0x0a
+#define MI_REPORT_ALIASES                               0x0b
+#define MI_REPORT_SUPPORTED_OPERATION_CODES             0x0c
+#define MI_REPORT_SUPPORTED_TASK_MANAGEMENT_FUNCTIONS   0x0d
+#define MI_REPORT_PRIORITY                              0x0e
+#define MI_REPORT_TIMESTAMP                             0x0f
+#define MI_MANAGEMENT_PROTOCOL_IN                       0x10
+/* value for MI_REPORT_TARGET_PGS ext header */
+#define MI_EXT_HDR_PARAM_FMT            0x20
+/* values for maintenance out */
+#define MO_SET_IDENTIFYING_INFORMATION  0x06
+#define MO_SET_TARGET_PGS               0x0a
+#define MO_CHANGE_ALIASES               0x0b
+#define MO_SET_PRIORITY                 0x0e
+#define MO_SET_TIMESTAMP                0x0f
+#define MO_MANAGEMENT_PROTOCOL_OUT      0x10
+/* values for variable length command */
+#define XDREAD_32                       0x03
+#define XDWRITE_32                      0x04
+#define XPWRITE_32                      0x06
+#define XDWRITEREAD_32                  0x07
+#define READ_32                         0x09
+#define VERIFY_32                       0x0a
+#define WRITE_32                        0x0b
+#define WRITE_SAME_32                   0x0d
+#define SERVICE_ACTION16(cdb) (cdb[1] & 0x1f)
+#define SERVICE_ACTION32(cdb) ((cdb[8] << 8) | cdb[9])
+static const char *
+scsi_trace_misc(struct trace_seq *, unsigned char *, int);
+static const char *
+scsi_trace_rw6(struct trace_seq *p, unsigned char *cdb, int len)
+{
+        const char *ret = p->buffer + p->len;
+        sector_t lba = 0, txlen = 0;
+        lba |= ((cdb[1] & 0x1F) << 16);
+        lba |=  (cdb[2] << 8);
+        lba |=   cdb[3];
+        txlen = cdb[4];
+        trace_seq_printf(p, "lba=%llu txlen=%llu",
+                         (unsigned long long)lba, (unsigned long long)txlen);
+        trace_seq_putc(p, 0);
+        return ret;
+}
+static const char *
+scsi_trace_rw10(struct trace_seq *p, unsigned char *cdb, int len)
+{
+        const char *ret = p->buffer + p->len;
+        sector_t lba = 0, txlen = 0;
+        lba |= (cdb[2] << 24);
+        lba |= (cdb[3] << 16);
+        lba |= (cdb[4] << 8);
+        lba |=  cdb[5];
+        txlen |= (cdb[7] << 8);
+        txlen |=  cdb[8];
+        trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u",
+                         (unsigned long long)lba, (unsigned long long)txlen,
+                         cdb[1] >> 5);
+        if (cdb[0] == WRITE_SAME)
+                trace_seq_printf(p, " unmap=%u", cdb[1] >> 3 & 1);
+        trace_seq_putc(p, 0);
+        return ret;
+}
+static const char *
+scsi_trace_rw12(struct trace_seq *p, unsigned char *cdb, int len)
+{
+        const char *ret = p->buffer + p->len;
+        sector_t lba = 0, txlen = 0;
+        lba |= (cdb[2] << 24);
+        lba |= (cdb[3] << 16);
+        lba |= (cdb[4] << 8);
+        lba |=  cdb[5];
+        txlen |= (cdb[6] << 24);
+        txlen |= (cdb[7] << 16);
+        txlen |= (cdb[8] << 8);
+        txlen |=  cdb[9];
+        trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u",
+                         (unsigned long long)lba, (unsigned long long)txlen,
+                         cdb[1] >> 5);
+        trace_seq_putc(p, 0);
+        return ret;
+}
+static const char *
+scsi_trace_rw16(struct trace_seq *p, unsigned char *cdb, int len)
+{
+        const char *ret = p->buffer + p->len;
+        sector_t lba = 0, txlen = 0;
+        lba |= ((u64)cdb[2] << 56);
+        lba |= ((u64)cdb[3] << 48);
+        lba |= ((u64)cdb[4] << 40);
+        lba |= ((u64)cdb[5] << 32);
+        lba |= (cdb[6] << 24);
+        lba |= (cdb[7] << 16);
+        lba |= (cdb[8] << 8);
+        lba |=  cdb[9];
+        txlen |= (cdb[10] << 24);
+        txlen |= (cdb[11] << 16);
+        txlen |= (cdb[12] << 8);
+        txlen |=  cdb[13];
+        trace_seq_printf(p, "lba=%llu txlen=%llu protect=%u",
+                         (unsigned long long)lba, (unsigned long long)txlen,
+                         cdb[1] >> 5);
+        if (cdb[0] == WRITE_SAME_16)
+                trace_seq_printf(p, " unmap=%u", cdb[1] >> 3 & 1);
+        trace_seq_putc(p, 0);
+        return ret;
+}
+static const char *
+scsi_trace_rw32(struct trace_seq *p, unsigned char *cdb, int len)
+{
+        const char *ret = p->buffer + p->len, *cmd;
+        sector_t lba = 0, txlen = 0;
+        u32 ei_lbrt = 0;
+        switch (SERVICE_ACTION32(cdb)) {
+        case READ_32:
+                cmd = "READ";
+                break;
+        case VERIFY_32:
+                cmd = "VERIFY";
+                break;
+        case WRITE_32:
+                cmd = "WRITE";
+                break;
+        case WRITE_SAME_32:
+                cmd = "WRITE_SAME";
+                break;
+        default:
+                trace_seq_printf(p, "UNKNOWN");
+                goto out;
+        }
+        lba |= ((u64)cdb[12] << 56);
+        lba |= ((u64)cdb[13] << 48);
+        lba |= ((u64)cdb[14] << 40);
+        lba |= ((u64)cdb[15] << 32);
+        lba |= (cdb[16] << 24);
+        lba |= (cdb[17] << 16);
+        lba |= (cdb[18] << 8);
+        lba |=  cdb[19];
+        ei_lbrt |= (cdb[20] << 24);
+        ei_lbrt |= (cdb[21] << 16);
+        ei_lbrt |= (cdb[22] << 8);
+        ei_lbrt |=  cdb[23];
+        txlen |= (cdb[28] << 24);
+        txlen |= (cdb[29] << 16);
+        txlen |= (cdb[30] << 8);
+        txlen |=  cdb[31];
+        trace_seq_printf(p, "%s_32 lba=%llu txlen=%llu protect=%u ei_lbrt=%u",
+                         cmd, (unsigned long long)lba,
+                         (unsigned long long)txlen, cdb[10] >> 5, ei_lbrt);
+        if (SERVICE_ACTION32(cdb) == WRITE_SAME_32)
+                trace_seq_printf(p, " unmap=%u", cdb[10] >> 3 & 1);
+out:
+        trace_seq_putc(p, 0);
+        return ret;
+}
+static const char *
+scsi_trace_unmap(struct trace_seq *p, unsigned char *cdb, int len)
+{
+        const char *ret = p->buffer + p->len;
+        unsigned int regions = cdb[7] << 8 | cdb[8];
+        trace_seq_printf(p, "regions=%u", (regions - 8) / 16);
+        trace_seq_putc(p, 0);
+        return ret;
+}
+static const char *
+scsi_trace_service_action_in(struct trace_seq *p, unsigned char *cdb, int len)
+{
+        const char *ret = p->buffer + p->len, *cmd;
+        sector_t lba = 0;
+        u32 alloc_len = 0;
+        switch (SERVICE_ACTION16(cdb)) {
+        case SAI_READ_CAPACITY_16:
+                cmd = "READ_CAPACITY_16";
+                break;
+        case SAI_GET_LBA_STATUS:
+                cmd = "GET_LBA_STATUS";
+                break;
+        default:
+                trace_seq_printf(p, "UNKNOWN");
+                goto out;
+        }
+        lba |= ((u64)cdb[2] << 56);
+        lba |= ((u64)cdb[3] << 48);
+        lba |= ((u64)cdb[4] << 40);
+        lba |= ((u64)cdb[5] << 32);
+        lba |= (cdb[6] << 24);
+        lba |= (cdb[7] << 16);
+        lba |= (cdb[8] << 8);
+        lba |=  cdb[9];
+        alloc_len |= (cdb[10] << 24);
+        alloc_len |= (cdb[11] << 16);
+        alloc_len |= (cdb[12] << 8);
+        alloc_len |=  cdb[13];
+        trace_seq_printf(p, "%s lba=%llu alloc_len=%u", cmd,
+                         (unsigned long long)lba, alloc_len);
+out:
+        trace_seq_putc(p, 0);
+        return ret;
+}
+static const char *
+scsi_trace_varlen(struct trace_seq *p, unsigned char *cdb, int len)
+{
+        switch (SERVICE_ACTION32(cdb)) {
+        case READ_32:
+        case VERIFY_32:
+        case WRITE_32:
+        case WRITE_SAME_32:
+                return scsi_trace_rw32(p, cdb, len);
+        default:
+                return scsi_trace_misc(p, cdb, len);
+        }
+}
+static const char *
+scsi_trace_misc(struct trace_seq *p, unsigned char *cdb, int len)
+{
+        const char *ret = p->buffer + p->len;
+        trace_seq_printf(p, "-");
+        trace_seq_putc(p, 0);
+        return ret;
+}
+const char *
+scsi_trace_parse_cdb(struct trace_seq *p, unsigned char *cdb, int len)
+{
+        switch (cdb[0]) {
+        case READ_6:
+        case WRITE_6:
+                return scsi_trace_rw6(p, cdb, len);
+        case READ_10:
+        case VERIFY:
+        case WRITE_10:
+        case WRITE_SAME:
+                return scsi_trace_rw10(p, cdb, len);
+        case READ_12:
+        case VERIFY_12:
+        case WRITE_12:
+                return scsi_trace_rw12(p, cdb, len);
+        case READ_16:
+        case VERIFY_16:
+        case WRITE_16:
+        case WRITE_SAME_16:
+                return scsi_trace_rw16(p, cdb, len);
+        case UNMAP:
+                return scsi_trace_unmap(p, cdb, len);
+        case SERVICE_ACTION_IN:
+                return scsi_trace_service_action_in(p, cdb, len);
+        case VARIABLE_LENGTH_CMD:
+                return scsi_trace_varlen(p, cdb, len);
+        default:
+                return scsi_trace_misc(p, cdb, len);
+        }
+}
+unsigned long long process_scsi_trace_parse_cdb(struct trace_seq *s,
+                                                unsigned long long *args)
+{
+        scsi_trace_parse_cdb(s, (unsigned char *) (unsigned long) args[1], args[2]);
+        return 0;
+}
+int PEVENT_PLUGIN_LOADER(struct pevent *pevent)
+{
+        pevent_register_print_function(pevent,
+                                       process_scsi_trace_parse_cdb,
+                                       PEVENT_FUNC_ARG_STRING,
+                                       "scsi_trace_parse_cdb",
+                                       PEVENT_FUNC_ARG_PTR,
+                                       PEVENT_FUNC_ARG_PTR,
+                                       PEVENT_FUNC_ARG_INT,
+                                       PEVENT_FUNC_ARG_VOID);
+        return 0;
+}
+void PEVENT_PLUGIN_UNLOADER(struct pevent *pevent)
+{
+        pevent_unregister_print_function(pevent, process_scsi_trace_parse_cdb,
+                                         "scsi_trace_parse_cdb");
+}
diff --git a/tools/lib/traceevent/plugin_xen.c b/tools/lib/traceevent/plugin_xen.c
new file mode 100644
index 000000000000..3a413eaada68
--- /dev/null
+++ b/tools/lib/traceevent/plugin_xen.c
@@ -0,0 +1,136 @@
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include "event-parse.h"
+#define __HYPERVISOR_set_trap_table                     0
+#define __HYPERVISOR_mmu_update                         1
+#define __HYPERVISOR_set_gdt                            2
+#define __HYPERVISOR_stack_switch                       3
+#define __HYPERVISOR_set_callbacks                      4
+#define __HYPERVISOR_fpu_taskswitch                     5
+#define __HYPERVISOR_sched_op_compat                    6
+#define __HYPERVISOR_dom0_op                            7
+#define __HYPERVISOR_set_debugreg                       8
+#define __HYPERVISOR_get_debugreg                       9
+#define __HYPERVISOR_update_descriptor                  10
+#define __HYPERVISOR_memory_op                          12
+#define __HYPERVISOR_multicall                          13
+#define __HYPERVISOR_update_va_mapping                  14
+#define __HYPERVISOR_set_timer_op                       15
+#define __HYPERVISOR_event_channel_op_compat            16
+#define __HYPERVISOR_xen_version                        17
+#define __HYPERVISOR_console_io                         18
+#define __HYPERVISOR_physdev_op_compat                  19
+#define __HYPERVISOR_grant_table_op                     20
+#define __HYPERVISOR_vm_assist                          21
+#define __HYPERVISOR_update_va_mapping_otherdomain      22
+#define __HYPERVISOR_iret                               23 /* x86 only */
+#define __HYPERVISOR_vcpu_op                            24
+#define __HYPERVISOR_set_segment_base                   25 /* x86/64 only */
+#define __HYPERVISOR_mmuext_op                          26
+#define __HYPERVISOR_acm_op                             27
+#define __HYPERVISOR_nmi_op                             28
+#define __HYPERVISOR_sched_op                           29
+#define __HYPERVISOR_callback_op                        30
+#define __HYPERVISOR_xenoprof_op                        31
+#define __HYPERVISOR_event_channel_op                   32
+#define __HYPERVISOR_physdev_op                         33
+#define __HYPERVISOR_hvm_op                             34
+#define __HYPERVISOR_tmem_op                            38
+/* Architecture-specific hypercall definitions. */
+#define __HYPERVISOR_arch_0                             48
+#define __HYPERVISOR_arch_1                             49
+#define __HYPERVISOR_arch_2                             50
+#define __HYPERVISOR_arch_3                             51
+#define __HYPERVISOR_arch_4                             52
+#define __HYPERVISOR_arch_5                             53
+#define __HYPERVISOR_arch_6                             54
+#define __HYPERVISOR_arch_7                             55
+#define N(x)    [__HYPERVISOR_##x] = "("#x")"
+static const char *xen_hypercall_names[] = {
+        N(set_trap_table),
+        N(mmu_update),
+        N(set_gdt),
+        N(stack_switch),
+        N(set_callbacks),
+        N(fpu_taskswitch),
+        N(sched_op_compat),
+        N(dom0_op),
+        N(set_debugreg),
+        N(get_debugreg),
+        N(update_descriptor),
+        N(memory_op),
+        N(multicall),
+        N(update_va_mapping),
+        N(set_timer_op),
+        N(event_channel_op_compat),
+        N(xen_version),
+        N(console_io),
+        N(physdev_op_compat),
+        N(grant_table_op),
+        N(vm_assist),
+        N(update_va_mapping_otherdomain),
+        N(iret),
+        N(vcpu_op),
+        N(set_segment_base),
+        N(mmuext_op),
+        N(acm_op),
+        N(nmi_op),
+        N(sched_op),
+        N(callback_op),
+        N(xenoprof_op),
+        N(event_channel_op),
+        N(physdev_op),
+        N(hvm_op),
+/* Architecture-specific hypercall definitions. */
+        N(arch_0),
+        N(arch_1),
+        N(arch_2),
+        N(arch_3),
+        N(arch_4),
+        N(arch_5),
+        N(arch_6),
+        N(arch_7),
+};
+#undef N
+#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]))
+static const char *xen_hypercall_name(unsigned op)
+{
+        if (op < ARRAY_SIZE(xen_hypercall_names) &&
+            xen_hypercall_names[op] != NULL)
+                return xen_hypercall_names[op];
+        return "";
+}
+unsigned long long process_xen_hypercall_name(struct trace_seq *s,
+                                              unsigned long long *args)
+{
+        unsigned int op = args[0];
+        trace_seq_printf(s, "%s", xen_hypercall_name(op));
+        return 0;
+}
+int PEVENT_PLUGIN_LOADER(struct pevent *pevent)
+{
+        pevent_register_print_function(pevent,
+                                       process_xen_hypercall_name,
+                                       PEVENT_FUNC_ARG_STRING,
+                                       "xen_hypercall_name",
+                                       PEVENT_FUNC_ARG_INT,
+                                       PEVENT_FUNC_ARG_VOID);
+        return 0;
+}
+void PEVENT_PLUGIN_UNLOADER(struct pevent *pevent)
+{
+        pevent_unregister_print_function(pevent, process_xen_hypercall_name,
+                                         "xen_hypercall_name");
+}
diff --git a/tools/lib/traceevent/trace-seq.c b/tools/lib/traceevent/trace-seq.c
index d7f2e68bc5b9..ec3bd16a5488 100644
--- a/tools/lib/traceevent/trace-seq.c
+++ b/tools/lib/traceevent/trace-seq.c
@@ -22,6 +22,7 @@
 #include <string.h>
 #include <stdarg.h>
+#include <asm/bug.h>
 #include "event-parse.h"
 #include "event-utils.h"
@@ -32,10 +33,21 @@
 #define TRACE_SEQ_POISON        ((void *)0xdeadbeef)
 #define TRACE_SEQ_CHECK(s)                                              \
 do {                                                                    \
-        if ((s)->buffer == TRACE_SEQ_POISON)                    \
+        if (WARN_ONCE((s)->buffer == TRACE_SEQ_POISON,                  \
-                die("Usage of trace_seq after it was destroyed");       \
+                      "Usage of trace_seq after it was destroyed"))     \
+                (s)->state = TRACE_SEQ__BUFFER_POISONED;                \
 } while (0)
+#define TRACE_SEQ_CHECK_RET_N(s, n)             \
+do {                                            \
+        TRACE_SEQ_CHECK(s);                     \
+        if ((s)->state != TRACE_SEQ__GOOD)      \
+                return n;                       \
+} while (0)
+#define TRACE_SEQ_CHECK_RET(s)   TRACE_SEQ_CHECK_RET_N(s, )
+#define TRACE_SEQ_CHECK_RET0(s)  TRACE_SEQ_CHECK_RET_N(s, 0)
 /**
 * trace_seq_init - initialize the trace_seq structure
 * @s: a pointer to the trace_seq structure to initialize
@@ -45,7 +57,11 @@ void trace_seq_init(struct trace_seq *s)
        s->len = 0;
        s->readpos = 0;
        s->buffer_size = TRACE_SEQ_BUF_SIZE;
-        s->buffer = malloc_or_die(s->buffer_size);
+        s->buffer = malloc(s->buffer_size);
+        if (s->buffer != NULL)
+                s->state = TRACE_SEQ__GOOD;
+        else
+                s->state = TRACE_SEQ__MEM_ALLOC_FAILED;
 }
 /**
@@ -71,17 +87,23 @@ void trace_seq_destroy(struct trace_seq *s)
 {
        if (!s)
                return;
-        TRACE_SEQ_CHECK(s);
+        TRACE_SEQ_CHECK_RET(s);
        free(s->buffer);
        s->buffer = TRACE_SEQ_POISON;
 }
 static void expand_buffer(struct trace_seq *s)
 {
+        char *buf;
+        buf = realloc(s->buffer, s->buffer_size + TRACE_SEQ_BUF_SIZE);
+        if (WARN_ONCE(!buf, "Can't allocate trace_seq buffer memory")) {
+                s->state = TRACE_SEQ__MEM_ALLOC_FAILED;
+                return;
+        }
+        s->buffer = buf;
        s->buffer_size += TRACE_SEQ_BUF_SIZE;
-        s->buffer = realloc(s->buffer, s->buffer_size);
-        if (!s->buffer)
-                die("Can't allocate trace_seq buffer memory");
 }
 /**
@@ -105,9 +127,9 @@ trace_seq_printf(struct trace_seq *s, const char *fmt, ...)
        int len;
        int ret;
-        TRACE_SEQ_CHECK(s);
 try_again:
+        TRACE_SEQ_CHECK_RET0(s);
        len = (s->buffer_size - 1) - s->len;
        va_start(ap, fmt);
@@ -141,9 +163,9 @@ trace_seq_vprintf(struct trace_seq *s, const char *fmt, va_list args)
        int len;
        int ret;
-        TRACE_SEQ_CHECK(s);
 try_again:
+        TRACE_SEQ_CHECK_RET0(s);
        len = (s->buffer_size - 1) - s->len;
        ret = vsnprintf(s->buffer + s->len, len, fmt, args);
@@ -172,13 +194,15 @@ int trace_seq_puts(struct trace_seq *s, const char *str)
 {
        int len;
-        TRACE_SEQ_CHECK(s);
+        TRACE_SEQ_CHECK_RET0(s);
        len = strlen(str);
        while (len > ((s->buffer_size - 1) - s->len))
                expand_buffer(s);
+        TRACE_SEQ_CHECK_RET0(s);
        memcpy(s->buffer + s->len, str, len);
        s->len += len;
@@ -187,11 +211,13 @@ int trace_seq_puts(struct trace_seq *s, const char *str)
 int trace_seq_putc(struct trace_seq *s, unsigned char c)
 {
-        TRACE_SEQ_CHECK(s);
+        TRACE_SEQ_CHECK_RET0(s);
        while (s->len >= (s->buffer_size - 1))
                expand_buffer(s);
+        TRACE_SEQ_CHECK_RET0(s);
        s->buffer[s->len++] = c;
        return 1;
@@ -199,7 +225,7 @@ int trace_seq_putc(struct trace_seq *s, unsigned char c)
 void trace_seq_terminate(struct trace_seq *s)
 {
-        TRACE_SEQ_CHECK(s);
+        TRACE_SEQ_CHECK_RET(s);
        /* There's always one character left on the buffer */
        s->buffer[s->len] = 0;
@@ -208,5 +234,16 @@ void trace_seq_terminate(struct trace_seq *s)
 int trace_seq_do_printf(struct trace_seq *s)
 {
        TRACE_SEQ_CHECK(s);
-        return printf("%.*s", s->len, s->buffer);
+        switch (s->state) {
+        case TRACE_SEQ__GOOD:
+                return printf("%.*s", s->len, s->buffer);
+        case TRACE_SEQ__BUFFER_POISONED:
+                puts("Usage of trace_seq after it was destroyed");
+                break;
+        case TRACE_SEQ__MEM_ALLOC_FAILED:
+                puts("Can't allocate trace_seq buffer memory");
+                break;
+        }
+        return -1;
 }
diff --git a/tools/perf/Documentation/perf-archive.txt b/tools/perf/Documentation/perf-archive.txt
index 5032a142853e..ac6ecbb3e669 100644
--- a/tools/perf/Documentation/perf-archive.txt
+++ b/tools/perf/Documentation/perf-archive.txt
@@ -12,9 +12,9 @@ SYNOPSIS
 DESCRIPTION
 -----------
-This command runs runs perf-buildid-list --with-hits, and collects the files
+This command runs perf-buildid-list --with-hits, and collects the files with the
-with the buildids found so that analysis of perf.data contents can be possible
+buildids found so that analysis of perf.data contents can be possible on another
-on another machine.
+machine.
 SEE ALSO
diff --git a/tools/perf/Documentation/perf-kvm.txt b/tools/perf/Documentation/perf-kvm.txt
index 6a06cefe9642..52276a6d2b75 100644
--- a/tools/perf/Documentation/perf-kvm.txt
+++ b/tools/perf/Documentation/perf-kvm.txt
@@ -10,9 +10,9 @@ SYNOPSIS
 [verse]
 'perf kvm' [--host] [--guest] [--guestmount=<path>
        [--guestkallsyms=<path> --guestmodules=<path> | --guestvmlinux=<path>]]
-        {top|record|report|diff|buildid-list}
+        {top|record|report|diff|buildid-list} [<options>]
 'perf kvm' [--host] [--guest] [--guestkallsyms=<path> --guestmodules=<path>
-        | --guestvmlinux=<path>] {top|record|report|diff|buildid-list|stat}
+        | --guestvmlinux=<path>] {top|record|report|diff|buildid-list|stat} [<options>]
 'perf kvm stat [record|report|live] [<options>]
 DESCRIPTION
@@ -24,10 +24,17 @@ There are a couple of variants of perf kvm:
  of an arbitrary workload.
  'perf kvm record <command>' to record the performance counter profile
-  of an arbitrary workload and save it into a perf data file. If both
+  of an arbitrary workload and save it into a perf data file. We set the
-  --host and --guest are input, the perf data file name is perf.data.kvm.
+  default behavior of perf kvm as --guest, so if neither --host nor --guest
-  If there is  no --host but --guest, the file name is perf.data.guest.
+  is input, the perf data file name is perf.data.guest. If --host is input,
-  If there is no --guest but --host, the file name is perf.data.host.
+  the perf data file name is perf.data.kvm. If you want to record data into
+  perf.data.host, please input --host --no-guest. The behaviors are shown as
+  following:
+    Default('')         ->  perf.data.guest
+    --host              ->  perf.data.kvm
+    --guest             ->  perf.data.guest
+    --host --guest      ->  perf.data.kvm
+    --host --no-guest   ->  perf.data.host
  'perf kvm report' to display the performance counter profile information
  recorded via perf kvm record.
@@ -37,7 +44,9 @@ There are a couple of variants of perf kvm:
  'perf kvm buildid-list' to  display the buildids found in a perf data file,
  so that other tools can be used to fetch packages with matching symbol tables
-  for use by perf report.
+  for use by perf report. As buildid is read from /sys/kernel/notes in os, then
+  if you want to list the buildid for guest, please make sure your perf data file
+  was captured with --guestmount in perf kvm record.
  'perf kvm stat <command>' to run a command and gather performance counter
  statistics.
@@ -58,14 +67,14 @@ There are a couple of variants of perf kvm:
 OPTIONS
 -------
 -i::
--input=::
+--input=<path>::
        Input file name.
 -o::
--output::
+--output=<path>::
        Output file name.
--host=::
+--host::
        Collect host side performance profile.
--guest=::
+--guest::
        Collect guest side performance profile.
 --guestmount=<path>::
        Guest os root file system mount directory. Users mounts guest os
@@ -84,6 +93,9 @@ OPTIONS
        kernel module information. Users copy it out from guest os.
 --guestvmlinux=<path>::
        Guest os kernel vmlinux.
+-v::
+--verbose::
+        Be more verbose (show counter open errors, etc).
 STAT REPORT OPTIONS
 -------------------
diff --git a/tools/perf/Documentation/perf-record.txt b/tools/perf/Documentation/perf-record.txt
index 43b42c4f4a91..c71b0f36d9e8 100644
--- a/tools/perf/Documentation/perf-record.txt
+++ b/tools/perf/Documentation/perf-record.txt
@@ -57,6 +57,8 @@ OPTIONS
 -t::
 --tid=::
        Record events on existing thread ID (comma separated list).
+        This option also disables inheritance by default.  Enable it by adding
+        --inherit.
 -u::
 --uid=::
@@ -66,8 +68,7 @@ OPTIONS
 --realtime=::
        Collect data with this RT SCHED_FIFO priority.
-D::
+--no-buffering::
--no-delay::
        Collect data without buffering.
 -c::
@@ -201,11 +202,16 @@ abort events and some memory events in precise mode on modern Intel CPUs.
 --transaction::
 Record transaction flags for transaction related events.
--force-per-cpu::
+--per-thread::
-Force the use of per-cpu mmaps.  By default, when tasks are specified (i.e. -p,
+Use per-thread mmaps.  By default per-cpu mmaps are created.  This option
-t or -u options) per-thread mmaps are created.  This option overrides that and
+overrides that and uses per-thread mmaps.  A side-effect of that is that
-forces per-cpu mmaps.  A side-effect of that is that inheritance is
+inheritance is automatically disabled.  --per-thread is ignored with a warning
-automatically enabled.  Add the -i option also to disable inheritance.
+if combined with -a or -C options.
+-D::
+--delay=::
+After starting the program, wait msecs before measuring. This is useful to
+filter out the startup phase of the program, which is often very different.
 SEE ALSO
 --------
diff --git a/tools/perf/Documentation/perf-report.txt b/tools/perf/Documentation/perf-report.txt
index 10a279871251..8eab8a4bdeb8 100644
--- a/tools/perf/Documentation/perf-report.txt
+++ b/tools/perf/Documentation/perf-report.txt
@@ -237,6 +237,15 @@ OPTIONS
        Do not show entries which have an overhead under that percent.
        (Default: 0).
+--header::
+        Show header information in the perf.data file.  This includes
+        various information like hostname, OS and perf version, cpu/mem
+        info, perf command line, event list and so on.  Currently only
+        --stdio output supports this feature.
+--header-only::
+        Show only perf.data header (forces --stdio).
 SEE ALSO
 --------
 linkperf:perf-stat[1], linkperf:perf-annotate[1]
diff --git a/tools/perf/Documentation/perf-script.txt b/tools/perf/Documentation/perf-script.txt
index e9cbfcddfa3f..05f9a0a6784c 100644
--- a/tools/perf/Documentation/perf-script.txt
+++ b/tools/perf/Documentation/perf-script.txt
@@ -115,7 +115,7 @@ OPTIONS
 -f::
 --fields::
        Comma separated list of fields to print. Options are:
-        comm, tid, pid, time, cpu, event, trace, ip, sym, dso, addr, symoff.
+        comm, tid, pid, time, cpu, event, trace, ip, sym, dso, addr, symoff, srcline.
        Field list can be prepended with the type, trace, sw or hw,
        to indicate to which event type the field list applies.
        e.g., -f sw:comm,tid,time,ip,sym  and -f trace:time,cpu,trace
@@ -203,6 +203,18 @@ OPTIONS
 --show-kernel-path::
        Try to resolve the path of [kernel.kallsyms]
+--show-task-events
+        Display task related events (e.g. FORK, COMM, EXIT).
+--show-mmap-events
+        Display mmap related events (e.g. MMAP, MMAP2).
+--header
+        Show perf.data header.
+--header-only
+        Show only perf.data header.
 SEE ALSO
 --------
 linkperf:perf-record[1], linkperf:perf-script-perl[1],
diff --git a/tools/perf/Documentation/perf-stat.txt b/tools/perf/Documentation/perf-stat.txt
index 80c7da6732f2..29ee857c09c6 100644
--- a/tools/perf/Documentation/perf-stat.txt
+++ b/tools/perf/Documentation/perf-stat.txt
@@ -133,7 +133,7 @@ use --per-core in addition to -a. (system-wide).  The output includes the
 core number and the number of online logical processors on that physical processor.
 -D msecs::
--initial-delay msecs::
+--delay msecs::
 After starting the program, wait msecs before measuring. This is useful to
 filter out the startup phase of the program, which is often very different.
diff --git a/tools/perf/Documentation/perf-timechart.txt b/tools/perf/Documentation/perf-timechart.txt
index 3ff8bd4f0b4d..bc5990c33dc0 100644
--- a/tools/perf/Documentation/perf-timechart.txt
+++ b/tools/perf/Documentation/perf-timechart.txt
@@ -8,8 +8,7 @@ perf-timechart - Tool to visualize total system behavior during a workload
 SYNOPSIS
 --------
 [verse]
-'perf timechart' record <command>
+'perf timechart' [<timechart options>] {record} [<record options>]
-'perf timechart' [<options>]
 DESCRIPTION
 -----------
@@ -21,8 +20,8 @@ There are two variants of perf timechart:
  'perf timechart' to turn a trace into a Scalable Vector Graphics file,
  that can be viewed with popular SVG viewers such as 'Inkscape'.
-OPTIONS
+TIMECHART OPTIONS
-------
+-----------------
 -o::
 --output=::
        Select the output file (default: output.svg)
@@ -35,6 +34,9 @@ OPTIONS
 -P::
 --power-only::
        Only output the CPU power section of the diagram
+-T::
+--tasks-only::
+        Don't output processor state transitions
 -p::
 --process::
        Select the processes to display, by name or PID
@@ -54,6 +56,38 @@ $ perf timechart
  Written 10.2 seconds of trace to output.svg.
+Record system-wide timechart:
+  $ perf timechart record
+  then generate timechart and highlight 'gcc' tasks:
+  $ perf timechart --highlight gcc
+-n::
+--proc-num::
+        Print task info for at least given number of tasks.
+-t::
+--topology::
+        Sort CPUs according to topology.
+--highlight=<duration_nsecs|task_name>::
+        Highlight tasks (using different color) that run more than given
+        duration or tasks with given name. If number is given it's interpreted
+        as number of nanoseconds. If non-numeric string is given it's
+        interpreted as task name.
+RECORD OPTIONS
+--------------
+-P::
+--power-only::
+        Record only power-related events
+-T::
+--tasks-only::
+        Record only tasks-related events
+-g::
+--callchain::
+        Do call-graph (stack chain/backtrace) recording
 SEE ALSO
 --------
 linkperf:perf-record[1]
diff --git a/tools/perf/Documentation/perf-top.txt b/tools/perf/Documentation/perf-top.txt
index 7de01dd79688..cdd8d4946dba 100644
--- a/tools/perf/Documentation/perf-top.txt
+++ b/tools/perf/Documentation/perf-top.txt
@@ -50,7 +50,6 @@ Default is to monitor all CPUS.
 --count-filter=<count>::
        Only display functions with more events than this.
-g::
 --group::
        Put the counters into a counter group.
@@ -143,12 +142,12 @@ Default is to monitor all CPUS.
 --asm-raw::
        Show raw instruction encoding of assembly instructions.
-G::
+-g::
        Enables call-graph (stack chain/backtrace) recording.
 --call-graph::
        Setup and enable call-graph (stack chain/backtrace) recording,
-        implies -G.
+        implies -g.
 --max-stack::
        Set the stack depth limit when parsing the callchain, anything
diff --git a/tools/perf/MANIFEST b/tools/perf/MANIFEST
index 025de796067c..f41572d0dd76 100644
--- a/tools/perf/MANIFEST
+++ b/tools/perf/MANIFEST
@@ -1,7 +1,11 @@
 tools/perf
 tools/scripts
 tools/lib/traceevent
-tools/lib/lk
+tools/lib/api
+tools/lib/symbol/kallsyms.c
+tools/lib/symbol/kallsyms.h
+tools/include/asm/bug.h
+tools/include/linux/compiler.h
 include/linux/const.h
 include/linux/perf_event.h
 include/linux/rbtree.h
diff --git a/tools/perf/Makefile b/tools/perf/Makefile
index 4835618a5608..cb2e5868c8e8 100644
--- a/tools/perf/Makefile
+++ b/tools/perf/Makefile
@@ -60,8 +60,11 @@ endef
 #
 # Needed if no target specified:
+# (Except for tags and TAGS targets. The reason is that the
+# Makefile does not treat tags/TAGS as targets but as files
+# and thus won't rebuilt them once they are in place.)
 #
-all:
+all tags TAGS:
        $(print_msg)
        $(make)
@@ -72,8 +75,16 @@ clean:
        $(make)
 #
+# The build-test target is not really parallel, don't print the jobs info:
+#
+build-test:
+        @$(MAKE) -f tests/make --no-print-directory
+#
 # All other targets get passed through:
 #
 %:
        $(print_msg)
        $(make)
+.PHONY: tags TAGS
diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf
index 7fc8f179cae7..7257e7e9e38a 100644
--- a/tools/perf/Makefile.perf
+++ b/tools/perf/Makefile.perf
@@ -76,6 +76,7 @@ $(OUTPUT)PERF-VERSION-FILE: ../../.git/HEAD
 CC = $(CROSS_COMPILE)gcc
 AR = $(CROSS_COMPILE)ar
+PKG_CONFIG = $(CROSS_COMPILE)pkg-config
 RM      = rm -f
 LN      = ln -f
@@ -86,7 +87,7 @@ FLEX    = flex
 BISON   = bison
 STRIP   = strip
-LK_DIR          = $(srctree)/tools/lib/lk/
+LIB_DIR          = $(srctree)/tools/lib/api/
 TRACE_EVENT_DIR = $(srctree)/tools/lib/traceevent/
 # include config/Makefile by default and rule out
@@ -105,7 +106,7 @@ ifeq ($(config),1)
 include config/Makefile
 endif
-export prefix bindir sharedir sysconfdir
+export prefix bindir sharedir sysconfdir DESTDIR
 # sparse is architecture-neutral, which means that we need to tell it
 # explicitly what architecture to check for. Fix this up for yours..
@@ -127,20 +128,20 @@ strip-libs = $(filter-out -l%,$(1))
 ifneq ($(OUTPUT),)
  TE_PATH=$(OUTPUT)
 ifneq ($(subdir),)
-  LK_PATH=$(OUTPUT)/../lib/lk/
+  LIB_PATH=$(OUTPUT)/../lib/api/
 else
-  LK_PATH=$(OUTPUT)
+  LIB_PATH=$(OUTPUT)
 endif
 else
  TE_PATH=$(TRACE_EVENT_DIR)
-  LK_PATH=$(LK_DIR)
+  LIB_PATH=$(LIB_DIR)
 endif
 LIBTRACEEVENT = $(TE_PATH)libtraceevent.a
 export LIBTRACEEVENT
-LIBLK = $(LK_PATH)liblk.a
+LIBAPIKFS = $(LIB_PATH)libapikfs.a
-export LIBLK
+export LIBAPIKFS
 # python extension build directories
 PYTHON_EXTBUILD     := $(OUTPUT)python_ext_build/
@@ -151,7 +152,7 @@ export PYTHON_EXTBUILD_LIB PYTHON_EXTBUILD_TMP
 python-clean := $(call QUIET_CLEAN, python) $(RM) -r $(PYTHON_EXTBUILD) $(OUTPUT)python/perf.so
 PYTHON_EXT_SRCS := $(shell grep -v ^\# util/python-ext-sources)
-PYTHON_EXT_DEPS := util/python-ext-sources util/setup.py $(LIBTRACEEVENT) $(LIBLK)
+PYTHON_EXT_DEPS := util/python-ext-sources util/setup.py $(LIBTRACEEVENT) $(LIBAPIKFS)
 $(OUTPUT)python/perf.so: $(PYTHON_EXT_SRCS) $(PYTHON_EXT_DEPS)
        $(QUIET_GEN)CFLAGS='$(CFLAGS)' $(PYTHON_WORD) util/setup.py \
@@ -202,6 +203,7 @@ $(OUTPUT)util/pmu.o: $(OUTPUT)util/pmu-flex.c $(OUTPUT)util/pmu-bison.c
 LIB_FILE=$(OUTPUT)libperf.a
+LIB_H += ../lib/symbol/kallsyms.h
 LIB_H += ../../include/uapi/linux/perf_event.h
 LIB_H += ../../include/linux/rbtree.h
 LIB_H += ../../include/linux/list.h
@@ -210,7 +212,7 @@ LIB_H += ../../include/linux/hash.h
 LIB_H += ../../include/linux/stringify.h
 LIB_H += util/include/linux/bitmap.h
 LIB_H += util/include/linux/bitops.h
-LIB_H += util/include/linux/compiler.h
+LIB_H += ../include/linux/compiler.h
 LIB_H += util/include/linux/const.h
 LIB_H += util/include/linux/ctype.h
 LIB_H += util/include/linux/kernel.h
@@ -225,7 +227,7 @@ LIB_H += util/include/linux/string.h
 LIB_H += util/include/linux/types.h
 LIB_H += util/include/linux/linkage.h
 LIB_H += util/include/asm/asm-offsets.h
-LIB_H += util/include/asm/bug.h
+LIB_H += ../include/asm/bug.h
 LIB_H += util/include/asm/byteorder.h
 LIB_H += util/include/asm/hweight.h
 LIB_H += util/include/asm/swab.h
@@ -312,6 +314,7 @@ LIB_OBJS += $(OUTPUT)util/evlist.o
 LIB_OBJS += $(OUTPUT)util/evsel.o
 LIB_OBJS += $(OUTPUT)util/exec_cmd.o
 LIB_OBJS += $(OUTPUT)util/help.o
+LIB_OBJS += $(OUTPUT)util/kallsyms.o
 LIB_OBJS += $(OUTPUT)util/levenshtein.o
 LIB_OBJS += $(OUTPUT)util/parse-options.o
 LIB_OBJS += $(OUTPUT)util/parse-events.o
@@ -353,6 +356,7 @@ LIB_OBJS += $(OUTPUT)util/pmu-bison.o
 LIB_OBJS += $(OUTPUT)util/trace-event-read.o
 LIB_OBJS += $(OUTPUT)util/trace-event-info.o
 LIB_OBJS += $(OUTPUT)util/trace-event-scripting.o
+LIB_OBJS += $(OUTPUT)util/trace-event.o
 LIB_OBJS += $(OUTPUT)util/svghelper.o
 LIB_OBJS += $(OUTPUT)util/sort.o
 LIB_OBJS += $(OUTPUT)util/hist.o
@@ -438,7 +442,7 @@ BUILTIN_OBJS += $(OUTPUT)builtin-inject.o
 BUILTIN_OBJS += $(OUTPUT)tests/builtin-test.o
 BUILTIN_OBJS += $(OUTPUT)builtin-mem.o
-PERFLIBS = $(LIB_FILE) $(LIBLK) $(LIBTRACEEVENT)
+PERFLIBS = $(LIB_FILE) $(LIBAPIKFS) $(LIBTRACEEVENT)
 # We choose to avoid "if .. else if .. else .. endif endif"
 # because maintaining the nesting to match is a pain.  If
@@ -486,6 +490,7 @@ ifndef NO_SLANG
  LIB_OBJS += $(OUTPUT)ui/browsers/hists.o
  LIB_OBJS += $(OUTPUT)ui/browsers/map.o
  LIB_OBJS += $(OUTPUT)ui/browsers/scripts.o
+  LIB_OBJS += $(OUTPUT)ui/browsers/header.o
  LIB_OBJS += $(OUTPUT)ui/tui/setup.o
  LIB_OBJS += $(OUTPUT)ui/tui/util.o
  LIB_OBJS += $(OUTPUT)ui/tui/helpline.o
@@ -671,6 +676,9 @@ $(OUTPUT)ui/browsers/map.o: ui/browsers/map.c $(OUTPUT)PERF-CFLAGS
 $(OUTPUT)ui/browsers/scripts.o: ui/browsers/scripts.c $(OUTPUT)PERF-CFLAGS
        $(QUIET_CC)$(CC) -o $@ -c $(CFLAGS) -DENABLE_SLFUTURE_CONST $<
+$(OUTPUT)util/kallsyms.o: ../lib/symbol/kallsyms.c $(OUTPUT)PERF-CFLAGS
+        $(QUIET_CC)$(CC) -o $@ -c $(CFLAGS) $<
 $(OUTPUT)util/rbtree.o: ../../lib/rbtree.c $(OUTPUT)PERF-CFLAGS
        $(QUIET_CC)$(CC) -o $@ -c $(CFLAGS) -Wno-unused-parameter -DETC_PERFCONFIG='"$(ETC_PERFCONFIG_SQ)"' $<
@@ -710,26 +718,33 @@ $(LIB_FILE): $(LIB_OBJS)
 # libtraceevent.a
 TE_SOURCES = $(wildcard $(TRACE_EVENT_DIR)*.[ch])
-$(LIBTRACEEVENT): $(TE_SOURCES)
+LIBTRACEEVENT_FLAGS  = $(QUIET_SUBDIR1) O=$(OUTPUT)
-        $(QUIET_SUBDIR0)$(TRACE_EVENT_DIR) $(QUIET_SUBDIR1) O=$(OUTPUT) CFLAGS="-g -Wall $(EXTRA_CFLAGS)" libtraceevent.a
+LIBTRACEEVENT_FLAGS += CFLAGS="-g -Wall $(EXTRA_CFLAGS)"
+LIBTRACEEVENT_FLAGS += plugin_dir=$(plugindir_SQ)
+$(LIBTRACEEVENT): $(TE_SOURCES) $(OUTPUT)PERF-CFLAGS
+        $(QUIET_SUBDIR0)$(TRACE_EVENT_DIR) $(LIBTRACEEVENT_FLAGS) libtraceevent.a plugins
 $(LIBTRACEEVENT)-clean:
        $(call QUIET_CLEAN, libtraceevent)
        @$(MAKE) -C $(TRACE_EVENT_DIR) O=$(OUTPUT) clean >/dev/null
-LIBLK_SOURCES = $(wildcard $(LK_PATH)*.[ch])
+install-traceevent-plugins: $(LIBTRACEEVENT)
+        $(QUIET_SUBDIR0)$(TRACE_EVENT_DIR) $(LIBTRACEEVENT_FLAGS) install_plugins
+LIBAPIKFS_SOURCES = $(wildcard $(LIB_PATH)fs/*.[ch])
 # if subdir is set, we've been called from above so target has been built
 # already
-$(LIBLK): $(LIBLK_SOURCES)
+$(LIBAPIKFS): $(LIBAPIKFS_SOURCES)
 ifeq ($(subdir),)
-        $(QUIET_SUBDIR0)$(LK_DIR) $(QUIET_SUBDIR1) O=$(OUTPUT) liblk.a
+        $(QUIET_SUBDIR0)$(LIB_DIR) $(QUIET_SUBDIR1) O=$(OUTPUT) libapikfs.a
 endif
-$(LIBLK)-clean:
+$(LIBAPIKFS)-clean:
 ifeq ($(subdir),)
-        $(call QUIET_CLEAN, liblk)
+        $(call QUIET_CLEAN, libapikfs)
-        @$(MAKE) -C $(LK_DIR) O=$(OUTPUT) clean >/dev/null
+        @$(MAKE) -C $(LIB_DIR) O=$(OUTPUT) clean >/dev/null
 endif
 help:
@@ -785,7 +800,7 @@ cscope:
 ### Detect prefix changes
 TRACK_CFLAGS = $(subst ','\'',$(CFLAGS)):\
-             $(bindir_SQ):$(perfexecdir_SQ):$(template_dir_SQ):$(prefix_SQ)
+             $(bindir_SQ):$(perfexecdir_SQ):$(template_dir_SQ):$(prefix_SQ):$(plugindir_SQ)
 $(OUTPUT)PERF-CFLAGS: .FORCE-PERF-CFLAGS
        @FLAGS='$(TRACK_CFLAGS)'; \
@@ -840,16 +855,16 @@ ifndef NO_LIBPYTHON
                $(INSTALL) scripts/python/*.py -t '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/scripts/python'; \
                $(INSTALL) scripts/python/bin/* -t '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/scripts/python/bin'
 endif
-        $(call QUIET_INSTALL, bash_completion-script) \
+        $(call QUIET_INSTALL, perf_completion-script) \
                $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(sysconfdir_SQ)/bash_completion.d'; \
-                $(INSTALL) bash_completion '$(DESTDIR_SQ)$(sysconfdir_SQ)/bash_completion.d/perf'
+                $(INSTALL) perf-completion.sh '$(DESTDIR_SQ)$(sysconfdir_SQ)/bash_completion.d/perf'
        $(call QUIET_INSTALL, tests) \
                $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/tests'; \
                $(INSTALL) tests/attr.py '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/tests'; \
                $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/tests/attr'; \
                $(INSTALL) tests/attr/* '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/tests/attr'
-install: install-bin try-install-man
+install: install-bin try-install-man install-traceevent-plugins
 install-python_ext:
        $(PYTHON_WORD) util/setup.py --quiet install --root='/$(DESTDIR_SQ)'
@@ -868,12 +883,11 @@ config-clean:
        $(call QUIET_CLEAN, config)
        @$(MAKE) -C config/feature-checks clean >/dev/null
-clean: $(LIBTRACEEVENT)-clean $(LIBLK)-clean config-clean
+clean: $(LIBTRACEEVENT)-clean $(LIBAPIKFS)-clean config-clean
        $(call QUIET_CLEAN, core-objs)  $(RM) $(LIB_OBJS) $(BUILTIN_OBJS) $(LIB_FILE) $(OUTPUT)perf-archive $(OUTPUT)perf.o $(LANG_BINDINGS) $(GTK_OBJS)
        $(call QUIET_CLEAN, core-progs) $(RM) $(ALL_PROGRAMS) perf
        $(call QUIET_CLEAN, core-gen)   $(RM)  *.spec *.pyc *.pyo */*.pyc */*.pyo $(OUTPUT)common-cmds.h TAGS tags cscope* $(OUTPUT)PERF-VERSION-FILE $(OUTPUT)PERF-CFLAGS $(OUTPUT)util/*-bison* $(OUTPUT)util/*-flex*
-        $(call QUIET_CLEAN, Documentation)
+        $(QUIET_SUBDIR0)Documentation $(QUIET_SUBDIR1) clean
-        @$(MAKE) -C Documentation O=$(OUTPUT) clean >/dev/null
        $(python-clean)
 #
diff --git a/tools/perf/arch/common.c b/tools/perf/arch/common.c
index aacef07ebf31..42faf369211c 100644
--- a/tools/perf/arch/common.c
+++ b/tools/perf/arch/common.c
@@ -154,8 +154,7 @@ static int perf_session_env__lookup_binutils_path(struct perf_session_env *env,
                }
                if (lookup_path(buf))
                        goto out;
-                free(buf);
+                zfree(&buf);
-                buf = NULL;
        }
        if (!strcmp(arch, "arm"))
diff --git a/tools/perf/builtin-annotate.c b/tools/perf/builtin-annotate.c
index 4087ab19823c..0da603b79b61 100644
--- a/tools/perf/builtin-annotate.c
+++ b/tools/perf/builtin-annotate.c
@@ -69,15 +69,7 @@ static int perf_evsel__add_sample(struct perf_evsel *evsel,
        if (he == NULL)
                return -ENOMEM;
-        ret = 0;
+        ret = hist_entry__inc_addr_samples(he, evsel->idx, al->addr);
-        if (he->ms.sym != NULL) {
-                struct annotation *notes = symbol__annotation(he->ms.sym);
-                if (notes->src == NULL && symbol__alloc_hist(he->ms.sym) < 0)
-                        return -ENOMEM;
-                ret = hist_entry__inc_addr_samples(he, evsel->idx, al->addr);
-        }
        evsel->hists.stats.total_period += sample->period;
        hists__inc_nr_events(&evsel->hists, PERF_RECORD_SAMPLE);
        return ret;
@@ -188,8 +180,7 @@ find_next:
                         * symbol, free he->ms.sym->src to signal we already
                         * processed this symbol.
                         */
-                        free(notes->src);
+                        zfree(&notes->src);
-                        notes->src = NULL;
                }
        }
 }
@@ -241,7 +232,7 @@ static int __cmd_annotate(struct perf_annotate *ann)
                perf_session__fprintf_dsos(session, stdout);
        total_nr_samples = 0;
-        list_for_each_entry(pos, &session->evlist->entries, node) {
+        evlist__for_each(session->evlist, pos) {
                struct hists *hists = &pos->hists;
                u32 nr_samples = hists->stats.nr_events[PERF_RECORD_SAMPLE];
@@ -373,7 +364,7 @@ int cmd_annotate(int argc, const char **argv, const char *prefix __maybe_unused)
        if (argc) {
                /*
-                 * Special case: if there's an argument left then assume tha
+                 * Special case: if there's an argument left then assume that
                 * it's a symbol filter:
                 */
                if (argc > 1)
diff --git a/tools/perf/builtin-diff.c b/tools/perf/builtin-diff.c
index 3b67ea2444bd..a77e31246c00 100644
--- a/tools/perf/builtin-diff.c
+++ b/tools/perf/builtin-diff.c
@@ -356,9 +356,10 @@ static struct perf_evsel *evsel_match(struct perf_evsel *evsel,
 {
        struct perf_evsel *e;
-        list_for_each_entry(e, &evlist->entries, node)
+        evlist__for_each(evlist, e) {
                if (perf_evsel__match2(evsel, e))
                        return e;
+        }
        return NULL;
 }
@@ -367,7 +368,7 @@ static void perf_evlist__collapse_resort(struct perf_evlist *evlist)
 {
        struct perf_evsel *evsel;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                struct hists *hists = &evsel->hists;
                hists__collapse_resort(hists, NULL);
@@ -614,7 +615,7 @@ static void data_process(void)
        struct perf_evsel *evsel_base;
        bool first = true;
-        list_for_each_entry(evsel_base, &evlist_base->entries, node) {
+        evlist__for_each(evlist_base, evsel_base) {
                struct data__file *d;
                int i;
@@ -654,7 +655,7 @@ static void data__free(struct data__file *d)
        for (col = 0; col < PERF_HPP_DIFF__MAX_INDEX; col++) {
                struct diff_hpp_fmt *fmt = &d->fmt[col];
-                free(fmt->header);
+                zfree(&fmt->header);
        }
 }
@@ -769,6 +770,81 @@ static int hpp__entry_baseline(struct hist_entry *he, char *buf, size_t size)
        return ret;
 }
+static int __hpp__color_compare(struct perf_hpp_fmt *fmt,
+                                struct perf_hpp *hpp, struct hist_entry *he,
+                                int comparison_method)
+{
+        struct diff_hpp_fmt *dfmt =
+                container_of(fmt, struct diff_hpp_fmt, fmt);
+        struct hist_entry *pair = get_pair_fmt(he, dfmt);
+        double diff;
+        s64 wdiff;
+        char pfmt[20] = " ";
+        if (!pair)
+                goto dummy_print;
+        switch (comparison_method) {
+        case COMPUTE_DELTA:
+                if (pair->diff.computed)
+                        diff = pair->diff.period_ratio_delta;
+                else
+                        diff = compute_delta(he, pair);
+                if (fabs(diff) < 0.01)
+                        goto dummy_print;
+                scnprintf(pfmt, 20, "%%%+d.2f%%%%", dfmt->header_width - 1);
+                return percent_color_snprintf(hpp->buf, hpp->size,
+                                        pfmt, diff);
+        case COMPUTE_RATIO:
+                if (he->dummy)
+                        goto dummy_print;
+                if (pair->diff.computed)
+                        diff = pair->diff.period_ratio;
+                else
+                        diff = compute_ratio(he, pair);
+                scnprintf(pfmt, 20, "%%%d.6f", dfmt->header_width);
+                return value_color_snprintf(hpp->buf, hpp->size,
+                                        pfmt, diff);
+        case COMPUTE_WEIGHTED_DIFF:
+                if (he->dummy)
+                        goto dummy_print;
+                if (pair->diff.computed)
+                        wdiff = pair->diff.wdiff;
+                else
+                        wdiff = compute_wdiff(he, pair);
+                scnprintf(pfmt, 20, "%%14ld", dfmt->header_width);
+                return color_snprintf(hpp->buf, hpp->size,
+                                get_percent_color(wdiff),
+                                pfmt, wdiff);
+        default:
+                BUG_ON(1);
+        }
+dummy_print:
+        return scnprintf(hpp->buf, hpp->size, "%*s",
+                        dfmt->header_width, pfmt);
+}
+static int hpp__color_delta(struct perf_hpp_fmt *fmt,
+                        struct perf_hpp *hpp, struct hist_entry *he)
+{
+        return __hpp__color_compare(fmt, hpp, he, COMPUTE_DELTA);
+}
+static int hpp__color_ratio(struct perf_hpp_fmt *fmt,
+                        struct perf_hpp *hpp, struct hist_entry *he)
+{
+        return __hpp__color_compare(fmt, hpp, he, COMPUTE_RATIO);
+}
+static int hpp__color_wdiff(struct perf_hpp_fmt *fmt,
+                        struct perf_hpp *hpp, struct hist_entry *he)
+{
+        return __hpp__color_compare(fmt, hpp, he, COMPUTE_WEIGHTED_DIFF);
+}
 static void
 hpp__entry_unpair(struct hist_entry *he, int idx, char *buf, size_t size)
 {
@@ -940,8 +1016,22 @@ static void data__hpp_register(struct data__file *d, int idx)
        fmt->entry  = hpp__entry_global;
        /* TODO more colors */
-        if (idx == PERF_HPP_DIFF__BASELINE)
+        switch (idx) {
+        case PERF_HPP_DIFF__BASELINE:
                fmt->color = hpp__color_baseline;
+                break;
+        case PERF_HPP_DIFF__DELTA:
+                fmt->color = hpp__color_delta;
+                break;
+        case PERF_HPP_DIFF__RATIO:
+                fmt->color = hpp__color_ratio;
+                break;
+        case PERF_HPP_DIFF__WEIGHTED_DIFF:
+                fmt->color = hpp__color_wdiff;
+                break;
+        default:
+                break;
+        }
        init_header(d, dfmt);
        perf_hpp__column_register(fmt);
@@ -1000,8 +1090,7 @@ static int data_init(int argc, const char **argv)
                        data__files_cnt = argc;
                        use_default = false;
                }
-        } else if (symbol_conf.default_guest_vmlinux_name ||
+        } else if (perf_guest) {
-                   symbol_conf.default_guest_kallsyms) {
                defaults[0] = "perf.data.host";
                defaults[1] = "perf.data.guest";
        }
diff --git a/tools/perf/builtin-evlist.c b/tools/perf/builtin-evlist.c
index 20b0f12763b0..c99e0de7e54a 100644
--- a/tools/perf/builtin-evlist.c
+++ b/tools/perf/builtin-evlist.c
@@ -29,7 +29,7 @@ static int __cmd_evlist(const char *file_name, struct perf_attr_details *details
        if (session == NULL)
                return -ENOMEM;
-        list_for_each_entry(pos, &session->evlist->entries, node)
+        evlist__for_each(session->evlist, pos)
                perf_evsel__fprintf(pos, details, stdout);
        perf_session__delete(session);
diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c
index 6a2508589460..b3466018bbd7 100644
--- a/tools/perf/builtin-inject.c
+++ b/tools/perf/builtin-inject.c
@@ -22,14 +22,13 @@
 #include <linux/list.h>
 struct perf_inject {
-        struct perf_tool tool;
+        struct perf_tool        tool;
-        bool             build_ids;
+        bool                    build_ids;
-        bool             sched_stat;
+        bool                    sched_stat;
-        const char       *input_name;
+        const char              *input_name;
-        int              pipe_output,
+        struct perf_data_file   output;
-                         output;
+        u64                     bytes_written;
-        u64              bytes_written;
+        struct list_head        samples;
-        struct list_head samples;
 };
 struct event_entry {
@@ -42,21 +41,14 @@ static int perf_event__repipe_synth(struct perf_tool *tool,
                                    union perf_event *event)
 {
        struct perf_inject *inject = container_of(tool, struct perf_inject, tool);
-        uint32_t size;
+        ssize_t size;
-        void *buf = event;
-        size = event->header.size;
+        size = perf_data_file__write(&inject->output, event,
+                                     event->header.size);
-        while (size) {
+        if (size < 0)
-                int ret = write(inject->output, buf, size);
+                return -errno;
-                if (ret < 0)
-                        return -errno;
-                size -= ret;
-                buf += ret;
-                inject->bytes_written += ret;
-        }
+        inject->bytes_written += size;
        return 0;
 }
@@ -80,7 +72,7 @@ static int perf_event__repipe_attr(struct perf_tool *tool,
        if (ret)
                return ret;
-        if (!inject->pipe_output)
+        if (&inject->output.is_pipe)
                return 0;
        return perf_event__repipe_synth(tool, event);
@@ -355,6 +347,7 @@ static int __cmd_inject(struct perf_inject *inject)
                .path = inject->input_name,
                .mode = PERF_DATA_MODE_READ,
        };
+        struct perf_data_file *file_out = &inject->output;
        signal(SIGINT, sig_handler);
@@ -376,7 +369,7 @@ static int __cmd_inject(struct perf_inject *inject)
                inject->tool.ordered_samples = true;
-                list_for_each_entry(evsel, &session->evlist->entries, node) {
+                evlist__for_each(session->evlist, evsel) {
                        const char *name = perf_evsel__name(evsel);
                        if (!strcmp(name, "sched:sched_switch")) {
@@ -391,14 +384,14 @@ static int __cmd_inject(struct perf_inject *inject)
                }
        }
-        if (!inject->pipe_output)
+        if (!file_out->is_pipe)
-                lseek(inject->output, session->header.data_offset, SEEK_SET);
+                lseek(file_out->fd, session->header.data_offset, SEEK_SET);
        ret = perf_session__process_events(session, &inject->tool);
-        if (!inject->pipe_output) {
+        if (!file_out->is_pipe) {
                session->header.data_size = inject->bytes_written;
-                perf_session__write_header(session, session->evlist, inject->output, true);
+                perf_session__write_header(session, session->evlist, file_out->fd, true);
        }
        perf_session__delete(session);
@@ -427,14 +420,17 @@ int cmd_inject(int argc, const char **argv, const char *prefix __maybe_unused)
                },
                .input_name  = "-",
                .samples = LIST_HEAD_INIT(inject.samples),
+                .output = {
+                        .path = "-",
+                        .mode = PERF_DATA_MODE_WRITE,
+                },
        };
-        const char *output_name = "-";
        const struct option options[] = {
                OPT_BOOLEAN('b', "build-ids", &inject.build_ids,
                            "Inject build-ids into the output stream"),
                OPT_STRING('i', "input", &inject.input_name, "file",
                           "input file name"),
-                OPT_STRING('o', "output", &output_name, "file",
+                OPT_STRING('o', "output", &inject.output.path, "file",
                           "output file name"),
                OPT_BOOLEAN('s', "sched-stat", &inject.sched_stat,
                            "Merge sched-stat and sched-switch for getting events "
@@ -456,16 +452,9 @@ int cmd_inject(int argc, const char **argv, const char *prefix __maybe_unused)
        if (argc)
                usage_with_options(inject_usage, options);
-        if (!strcmp(output_name, "-")) {
+        if (perf_data_file__open(&inject.output)) {
-                inject.pipe_output = 1;
+                perror("failed to create output file");
-                inject.output = STDOUT_FILENO;
+                return -1;
-        } else {
-                inject.output = open(output_name, O_CREAT | O_WRONLY | O_TRUNC,
-                                                  S_IRUSR | S_IWUSR);
-                if (inject.output < 0) {
-                        perror("failed to create output file");
-                        return -1;
-                }
        }
        if (symbol__init() < 0)
diff --git a/tools/perf/builtin-kvm.c b/tools/perf/builtin-kvm.c
index f8bf5f244d77..a7350519c63f 100644
--- a/tools/perf/builtin-kvm.c
+++ b/tools/perf/builtin-kvm.c
@@ -13,7 +13,7 @@
 #include "util/parse-options.h"
 #include "util/trace-event.h"
 #include "util/debug.h"
-#include <lk/debugfs.h>
+#include <api/fs/debugfs.h>
 #include "util/tool.h"
 #include "util/stat.h"
 #include "util/top.h"
@@ -89,7 +89,7 @@ struct exit_reasons_table {
 struct perf_kvm_stat {
        struct perf_tool    tool;
-        struct perf_record_opts opts;
+        struct record_opts  opts;
        struct perf_evlist  *evlist;
        struct perf_session *session;
@@ -1158,9 +1158,7 @@ out:
        if (kvm->timerfd >= 0)
                close(kvm->timerfd);
-        if (pollfds)
+        free(pollfds);
-                free(pollfds);
        return err;
 }
@@ -1176,7 +1174,7 @@ static int kvm_live_open_events(struct perf_kvm_stat *kvm)
         * Note: exclude_{guest,host} do not apply here.
         *       This command processes KVM tracepoints from host only
         */
-        list_for_each_entry(pos, &evlist->entries, node) {
+        evlist__for_each(evlist, pos) {
                struct perf_event_attr *attr = &pos->attr;
                /* make sure these *are* set */
@@ -1232,7 +1230,7 @@ static int read_events(struct perf_kvm_stat *kvm)
                .ordered_samples        = true,
        };
        struct perf_data_file file = {
-                .path = input_name,
+                .path = kvm->file_name,
                .mode = PERF_DATA_MODE_READ,
        };
@@ -1558,10 +1556,8 @@ out:
        if (kvm->session)
                perf_session__delete(kvm->session);
        kvm->session = NULL;
-        if (kvm->evlist) {
+        if (kvm->evlist)
-                perf_evlist__delete_maps(kvm->evlist);
                perf_evlist__delete(kvm->evlist);
-        }
        return err;
 }
@@ -1690,6 +1686,8 @@ int cmd_kvm(int argc, const char **argv, const char *prefix __maybe_unused)
                           "file", "file saving guest os /proc/kallsyms"),
                OPT_STRING(0, "guestmodules", &symbol_conf.default_guest_modules,
                           "file", "file saving guest os /proc/modules"),
+                OPT_INCR('v', "verbose", &verbose,
+                            "be more verbose (show counter open errors, etc)"),
                OPT_END()
        };
@@ -1711,12 +1709,7 @@ int cmd_kvm(int argc, const char **argv, const char *prefix __maybe_unused)
                perf_guest = 1;
        if (!file_name) {
-                if (perf_host && !perf_guest)
+                file_name = get_filename_for_perf_kvm();
-                        file_name = strdup("perf.data.host");
-                else if (!perf_host && perf_guest)
-                        file_name = strdup("perf.data.guest");
-                else
-                        file_name = strdup("perf.data.kvm");
                if (!file_name) {
                        pr_err("Failed to allocate memory for filename\n");
diff --git a/tools/perf/builtin-mem.c b/tools/perf/builtin-mem.c
index 31c00f186da1..2e3ade69a58e 100644
--- a/tools/perf/builtin-mem.c
+++ b/tools/perf/builtin-mem.c
@@ -62,7 +62,6 @@ static int
 dump_raw_samples(struct perf_tool *tool,
                 union perf_event *event,
                 struct perf_sample *sample,
-                 struct perf_evsel *evsel __maybe_unused,
                 struct machine *machine)
 {
        struct perf_mem *mem = container_of(tool, struct perf_mem, tool);
@@ -112,10 +111,10 @@ dump_raw_samples(struct perf_tool *tool,
 static int process_sample_event(struct perf_tool *tool,
                                union perf_event *event,
                                struct perf_sample *sample,
-                                struct perf_evsel *evsel,
+                                struct perf_evsel *evsel __maybe_unused,
                                struct machine *machine)
 {
-        return dump_raw_samples(tool, event, sample, evsel, machine);
+        return dump_raw_samples(tool, event, sample, machine);
 }
 static int report_raw_events(struct perf_mem *mem)
diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c
index 6ea9e85bdc00..78948882e3de 100644
--- a/tools/perf/builtin-probe.c
+++ b/tools/perf/builtin-probe.c
@@ -37,7 +37,7 @@
 #include "util/strfilter.h"
 #include "util/symbol.h"
 #include "util/debug.h"
-#include <lk/debugfs.h>
+#include <api/fs/debugfs.h>
 #include "util/parse-options.h"
 #include "util/probe-finder.h"
 #include "util/probe-event.h"
@@ -59,7 +59,7 @@ static struct {
        struct perf_probe_event events[MAX_PROBES];
        struct strlist *dellist;
        struct line_range line_range;
-        const char *target;
+        char *target;
        int max_probe_points;
        struct strfilter *filter;
 } params;
@@ -98,7 +98,10 @@ static int set_target(const char *ptr)
         * short module name.
         */
        if (!params.target && ptr && *ptr == '/') {
-                params.target = ptr;
+                params.target = strdup(ptr);
+                if (!params.target)
+                        return -ENOMEM;
                found = 1;
                buf = ptr + (strlen(ptr) - 3);
@@ -116,6 +119,9 @@ static int parse_probe_event_argv(int argc, const char **argv)
        char *buf;
        found_target = set_target(argv[0]);
+        if (found_target < 0)
+                return found_target;
        if (found_target && argc == 1)
                return 0;
@@ -169,6 +175,7 @@ static int opt_set_target(const struct option *opt, const char *str,
                        int unset __maybe_unused)
 {
        int ret = -ENOENT;
+        char *tmp;
        if  (str && !params.target) {
                if (!strcmp(opt->long_name, "exec"))
@@ -180,7 +187,19 @@ static int opt_set_target(const struct option *opt, const char *str,
                else
                        return ret;
-                params.target = str;
+                /* Expand given path to absolute path, except for modulename */
+                if (params.uprobes || strchr(str, '/')) {
+                        tmp = realpath(str, NULL);
+                        if (!tmp) {
+                                pr_warning("Failed to get the absolute path of %s: %m\n", str);
+                                return ret;
+                        }
+                } else {
+                        tmp = strdup(str);
+                        if (!tmp)
+                                return -ENOMEM;
+                }
+                params.target = tmp;
                ret = 0;
        }
@@ -204,7 +223,6 @@ static int opt_show_lines(const struct option *opt __maybe_unused,
        params.show_lines = true;
        ret = parse_line_range_desc(str, &params.line_range);
-        INIT_LIST_HEAD(&params.line_range.line_list);
        return ret;
 }
@@ -250,7 +268,28 @@ static int opt_set_filter(const struct option *opt __maybe_unused,
        return 0;
 }
-int cmd_probe(int argc, const char **argv, const char *prefix __maybe_unused)
+static void init_params(void)
+{
+        line_range__init(&params.line_range);
+}
+static void cleanup_params(void)
+{
+        int i;
+        for (i = 0; i < params.nevents; i++)
+                clear_perf_probe_event(params.events + i);
+        if (params.dellist)
+                strlist__delete(params.dellist);
+        line_range__clear(&params.line_range);
+        free(params.target);
+        if (params.filter)
+                strfilter__delete(params.filter);
+        memset(&params, 0, sizeof(params));
+}
+static int
+__cmd_probe(int argc, const char **argv, const char *prefix __maybe_unused)
 {
        const char * const probe_usage[] = {
                "perf probe [<options>] 'PROBEDEF' ['PROBEDEF' ...]",
@@ -404,6 +443,7 @@ int cmd_probe(int argc, const char **argv, const char *prefix __maybe_unused)
                ret = show_available_funcs(params.target, params.filter,
                                        params.uprobes);
                strfilter__delete(params.filter);
+                params.filter = NULL;
                if (ret < 0)
                        pr_err("  Error: Failed to show functions."
                               " (%d)\n", ret);
@@ -411,7 +451,7 @@ int cmd_probe(int argc, const char **argv, const char *prefix __maybe_unused)
        }
 #ifdef HAVE_DWARF_SUPPORT
-        if (params.show_lines && !params.uprobes) {
+        if (params.show_lines) {
                if (params.mod_events) {
                        pr_err("  Error: Don't use --line with"
                               " --add/--del.\n");
@@ -443,6 +483,7 @@ int cmd_probe(int argc, const char **argv, const char *prefix __maybe_unused)
                                          params.filter,
                                          params.show_ext_vars);
                strfilter__delete(params.filter);
+                params.filter = NULL;
                if (ret < 0)
                        pr_err("  Error: Failed to show vars. (%d)\n", ret);
                return ret;
@@ -451,7 +492,6 @@ int cmd_probe(int argc, const char **argv, const char *prefix __maybe_unused)
        if (params.dellist) {
                ret = del_perf_probe_events(params.dellist);
-                strlist__delete(params.dellist);
                if (ret < 0) {
                        pr_err("  Error: Failed to delete events. (%d)\n", ret);
                        return ret;
@@ -470,3 +510,14 @@ int cmd_probe(int argc, const char **argv, const char *prefix __maybe_unused)
        }
        return 0;
 }
+int cmd_probe(int argc, const char **argv, const char *prefix)
+{
+        int ret;
+        init_params();
+        ret = __cmd_probe(argc, argv, prefix);
+        cleanup_params();
+        return ret;
+}
diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 7c8020a32784..3c394bf16fa8 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -62,9 +62,9 @@ static void __handle_on_exit_funcs(void)
 }
 #endif
-struct perf_record {
+struct record {
        struct perf_tool        tool;
-        struct perf_record_opts opts;
+        struct record_opts      opts;
        u64                     bytes_written;
        struct perf_data_file   file;
        struct perf_evlist      *evlist;
@@ -76,46 +76,27 @@ struct perf_record {
        long                    samples;
 };
-static int do_write_output(struct perf_record *rec, void *buf, size_t size)
+static int record__write(struct record *rec, void *bf, size_t size)
 {
-        struct perf_data_file *file = &rec->file;
+        if (perf_data_file__write(rec->session->file, bf, size) < 0) {
+                pr_err("failed to write perf data, error: %m\n");
-        while (size) {
+                return -1;
-                ssize_t ret = write(file->fd, buf, size);
-                if (ret < 0) {
-                        pr_err("failed to write perf data, error: %m\n");
-                        return -1;
-                }
-                size -= ret;
-                buf += ret;
-                rec->bytes_written += ret;
        }
+        rec->bytes_written += size;
        return 0;
 }
-static int write_output(struct perf_record *rec, void *buf, size_t size)
-{
-        return do_write_output(rec, buf, size);
-}
 static int process_synthesized_event(struct perf_tool *tool,
                                     union perf_event *event,
                                     struct perf_sample *sample __maybe_unused,
                                     struct machine *machine __maybe_unused)
 {
-        struct perf_record *rec = container_of(tool, struct perf_record, tool);
+        struct record *rec = container_of(tool, struct record, tool);
-        if (write_output(rec, event, event->header.size) < 0)
+        return record__write(rec, event, event->header.size);
-                return -1;
-        return 0;
 }
-static int perf_record__mmap_read(struct perf_record *rec,
+static int record__mmap_read(struct record *rec, struct perf_mmap *md)
-                                   struct perf_mmap *md)
 {
        unsigned int head = perf_mmap__read_head(md);
        unsigned int old = md->prev;
@@ -136,7 +117,7 @@ static int perf_record__mmap_read(struct perf_record *rec,
                size = md->mask + 1 - (old & md->mask);
                old += size;
-                if (write_output(rec, buf, size) < 0) {
+                if (record__write(rec, buf, size) < 0) {
                        rc = -1;
                        goto out;
                }
@@ -146,7 +127,7 @@ static int perf_record__mmap_read(struct perf_record *rec,
        size = head - old;
        old += size;
-        if (write_output(rec, buf, size) < 0) {
+        if (record__write(rec, buf, size) < 0) {
                rc = -1;
                goto out;
        }
@@ -171,9 +152,9 @@ static void sig_handler(int sig)
        signr = sig;
 }
-static void perf_record__sig_exit(int exit_status __maybe_unused, void *arg)
+static void record__sig_exit(int exit_status __maybe_unused, void *arg)
 {
-        struct perf_record *rec = arg;
+        struct record *rec = arg;
        int status;
        if (rec->evlist->workload.pid > 0) {
@@ -191,18 +172,18 @@ static void perf_record__sig_exit(int exit_status __maybe_unused, void *arg)
        signal(signr, SIG_DFL);
 }
-static int perf_record__open(struct perf_record *rec)
+static int record__open(struct record *rec)
 {
        char msg[512];
        struct perf_evsel *pos;
        struct perf_evlist *evlist = rec->evlist;
        struct perf_session *session = rec->session;
-        struct perf_record_opts *opts = &rec->opts;
+        struct record_opts *opts = &rec->opts;
        int rc = 0;
        perf_evlist__config(evlist, opts);
-        list_for_each_entry(pos, &evlist->entries, node) {
+        evlist__for_each(evlist, pos) {
 try_again:
                if (perf_evsel__open(pos, evlist->cpus, evlist->threads) < 0) {
                        if (perf_evsel__fallback(pos, errno, msg, sizeof(msg))) {
@@ -232,7 +213,7 @@ try_again:
                               "Consider increasing "
                               "/proc/sys/kernel/perf_event_mlock_kb,\n"
                               "or try again with a smaller value of -m/--mmap_pages.\n"
-                               "(current value: %d)\n", opts->mmap_pages);
+                               "(current value: %u)\n", opts->mmap_pages);
                        rc = -errno;
                } else {
                        pr_err("failed to mmap with %d (%s)\n", errno, strerror(errno));
@@ -247,7 +228,7 @@ out:
        return rc;
 }
-static int process_buildids(struct perf_record *rec)
+static int process_buildids(struct record *rec)
 {
        struct perf_data_file *file  = &rec->file;
        struct perf_session *session = rec->session;
@@ -262,9 +243,9 @@ static int process_buildids(struct perf_record *rec)
                                              size, &build_id__mark_dso_hit_ops);
 }
-static void perf_record__exit(int status, void *arg)
+static void record__exit(int status, void *arg)
 {
-        struct perf_record *rec = arg;
+        struct record *rec = arg;
        struct perf_data_file *file = &rec->file;
        if (status != 0)
@@ -320,14 +301,14 @@ static struct perf_event_header finished_round_event = {
        .type = PERF_RECORD_FINISHED_ROUND,
 };
-static int perf_record__mmap_read_all(struct perf_record *rec)
+static int record__mmap_read_all(struct record *rec)
 {
        int i;
        int rc = 0;
        for (i = 0; i < rec->evlist->nr_mmaps; i++) {
                if (rec->evlist->mmap[i].base) {
-                        if (perf_record__mmap_read(rec, &rec->evlist->mmap[i]) != 0) {
+                        if (record__mmap_read(rec, &rec->evlist->mmap[i]) != 0) {
                                rc = -1;
                                goto out;
                        }
@@ -335,16 +316,14 @@ static int perf_record__mmap_read_all(struct perf_record *rec)
        }
        if (perf_header__has_feat(&rec->session->header, HEADER_TRACING_DATA))
-                rc = write_output(rec, &finished_round_event,
+                rc = record__write(rec, &finished_round_event, sizeof(finished_round_event));
-                                  sizeof(finished_round_event));
 out:
        return rc;
 }
-static void perf_record__init_features(struct perf_record *rec)
+static void record__init_features(struct record *rec)
 {
-        struct perf_evlist *evsel_list = rec->evlist;
        struct perf_session *session = rec->session;
        int feat;
@@ -354,32 +333,46 @@ static void perf_record__init_features(struct perf_record *rec)
        if (rec->no_buildid)
                perf_header__clear_feat(&session->header, HEADER_BUILD_ID);
-        if (!have_tracepoints(&evsel_list->entries))
+        if (!have_tracepoints(&rec->evlist->entries))
                perf_header__clear_feat(&session->header, HEADER_TRACING_DATA);
        if (!rec->opts.branch_stack)
                perf_header__clear_feat(&session->header, HEADER_BRANCH_STACK);
 }
-static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
+static volatile int workload_exec_errno;
+/*
+ * perf_evlist__prepare_workload will send a SIGUSR1
+ * if the fork fails, since we asked by setting its
+ * want_signal to true.
+ */
+static void workload_exec_failed_signal(int signo, siginfo_t *info,
+                                        void *ucontext __maybe_unused)
+{
+        workload_exec_errno = info->si_value.sival_int;
+        done = 1;
+        signr = signo;
+        child_finished = 1;
+}
+static int __cmd_record(struct record *rec, int argc, const char **argv)
 {
        int err;
        unsigned long waking = 0;
        const bool forks = argc > 0;
        struct machine *machine;
        struct perf_tool *tool = &rec->tool;
-        struct perf_record_opts *opts = &rec->opts;
+        struct record_opts *opts = &rec->opts;
-        struct perf_evlist *evsel_list = rec->evlist;
        struct perf_data_file *file = &rec->file;
        struct perf_session *session;
        bool disabled = false;
        rec->progname = argv[0];
-        on_exit(perf_record__sig_exit, rec);
+        on_exit(record__sig_exit, rec);
        signal(SIGCHLD, sig_handler);
        signal(SIGINT, sig_handler);
-        signal(SIGUSR1, sig_handler);
        signal(SIGTERM, sig_handler);
        session = perf_session__new(file, false, NULL);
@@ -390,37 +383,37 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
        rec->session = session;
-        perf_record__init_features(rec);
+        record__init_features(rec);
        if (forks) {
-                err = perf_evlist__prepare_workload(evsel_list, &opts->target,
+                err = perf_evlist__prepare_workload(rec->evlist, &opts->target,
                                                    argv, file->is_pipe,
-                                                    true);
+                                                    workload_exec_failed_signal);
                if (err < 0) {
                        pr_err("Couldn't run the workload!\n");
                        goto out_delete_session;
                }
        }
-        if (perf_record__open(rec) != 0) {
+        if (record__open(rec) != 0) {
                err = -1;
                goto out_delete_session;
        }
-        if (!evsel_list->nr_groups)
+        if (!rec->evlist->nr_groups)
                perf_header__clear_feat(&session->header, HEADER_GROUP_DESC);
        /*
-         * perf_session__delete(session) will be called at perf_record__exit()
+         * perf_session__delete(session) will be called at record__exit()
         */
-        on_exit(perf_record__exit, rec);
+        on_exit(record__exit, rec);
        if (file->is_pipe) {
                err = perf_header__write_pipe(file->fd);
                if (err < 0)
                        goto out_delete_session;
        } else {
-                err = perf_session__write_header(session, evsel_list,
+                err = perf_session__write_header(session, rec->evlist,
                                                 file->fd, false);
                if (err < 0)
                        goto out_delete_session;
@@ -444,7 +437,7 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
                        goto out_delete_session;
                }
-                if (have_tracepoints(&evsel_list->entries)) {
+                if (have_tracepoints(&rec->evlist->entries)) {
                        /*
                         * FIXME err <= 0 here actually means that
                         * there were no tracepoints so its not really
@@ -453,7 +446,7 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
                         * return this more properly and also
                         * propagate errors that now are calling die()
                         */
-                        err = perf_event__synthesize_tracing_data(tool, file->fd, evsel_list,
+                        err = perf_event__synthesize_tracing_data(tool, file->fd, rec->evlist,
                                                                  process_synthesized_event);
                        if (err <= 0) {
                                pr_err("Couldn't record tracing data.\n");
@@ -485,7 +478,7 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
                                         perf_event__synthesize_guest_os, tool);
        }
-        err = __machine__synthesize_threads(machine, tool, &opts->target, evsel_list->threads,
+        err = __machine__synthesize_threads(machine, tool, &opts->target, rec->evlist->threads,
                                            process_synthesized_event, opts->sample_address);
        if (err != 0)
                goto out_delete_session;
@@ -506,19 +499,24 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
         * (apart from group members) have enable_on_exec=1 set,
         * so don't spoil it by prematurely enabling them.
         */
-        if (!target__none(&opts->target))
+        if (!target__none(&opts->target) && !opts->initial_delay)
-                perf_evlist__enable(evsel_list);
+                perf_evlist__enable(rec->evlist);
        /*
         * Let the child rip
         */
        if (forks)
-                perf_evlist__start_workload(evsel_list);
+                perf_evlist__start_workload(rec->evlist);
+        if (opts->initial_delay) {
+                usleep(opts->initial_delay * 1000);
+                perf_evlist__enable(rec->evlist);
+        }
        for (;;) {
                int hits = rec->samples;
-                if (perf_record__mmap_read_all(rec) < 0) {
+                if (record__mmap_read_all(rec) < 0) {
                        err = -1;
                        goto out_delete_session;
                }
@@ -526,7 +524,7 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
                if (hits == rec->samples) {
                        if (done)
                                break;
-                        err = poll(evsel_list->pollfd, evsel_list->nr_fds, -1);
+                        err = poll(rec->evlist->pollfd, rec->evlist->nr_fds, -1);
                        waking++;
                }
@@ -536,11 +534,19 @@ static int __cmd_record(struct perf_record *rec, int argc, const char **argv)
                 * disable events in this case.
                 */
                if (done && !disabled && !target__none(&opts->target)) {
-                        perf_evlist__disable(evsel_list);
+                        perf_evlist__disable(rec->evlist);
                        disabled = true;
                }
        }
+        if (forks && workload_exec_errno) {
+                char msg[512];
+                const char *emsg = strerror_r(workload_exec_errno, msg, sizeof(msg));
+                pr_err("Workload failed: %s\n", emsg);
+                err = -1;
+                goto out_delete_session;
+        }
        if (quiet || signr == SIGUSR1)
                return 0;
@@ -677,7 +683,7 @@ static int get_stack_size(char *str, unsigned long *_size)
 }
 #endif /* HAVE_LIBUNWIND_SUPPORT */
-int record_parse_callchain(const char *arg, struct perf_record_opts *opts)
+int record_parse_callchain(const char *arg, struct record_opts *opts)
 {
        char *tok, *name, *saveptr = NULL;
        char *buf;
@@ -733,7 +739,7 @@ int record_parse_callchain(const char *arg, struct perf_record_opts *opts)
        return ret;
 }
-static void callchain_debug(struct perf_record_opts *opts)
+static void callchain_debug(struct record_opts *opts)
 {
        pr_debug("callchain: type %d\n", opts->call_graph);
@@ -746,7 +752,7 @@ int record_parse_callchain_opt(const struct option *opt,
                               const char *arg,
                               int unset)
 {
-        struct perf_record_opts *opts = opt->value;
+        struct record_opts *opts = opt->value;
        int ret;
        /* --no-call-graph */
@@ -767,7 +773,7 @@ int record_callchain_opt(const struct option *opt,
                         const char *arg __maybe_unused,
                         int unset __maybe_unused)
 {
-        struct perf_record_opts *opts = opt->value;
+        struct record_opts *opts = opt->value;
        if (opts->call_graph == CALLCHAIN_NONE)
                opts->call_graph = CALLCHAIN_FP;
@@ -783,8 +789,8 @@ static const char * const record_usage[] = {
 };
 /*
- * XXX Ideally would be local to cmd_record() and passed to a perf_record__new
+ * XXX Ideally would be local to cmd_record() and passed to a record__new
- * because we need to have access to it in perf_record__exit, that is called
+ * because we need to have access to it in record__exit, that is called
 * after cmd_record() exits, but since record_options need to be accessible to
 * builtin-script, leave it here.
 *
@@ -792,7 +798,7 @@ static const char * const record_usage[] = {
 *
 * Just say no to tons of global variables, sigh.
 */
-static struct perf_record record = {
+static struct record record = {
        .opts = {
                .mmap_pages          = UINT_MAX,
                .user_freq           = UINT_MAX,
@@ -800,6 +806,7 @@ static struct perf_record record = {
                .freq                = 4000,
                .target              = {
                        .uses_mmap   = true,
+                        .default_per_cpu = true,
                },
        },
 };
@@ -815,7 +822,7 @@ const char record_callchain_help[] = CALLCHAIN_HELP "fp";
 /*
 * XXX Will stay a global variable till we fix builtin-script.c to stop messing
 * with it and switch to use the library functions in perf_evlist that came
- * from builtin-record.c, i.e. use perf_record_opts,
+ * from builtin-record.c, i.e. use record_opts,
 * perf_evlist__prepare_workload, etc instead of fork+exec'in 'perf record',
 * using pipes, etc.
 */
@@ -831,7 +838,7 @@ const struct option record_options[] = {
                    "record events on existing thread id"),
        OPT_INTEGER('r', "realtime", &record.realtime_prio,
                    "collect data with this RT SCHED_FIFO priority"),
-        OPT_BOOLEAN('D', "no-delay", &record.opts.no_delay,
+        OPT_BOOLEAN(0, "no-buffering", &record.opts.no_buffering,
                    "collect data without buffering"),
        OPT_BOOLEAN('R', "raw-samples", &record.opts.raw_samples,
                    "collect raw sample records from all opened counters"),
@@ -842,8 +849,9 @@ const struct option record_options[] = {
        OPT_U64('c', "count", &record.opts.user_interval, "event period to sample"),
        OPT_STRING('o', "output", &record.file.path, "file",
                    "output file name"),
-        OPT_BOOLEAN('i', "no-inherit", &record.opts.no_inherit,
+        OPT_BOOLEAN_SET('i', "no-inherit", &record.opts.no_inherit,
-                    "child tasks do not inherit counters"),
+                        &record.opts.no_inherit_set,
+                        "child tasks do not inherit counters"),
        OPT_UINTEGER('F', "freq", &record.opts.user_freq, "profile at this frequency"),
        OPT_CALLBACK('m', "mmap-pages", &record.opts.mmap_pages, "pages",
                     "number of mmap data pages",
@@ -874,6 +882,8 @@ const struct option record_options[] = {
        OPT_CALLBACK('G', "cgroup", &record.evlist, "name",
                     "monitor event in cgroup name only",
                     parse_cgroups),
+        OPT_UINTEGER('D', "delay", &record.opts.initial_delay,
+                  "ms to wait before starting measurement after program start"),
        OPT_STRING('u', "uid", &record.opts.target.uid_str, "user",
                   "user to profile"),
@@ -888,24 +898,21 @@ const struct option record_options[] = {
                    "sample by weight (on special events only)"),
        OPT_BOOLEAN(0, "transaction", &record.opts.sample_transaction,
                    "sample transaction flags (special events only)"),
-        OPT_BOOLEAN(0, "force-per-cpu", &record.opts.target.force_per_cpu,
+        OPT_BOOLEAN(0, "per-thread", &record.opts.target.per_thread,
-                    "force the use of per-cpu mmaps"),
+                    "use per-thread mmaps"),
        OPT_END()
 };
 int cmd_record(int argc, const char **argv, const char *prefix __maybe_unused)
 {
        int err = -ENOMEM;
-        struct perf_evlist *evsel_list;
+        struct record *rec = &record;
-        struct perf_record *rec = &record;
        char errbuf[BUFSIZ];
-        evsel_list = perf_evlist__new();
+        rec->evlist = perf_evlist__new();
-        if (evsel_list == NULL)
+        if (rec->evlist == NULL)
                return -ENOMEM;
-        rec->evlist = evsel_list;
        argc = parse_options(argc, argv, record_options, record_usage,
                            PARSE_OPT_STOP_AT_NON_OPTION);
        if (!argc && target__none(&rec->opts.target))
@@ -932,12 +939,15 @@ int cmd_record(int argc, const char **argv, const char *prefix __maybe_unused)
        if (rec->no_buildid_cache || rec->no_buildid)
                disable_buildid_cache();
-        if (evsel_list->nr_entries == 0 &&
+        if (rec->evlist->nr_entries == 0 &&
-            perf_evlist__add_default(evsel_list) < 0) {
+            perf_evlist__add_default(rec->evlist) < 0) {
                pr_err("Not enough memory for event selector list\n");
                goto out_symbol_exit;
        }
+        if (rec->opts.target.tid && !rec->opts.no_inherit_set)
+                rec->opts.no_inherit = true;
        err = target__validate(&rec->opts.target);
        if (err) {
                target__strerror(&rec->opts.target, err, errbuf, BUFSIZ);
@@ -956,20 +966,15 @@ int cmd_record(int argc, const char **argv, const char *prefix __maybe_unused)
        }
        err = -ENOMEM;
-        if (perf_evlist__create_maps(evsel_list, &rec->opts.target) < 0)
+        if (perf_evlist__create_maps(rec->evlist, &rec->opts.target) < 0)
                usage_with_options(record_usage, record_options);
-        if (perf_record_opts__config(&rec->opts)) {
+        if (record_opts__config(&rec->opts)) {
                err = -EINVAL;
-                goto out_free_fd;
+                goto out_symbol_exit;
        }
        err = __cmd_record(&record, argc, argv);
-        perf_evlist__munmap(evsel_list);
-        perf_evlist__close(evsel_list);
-out_free_fd:
-        perf_evlist__delete_maps(evsel_list);
 out_symbol_exit:
        symbol__exit();
        return err;
diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c
index 8cf8e66ba594..3c53ec268fbc 100644
--- a/tools/perf/builtin-report.c
+++ b/tools/perf/builtin-report.c
@@ -39,7 +39,7 @@
 #include <dlfcn.h>
 #include <linux/bitmap.h>
-struct perf_report {
+struct report {
        struct perf_tool        tool;
        struct perf_session     *session;
        bool                    force, use_tui, use_gtk, use_stdio;
@@ -49,6 +49,8 @@ struct perf_report {
        bool                    show_threads;
        bool                    inverted_callchain;
        bool                    mem_mode;
+        bool                    header;
+        bool                    header_only;
        int                     max_stack;
        struct perf_read_values show_threads_values;
        const char              *pretty_printing_style;
@@ -58,14 +60,14 @@ struct perf_report {
        DECLARE_BITMAP(cpu_bitmap, MAX_NR_CPUS);
 };
-static int perf_report_config(const char *var, const char *value, void *cb)
+static int report__config(const char *var, const char *value, void *cb)
 {
        if (!strcmp(var, "report.group")) {
                symbol_conf.event_group = perf_config_bool(var, value);
                return 0;
        }
        if (!strcmp(var, "report.percent-limit")) {
-                struct perf_report *rep = cb;
+                struct report *rep = cb;
                rep->min_percent = strtof(value, NULL);
                return 0;
        }
@@ -73,31 +75,22 @@ static int perf_report_config(const char *var, const char *value, void *cb)
        return perf_default_config(var, value, cb);
 }
-static int perf_report__add_mem_hist_entry(struct perf_tool *tool,
+static int report__add_mem_hist_entry(struct perf_tool *tool, struct addr_location *al,
-                                           struct addr_location *al,
+                                      struct perf_sample *sample, struct perf_evsel *evsel,
-                                           struct perf_sample *sample,
+                                      union perf_event *event)
-                                           struct perf_evsel *evsel,
-                                           struct machine *machine,
-                                           union perf_event *event)
 {
-        struct perf_report *rep = container_of(tool, struct perf_report, tool);
+        struct report *rep = container_of(tool, struct report, tool);
        struct symbol *parent = NULL;
        u8 cpumode = event->header.misc & PERF_RECORD_MISC_CPUMODE_MASK;
-        int err = 0;
        struct hist_entry *he;
        struct mem_info *mi, *mx;
        uint64_t cost;
+        int err = sample__resolve_callchain(sample, &parent, evsel, al, rep->max_stack);
-        if ((sort__has_parent || symbol_conf.use_callchain) &&
+        if (err)
-            sample->callchain) {
+                return err;
-                err = machine__resolve_callchain(machine, evsel, al->thread,
-                                                 sample, &parent, al,
-                                                 rep->max_stack);
-                if (err)
-                        return err;
-        }
-        mi = machine__resolve_mem(machine, al->thread, sample, cpumode);
+        mi = machine__resolve_mem(al->machine, al->thread, sample, cpumode);
        if (!mi)
                return -ENOMEM;
@@ -120,77 +113,36 @@ static int perf_report__add_mem_hist_entry(struct perf_tool *tool,
        if (!he)
                return -ENOMEM;
-        /*
+        err = hist_entry__inc_addr_samples(he, evsel->idx, al->addr);
-         * In the TUI browser, we are doing integrated annotation,
+        if (err)
-         * so we don't allocate the extra space needed because the stdio
+                goto out;
-         * code will not use it.
-         */
-        if (sort__has_sym && he->ms.sym && use_browser > 0) {
-                struct annotation *notes = symbol__annotation(he->ms.sym);
-                assert(evsel != NULL);
-                if (notes->src == NULL && symbol__alloc_hist(he->ms.sym) < 0)
-                        goto out;
-                err = hist_entry__inc_addr_samples(he, evsel->idx, al->addr);
-                if (err)
-                        goto out;
-        }
-        if (sort__has_sym && he->mem_info->daddr.sym && use_browser > 0) {
+        mx = he->mem_info;
-                struct annotation *notes;
+        err = addr_map_symbol__inc_samples(&mx->daddr, evsel->idx);
+        if (err)
-                mx = he->mem_info;
+                goto out;
-                notes = symbol__annotation(mx->daddr.sym);
-                if (notes->src == NULL && symbol__alloc_hist(mx->daddr.sym) < 0)
-                        goto out;
-                err = symbol__inc_addr_samples(mx->daddr.sym,
-                                               mx->daddr.map,
-                                               evsel->idx,
-                                               mx->daddr.al_addr);
-                if (err)
-                        goto out;
-        }
        evsel->hists.stats.total_period += cost;
        hists__inc_nr_events(&evsel->hists, PERF_RECORD_SAMPLE);
-        err = 0;
+        err = hist_entry__append_callchain(he, sample);
-        if (symbol_conf.use_callchain) {
-                err = callchain_append(he->callchain,
-                                       &callchain_cursor,
-                                       sample->period);
-        }
 out:
        return err;
 }
-static int perf_report__add_branch_hist_entry(struct perf_tool *tool,
+static int report__add_branch_hist_entry(struct perf_tool *tool, struct addr_location *al,
-                                        struct addr_location *al,
+                                         struct perf_sample *sample, struct perf_evsel *evsel)
-                                        struct perf_sample *sample,
-                                        struct perf_evsel *evsel,
-                                      struct machine *machine)
 {
-        struct perf_report *rep = container_of(tool, struct perf_report, tool);
+        struct report *rep = container_of(tool, struct report, tool);
        struct symbol *parent = NULL;
-        int err = 0;
        unsigned i;
        struct hist_entry *he;
        struct branch_info *bi, *bx;
+        int err = sample__resolve_callchain(sample, &parent, evsel, al, rep->max_stack);
-        if ((sort__has_parent || symbol_conf.use_callchain)
+        if (err)
-            && sample->callchain) {
+                return err;
-                err = machine__resolve_callchain(machine, evsel, al->thread,
-                                                 sample, &parent, al,
-                                                 rep->max_stack);
-                if (err)
-                        return err;
-        }
-        bi = machine__resolve_bstack(machine, al->thread,
+        bi = machine__resolve_bstack(al->machine, al->thread,
                                     sample->branch_stack);
        if (!bi)
                return -ENOMEM;
@@ -212,35 +164,15 @@ static int perf_report__add_branch_hist_entry(struct perf_tool *tool,
                he = __hists__add_entry(&evsel->hists, al, parent, &bi[i], NULL,
                                        1, 1, 0);
                if (he) {
-                        struct annotation *notes;
                        bx = he->branch_info;
-                        if (bx->from.sym && use_browser == 1 && sort__has_sym) {
+                        err = addr_map_symbol__inc_samples(&bx->from, evsel->idx);
-                                notes = symbol__annotation(bx->from.sym);
+                        if (err)
-                                if (!notes->src
+                                goto out;
-                                    && symbol__alloc_hist(bx->from.sym) < 0)
-                                        goto out;
+                        err = addr_map_symbol__inc_samples(&bx->to, evsel->idx);
+                        if (err)
-                                err = symbol__inc_addr_samples(bx->from.sym,
+                                goto out;
-                                                               bx->from.map,
-                                                               evsel->idx,
-                                                               bx->from.al_addr);
-                                if (err)
-                                        goto out;
-                        }
-                        if (bx->to.sym && use_browser == 1 && sort__has_sym) {
-                                notes = symbol__annotation(bx->to.sym);
-                                if (!notes->src
-                                    && symbol__alloc_hist(bx->to.sym) < 0)
-                                        goto out;
-                                err = symbol__inc_addr_samples(bx->to.sym,
-                                                               bx->to.map,
-                                                               evsel->idx,
-                                                               bx->to.al_addr);
-                                if (err)
-                                        goto out;
-                        }
                        evsel->hists.stats.total_period += 1;
                        hists__inc_nr_events(&evsel->hists, PERF_RECORD_SAMPLE);
                } else
@@ -252,24 +184,16 @@ out:
        return err;
 }
-static int perf_evsel__add_hist_entry(struct perf_tool *tool,
+static int report__add_hist_entry(struct perf_tool *tool, struct perf_evsel *evsel,
-                                      struct perf_evsel *evsel,
+                                  struct addr_location *al, struct perf_sample *sample)
-                                      struct addr_location *al,
-                                      struct perf_sample *sample,
-                                      struct machine *machine)
 {
-        struct perf_report *rep = container_of(tool, struct perf_report, tool);
+        struct report *rep = container_of(tool, struct report, tool);
        struct symbol *parent = NULL;
-        int err = 0;
        struct hist_entry *he;
+        int err = sample__resolve_callchain(sample, &parent, evsel, al, rep->max_stack);
-        if ((sort__has_parent || symbol_conf.use_callchain) && sample->callchain) {
+        if (err)
-                err = machine__resolve_callchain(machine, evsel, al->thread,
+                return err;
-                                                 sample, &parent, al,
-                                                 rep->max_stack);
-                if (err)
-                        return err;
-        }
        he = __hists__add_entry(&evsel->hists, al, parent, NULL, NULL,
                                sample->period, sample->weight,
@@ -277,30 +201,11 @@ static int perf_evsel__add_hist_entry(struct perf_tool *tool,
        if (he == NULL)
                return -ENOMEM;
-        if (symbol_conf.use_callchain) {
+        err = hist_entry__append_callchain(he, sample);
-                err = callchain_append(he->callchain,
+        if (err)
-                                       &callchain_cursor,
+                goto out;
-                                       sample->period);
-                if (err)
-                        return err;
-        }
-        /*
-         * Only in the TUI browser we are doing integrated annotation,
-         * so we don't allocated the extra space needed because the stdio
-         * code will not use it.
-         */
-        if (he->ms.sym != NULL && use_browser == 1 && sort__has_sym) {
-                struct annotation *notes = symbol__annotation(he->ms.sym);
-                assert(evsel != NULL);
-                err = -ENOMEM;
-                if (notes->src == NULL && symbol__alloc_hist(he->ms.sym) < 0)
-                        goto out;
-                err = hist_entry__inc_addr_samples(he, evsel->idx, al->addr);
-        }
+        err = hist_entry__inc_addr_samples(he, evsel->idx, al->addr);
        evsel->hists.stats.total_period += sample->period;
        hists__inc_nr_events(&evsel->hists, PERF_RECORD_SAMPLE);
 out:
@@ -314,13 +219,13 @@ static int process_sample_event(struct perf_tool *tool,
                                struct perf_evsel *evsel,
                                struct machine *machine)
 {
-        struct perf_report *rep = container_of(tool, struct perf_report, tool);
+        struct report *rep = container_of(tool, struct report, tool);
        struct addr_location al;
        int ret;
        if (perf_event__preprocess_sample(event, machine, &al, sample) < 0) {
-                fprintf(stderr, "problem processing %d event, skipping it.\n",
+                pr_debug("problem processing %d event, skipping it.\n",
-                        event->header.type);
+                         event->header.type);
                return -1;
        }
@@ -331,21 +236,18 @@ static int process_sample_event(struct perf_tool *tool,
                return 0;
        if (sort__mode == SORT_MODE__BRANCH) {
-                ret = perf_report__add_branch_hist_entry(tool, &al, sample,
+                ret = report__add_branch_hist_entry(tool, &al, sample, evsel);
-                                                         evsel, machine);
                if (ret < 0)
                        pr_debug("problem adding lbr entry, skipping event\n");
        } else if (rep->mem_mode == 1) {
-                ret = perf_report__add_mem_hist_entry(tool, &al, sample,
+                ret = report__add_mem_hist_entry(tool, &al, sample, evsel, event);
-                                                      evsel, machine, event);
                if (ret < 0)
                        pr_debug("problem adding mem entry, skipping event\n");
        } else {
                if (al.map != NULL)
                        al.map->dso->hit = 1;
-                ret = perf_evsel__add_hist_entry(tool, evsel, &al, sample,
+                ret = report__add_hist_entry(tool, evsel, &al, sample);
-                                                 machine);
                if (ret < 0)
                        pr_debug("problem incrementing symbol period, skipping event\n");
        }
@@ -358,7 +260,7 @@ static int process_read_event(struct perf_tool *tool,
                              struct perf_evsel *evsel,
                              struct machine *machine __maybe_unused)
 {
-        struct perf_report *rep = container_of(tool, struct perf_report, tool);
+        struct report *rep = container_of(tool, struct report, tool);
        if (rep->show_threads) {
                const char *name = evsel ? perf_evsel__name(evsel) : "unknown";
@@ -377,7 +279,7 @@ static int process_read_event(struct perf_tool *tool,
 }
 /* For pipe mode, sample_type is not currently set */
-static int perf_report__setup_sample_type(struct perf_report *rep)
+static int report__setup_sample_type(struct report *rep)
 {
        struct perf_session *session = rep->session;
        u64 sample_type = perf_evlist__combined_sample_type(session->evlist);
@@ -422,8 +324,7 @@ static void sig_handler(int sig __maybe_unused)
        session_done = 1;
 }
-static size_t hists__fprintf_nr_sample_events(struct perf_report *rep,
+static size_t hists__fprintf_nr_sample_events(struct hists *hists, struct report *rep,
-                                              struct hists *hists,
                                              const char *evname, FILE *fp)
 {
        size_t ret;
@@ -460,12 +361,12 @@ static size_t hists__fprintf_nr_sample_events(struct perf_report *rep,
 }
 static int perf_evlist__tty_browse_hists(struct perf_evlist *evlist,
-                                         struct perf_report *rep,
+                                         struct report *rep,
                                         const char *help)
 {
        struct perf_evsel *pos;
-        list_for_each_entry(pos, &evlist->entries, node) {
+        evlist__for_each(evlist, pos) {
                struct hists *hists = &pos->hists;
                const char *evname = perf_evsel__name(pos);
@@ -473,7 +374,7 @@ static int perf_evlist__tty_browse_hists(struct perf_evlist *evlist,
                    !perf_evsel__is_group_leader(pos))
                        continue;
-                hists__fprintf_nr_sample_events(rep, hists, evname, stdout);
+                hists__fprintf_nr_sample_events(hists, rep, evname, stdout);
                hists__fprintf(hists, true, 0, 0, rep->min_percent, stdout);
                fprintf(stdout, "\n\n");
        }
@@ -493,43 +394,11 @@ static int perf_evlist__tty_browse_hists(struct perf_evlist *evlist,
        return 0;
 }
-static int __cmd_report(struct perf_report *rep)
+static void report__warn_kptr_restrict(const struct report *rep)
 {
-        int ret = -EINVAL;
+        struct map *kernel_map = rep->session->machines.host.vmlinux_maps[MAP__FUNCTION];
-        u64 nr_samples;
+        struct kmap *kernel_kmap = map__kmap(kernel_map);
-        struct perf_session *session = rep->session;
-        struct perf_evsel *pos;
-        struct map *kernel_map;
-        struct kmap *kernel_kmap;
-        const char *help = "For a higher level overview, try: perf report --sort comm,dso";
-        struct ui_progress prog;
-        struct perf_data_file *file = session->file;
-        signal(SIGINT, sig_handler);
-        if (rep->cpu_list) {
-                ret = perf_session__cpu_bitmap(session, rep->cpu_list,
-                                               rep->cpu_bitmap);
-                if (ret)
-                        return ret;
-        }
-        if (use_browser <= 0)
-                perf_session__fprintf_info(session, stdout, rep->show_full_info);
-        if (rep->show_threads)
-                perf_read_values_init(&rep->show_threads_values);
-        ret = perf_report__setup_sample_type(rep);
-        if (ret)
-                return ret;
-        ret = perf_session__process_events(session, &rep->tool);
-        if (ret)
-                return ret;
-        kernel_map = session->machines.host.vmlinux_maps[MAP__FUNCTION];
-        kernel_kmap = map__kmap(kernel_map);
        if (kernel_map == NULL ||
            (kernel_map->dso->hit &&
             (kernel_kmap->ref_reloc_sym == NULL ||
@@ -552,26 +421,73 @@ static int __cmd_report(struct perf_report *rep)
 "Samples in kernel modules can't be resolved as well.\n\n",
                desc);
        }
+}
-        if (verbose > 3)
+static int report__gtk_browse_hists(struct report *rep, const char *help)
-                perf_session__fprintf(session, stdout);
+{
+        int (*hist_browser)(struct perf_evlist *evlist, const char *help,
+                            struct hist_browser_timer *timer, float min_pcnt);
-        if (verbose > 2)
+        hist_browser = dlsym(perf_gtk_handle, "perf_evlist__gtk_browse_hists");
-                perf_session__fprintf_dsos(session, stdout);
-        if (dump_trace) {
+        if (hist_browser == NULL) {
-                perf_session__fprintf_nr_events(session, stdout);
+                ui__error("GTK browser not found!\n");
-                return 0;
+                return -1;
        }
-        nr_samples = 0;
+        return hist_browser(rep->session->evlist, help, NULL, rep->min_percent);
-        list_for_each_entry(pos, &session->evlist->entries, node)
+}
+static int report__browse_hists(struct report *rep)
+{
+        int ret;
+        struct perf_session *session = rep->session;
+        struct perf_evlist *evlist = session->evlist;
+        const char *help = "For a higher level overview, try: perf report --sort comm,dso";
+        switch (use_browser) {
+        case 1:
+                ret = perf_evlist__tui_browse_hists(evlist, help, NULL,
+                                                    rep->min_percent,
+                                                    &session->header.env);
+                /*
+                 * Usually "ret" is the last pressed key, and we only
+                 * care if the key notifies us to switch data file.
+                 */
+                if (ret != K_SWITCH_INPUT_DATA)
+                        ret = 0;
+                break;
+        case 2:
+                ret = report__gtk_browse_hists(rep, help);
+                break;
+        default:
+                ret = perf_evlist__tty_browse_hists(evlist, rep, help);
+                break;
+        }
+        return ret;
+}
+static u64 report__collapse_hists(struct report *rep)
+{
+        struct ui_progress prog;
+        struct perf_evsel *pos;
+        u64 nr_samples = 0;
+        /*
+         * Count number of histogram entries to use when showing progress,
+         * reusing nr_samples variable.
+         */
+        evlist__for_each(rep->session->evlist, pos)
                nr_samples += pos->hists.nr_entries;
        ui_progress__init(&prog, nr_samples, "Merging related events...");
+        /*
+         * Count total number of samples, will be used to check if this
+         * session had any.
+         */
        nr_samples = 0;
-        list_for_each_entry(pos, &session->evlist->entries, node) {
+        evlist__for_each(rep->session->evlist, pos) {
                struct hists *hists = &pos->hists;
                if (pos->idx == 0)
@@ -589,8 +505,57 @@ static int __cmd_report(struct perf_report *rep)
                        hists__link(leader_hists, hists);
                }
        }
        ui_progress__finish();
+        return nr_samples;
+}
+static int __cmd_report(struct report *rep)
+{
+        int ret;
+        u64 nr_samples;
+        struct perf_session *session = rep->session;
+        struct perf_evsel *pos;
+        struct perf_data_file *file = session->file;
+        signal(SIGINT, sig_handler);
+        if (rep->cpu_list) {
+                ret = perf_session__cpu_bitmap(session, rep->cpu_list,
+                                               rep->cpu_bitmap);
+                if (ret)
+                        return ret;
+        }
+        if (rep->show_threads)
+                perf_read_values_init(&rep->show_threads_values);
+        ret = report__setup_sample_type(rep);
+        if (ret)
+                return ret;
+        ret = perf_session__process_events(session, &rep->tool);
+        if (ret)
+                return ret;
+        report__warn_kptr_restrict(rep);
+        if (use_browser == 0) {
+                if (verbose > 3)
+                        perf_session__fprintf(session, stdout);
+                if (verbose > 2)
+                        perf_session__fprintf_dsos(session, stdout);
+                if (dump_trace) {
+                        perf_session__fprintf_nr_events(session, stdout);
+                        return 0;
+                }
+        }
+        nr_samples = report__collapse_hists(rep);
        if (session_done())
                return 0;
@@ -599,47 +564,16 @@ static int __cmd_report(struct perf_report *rep)
                return 0;
        }
-        list_for_each_entry(pos, &session->evlist->entries, node)
+        evlist__for_each(session->evlist, pos)
                hists__output_resort(&pos->hists);
-        if (use_browser > 0) {
+        return report__browse_hists(rep);
-                if (use_browser == 1) {
-                        ret = perf_evlist__tui_browse_hists(session->evlist,
-                                                        help, NULL,
-                                                        rep->min_percent,
-                                                        &session->header.env);
-                        /*
-                         * Usually "ret" is the last pressed key, and we only
-                         * care if the key notifies us to switch data file.
-                         */
-                        if (ret != K_SWITCH_INPUT_DATA)
-                                ret = 0;
-                } else if (use_browser == 2) {
-                        int (*hist_browser)(struct perf_evlist *,
-                                            const char *,
-                                            struct hist_browser_timer *,
-                                            float min_pcnt);
-                        hist_browser = dlsym(perf_gtk_handle,
-                                             "perf_evlist__gtk_browse_hists");
-                        if (hist_browser == NULL) {
-                                ui__error("GTK browser not found!\n");
-                                return ret;
-                        }
-                        hist_browser(session->evlist, help, NULL,
-                                     rep->min_percent);
-                }
-        } else
-                perf_evlist__tty_browse_hists(session->evlist, rep, help);
-        return ret;
 }
 static int
 parse_callchain_opt(const struct option *opt, const char *arg, int unset)
 {
-        struct perf_report *rep = (struct perf_report *)opt->value;
+        struct report *rep = (struct report *)opt->value;
        char *tok, *tok2;
        char *endptr;
@@ -721,7 +655,7 @@ parse_callchain_opt(const struct option *opt, const char *arg, int unset)
                return -1;
 setup:
        if (callchain_register_param(&callchain_param) < 0) {
-                fprintf(stderr, "Can't register callchain params\n");
+                pr_err("Can't register callchain params\n");
                return -1;
        }
        return 0;
@@ -759,7 +693,7 @@ static int
 parse_percent_limit(const struct option *opt, const char *str,
                    int unset __maybe_unused)
 {
-        struct perf_report *rep = opt->value;
+        struct report *rep = opt->value;
        rep->min_percent = strtof(str, NULL);
        return 0;
@@ -777,7 +711,7 @@ int cmd_report(int argc, const char **argv, const char *prefix __maybe_unused)
                "perf report [<options>]",
                NULL
        };
-        struct perf_report report = {
+        struct report report = {
                .tool = {
                        .sample          = process_sample_event,
                        .mmap            = perf_event__process_mmap,
@@ -820,6 +754,9 @@ int cmd_report(int argc, const char **argv, const char *prefix __maybe_unused)
        OPT_BOOLEAN(0, "gtk", &report.use_gtk, "Use the GTK2 interface"),
        OPT_BOOLEAN(0, "stdio", &report.use_stdio,
                    "Use the stdio interface"),
+        OPT_BOOLEAN(0, "header", &report.header, "Show data header."),
+        OPT_BOOLEAN(0, "header-only", &report.header_only,
+                    "Show only data header."),
        OPT_STRING('s', "sort", &sort_order, "key[,key2...]",
                   "sort by key(s): pid, comm, dso, symbol, parent, cpu, srcline,"
                   " dso_to, dso_from, symbol_to, symbol_from, mispredict,"
@@ -890,7 +827,7 @@ int cmd_report(int argc, const char **argv, const char *prefix __maybe_unused)
                .mode  = PERF_DATA_MODE_READ,
        };
-        perf_config(perf_report_config, &report);
+        perf_config(report__config, &report);
        argc = parse_options(argc, argv, options, report_usage, 0);
@@ -940,7 +877,7 @@ repeat:
        }
        if (report.mem_mode) {
                if (sort__mode == SORT_MODE__BRANCH) {
-                        fprintf(stderr, "branch and mem mode incompatible\n");
+                        pr_err("branch and mem mode incompatible\n");
                        goto error;
                }
                sort__mode = SORT_MODE__MEMORY;
@@ -963,6 +900,10 @@ repeat:
                        goto error;
        }
+        /* Force tty output for header output. */
+        if (report.header || report.header_only)
+                use_browser = 0;
        if (strcmp(input_name, "-") != 0)
                setup_browser(true);
        else {
@@ -970,6 +911,16 @@ repeat:
                perf_hpp__init();
        }
+        if (report.header || report.header_only) {
+                perf_session__fprintf_info(session, stdout,
+                                           report.show_full_info);
+                if (report.header_only)
+                        return 0;
+        } else if (use_browser == 0) {
+                fputs("# To display the perf.data header info, please use --header/--header-only options.\n#\n",
+                      stdout);
+        }
        /*
         * Only in the TUI browser we are doing integrated annotation,
         * so don't allocate extra space that won't be used in the stdio
diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
index 0f3c65518a2c..6a76a07b6789 100644
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -469,7 +469,7 @@ static void *thread_func(void *ctx)
        char comm2[22];
        int fd;
-        free(parms);
+        zfree(&parms);
        sprintf(comm2, ":%s", this_task->comm);
        prctl(PR_SET_NAME, comm2);
diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
index baf17989a216..9e9c91f5b7fa 100644
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -43,6 +43,7 @@ enum perf_output_field {
        PERF_OUTPUT_DSO             = 1U << 9,
        PERF_OUTPUT_ADDR            = 1U << 10,
        PERF_OUTPUT_SYMOFFSET       = 1U << 11,
+        PERF_OUTPUT_SRCLINE         = 1U << 12,
 };
 struct output_option {
@@ -61,6 +62,7 @@ struct output_option {
        {.str = "dso",   .field = PERF_OUTPUT_DSO},
        {.str = "addr",  .field = PERF_OUTPUT_ADDR},
        {.str = "symoff", .field = PERF_OUTPUT_SYMOFFSET},
+        {.str = "srcline", .field = PERF_OUTPUT_SRCLINE},
 };
 /* default set to maintain compatibility with current format */
@@ -210,6 +212,11 @@ static int perf_evsel__check_attr(struct perf_evsel *evsel,
                       "to DSO.\n");
                return -EINVAL;
        }
+        if (PRINT_FIELD(SRCLINE) && !PRINT_FIELD(IP)) {
+                pr_err("Display of source line number requested but sample IP is not\n"
+                       "selected. Hence, no address to lookup the source line number.\n");
+                return -EINVAL;
+        }
        if ((PRINT_FIELD(PID) || PRINT_FIELD(TID)) &&
                perf_evsel__check_stype(evsel, PERF_SAMPLE_TID, "TID",
@@ -245,6 +252,9 @@ static void set_print_ip_opts(struct perf_event_attr *attr)
        if (PRINT_FIELD(SYMOFFSET))
                output[type].print_ip_opts |= PRINT_IP_OPT_SYMOFFSET;
+        if (PRINT_FIELD(SRCLINE))
+                output[type].print_ip_opts |= PRINT_IP_OPT_SRCLINE;
 }
 /*
@@ -280,6 +290,30 @@ static int perf_session__check_output_opt(struct perf_session *session)
                set_print_ip_opts(&evsel->attr);
        }
+        /*
+         * set default for tracepoints to print symbols only
+         * if callchains are present
+         */
+        if (symbol_conf.use_callchain &&
+            !output[PERF_TYPE_TRACEPOINT].user_set) {
+                struct perf_event_attr *attr;
+                j = PERF_TYPE_TRACEPOINT;
+                evsel = perf_session__find_first_evtype(session, j);
+                if (evsel == NULL)
+                        goto out;
+                attr = &evsel->attr;
+                if (attr->sample_type & PERF_SAMPLE_CALLCHAIN) {
+                        output[j].fields |= PERF_OUTPUT_IP;
+                        output[j].fields |= PERF_OUTPUT_SYM;
+                        output[j].fields |= PERF_OUTPUT_DSO;
+                        set_print_ip_opts(attr);
+                }
+        }
+out:
        return 0;
 }
@@ -288,7 +322,6 @@ static void print_sample_start(struct perf_sample *sample,
                               struct perf_evsel *evsel)
 {
        struct perf_event_attr *attr = &evsel->attr;
-        const char *evname = NULL;
        unsigned long secs;
        unsigned long usecs;
        unsigned long long nsecs;
@@ -323,11 +356,6 @@ static void print_sample_start(struct perf_sample *sample,
                usecs = nsecs / NSECS_PER_USEC;
                printf("%5lu.%06lu: ", secs, usecs);
        }
-        if (PRINT_FIELD(EVNAME)) {
-                evname = perf_evsel__name(evsel);
-                printf("%s: ", evname ? evname : "[unknown]");
-        }
 }
 static bool is_bts_event(struct perf_event_attr *attr)
@@ -395,8 +423,8 @@ static void print_sample_addr(union perf_event *event,
 static void print_sample_bts(union perf_event *event,
                             struct perf_sample *sample,
                             struct perf_evsel *evsel,
-                             struct machine *machine,
+                             struct thread *thread,
-                             struct thread *thread)
+                             struct addr_location *al)
 {
        struct perf_event_attr *attr = &evsel->attr;
@@ -406,7 +434,7 @@ static void print_sample_bts(union perf_event *event,
                        printf(" ");
                else
                        printf("\n");
-                perf_evsel__print_ip(evsel, event, sample, machine,
+                perf_evsel__print_ip(evsel, sample, al,
                                     output[attr->type].print_ip_opts,
                                     PERF_MAX_STACK_DEPTH);
        }
@@ -417,15 +445,14 @@ static void print_sample_bts(union perf_event *event,
        if (PRINT_FIELD(ADDR) ||
            ((evsel->attr.sample_type & PERF_SAMPLE_ADDR) &&
             !output[attr->type].user_set))
-                print_sample_addr(event, sample, machine, thread, attr);
+                print_sample_addr(event, sample, al->machine, thread, attr);
        printf("\n");
 }
 static void process_event(union perf_event *event, struct perf_sample *sample,
-                          struct perf_evsel *evsel, struct machine *machine,
+                          struct perf_evsel *evsel, struct thread *thread,
-                          struct thread *thread,
+                          struct addr_location *al)
-                          struct addr_location *al __maybe_unused)
 {
        struct perf_event_attr *attr = &evsel->attr;
@@ -434,8 +461,13 @@ static void process_event(union perf_event *event, struct perf_sample *sample,
        print_sample_start(sample, thread, evsel);
+        if (PRINT_FIELD(EVNAME)) {
+                const char *evname = perf_evsel__name(evsel);
+                printf("%s: ", evname ? evname : "[unknown]");
+        }
        if (is_bts_event(attr)) {
-                print_sample_bts(event, sample, evsel, machine, thread);
+                print_sample_bts(event, sample, evsel, thread, al);
                return;
        }
@@ -443,7 +475,7 @@ static void process_event(union perf_event *event, struct perf_sample *sample,
                event_format__print(evsel->tp_format, sample->cpu,
                                    sample->raw_data, sample->raw_size);
        if (PRINT_FIELD(ADDR))
-                print_sample_addr(event, sample, machine, thread, attr);
+                print_sample_addr(event, sample, al->machine, thread, attr);
        if (PRINT_FIELD(IP)) {
                if (!symbol_conf.use_callchain)
@@ -451,7 +483,7 @@ static void process_event(union perf_event *event, struct perf_sample *sample,
                else
                        printf("\n");
-                perf_evsel__print_ip(evsel, event, sample, machine,
+                perf_evsel__print_ip(evsel, sample, al,
                                     output[attr->type].print_ip_opts,
                                     PERF_MAX_STACK_DEPTH);
        }
@@ -540,7 +572,7 @@ static int process_sample_event(struct perf_tool *tool __maybe_unused,
        if (cpu_list && !test_bit(sample->cpu, cpu_bitmap))
                return 0;
-        scripting_ops->process_event(event, sample, evsel, machine, thread, &al);
+        scripting_ops->process_event(event, sample, evsel, thread, &al);
        evsel->hists.stats.total_period += sample->period;
        return 0;
@@ -549,6 +581,8 @@ static int process_sample_event(struct perf_tool *tool __maybe_unused,
 struct perf_script {
        struct perf_tool        tool;
        struct perf_session     *session;
+        bool                    show_task_events;
+        bool                    show_mmap_events;
 };
 static int process_attr(struct perf_tool *tool, union perf_event *event,
@@ -569,7 +603,7 @@ static int process_attr(struct perf_tool *tool, union perf_event *event,
        if (evsel->attr.type >= PERF_TYPE_MAX)
                return 0;
-        list_for_each_entry(pos, &evlist->entries, node) {
+        evlist__for_each(evlist, pos) {
                if (pos->attr.type == evsel->attr.type && pos != evsel)
                        return 0;
        }
@@ -579,6 +613,163 @@ static int process_attr(struct perf_tool *tool, union perf_event *event,
        return perf_evsel__check_attr(evsel, scr->session);
 }
+static int process_comm_event(struct perf_tool *tool,
+                              union perf_event *event,
+                              struct perf_sample *sample,
+                              struct machine *machine)
+{
+        struct thread *thread;
+        struct perf_script *script = container_of(tool, struct perf_script, tool);
+        struct perf_session *session = script->session;
+        struct perf_evsel *evsel = perf_evlist__first(session->evlist);
+        int ret = -1;
+        thread = machine__findnew_thread(machine, event->comm.pid, event->comm.tid);
+        if (thread == NULL) {
+                pr_debug("problem processing COMM event, skipping it.\n");
+                return -1;
+        }
+        if (perf_event__process_comm(tool, event, sample, machine) < 0)
+                goto out;
+        if (!evsel->attr.sample_id_all) {
+                sample->cpu = 0;
+                sample->time = 0;
+                sample->tid = event->comm.tid;
+                sample->pid = event->comm.pid;
+        }
+        print_sample_start(sample, thread, evsel);
+        perf_event__fprintf(event, stdout);
+        ret = 0;
+out:
+        return ret;
+}
+static int process_fork_event(struct perf_tool *tool,
+                              union perf_event *event,
+                              struct perf_sample *sample,
+                              struct machine *machine)
+{
+        struct thread *thread;
+        struct perf_script *script = container_of(tool, struct perf_script, tool);
+        struct perf_session *session = script->session;
+        struct perf_evsel *evsel = perf_evlist__first(session->evlist);
+        if (perf_event__process_fork(tool, event, sample, machine) < 0)
+                return -1;
+        thread = machine__findnew_thread(machine, event->fork.pid, event->fork.tid);
+        if (thread == NULL) {
+                pr_debug("problem processing FORK event, skipping it.\n");
+                return -1;
+        }
+        if (!evsel->attr.sample_id_all) {
+                sample->cpu = 0;
+                sample->time = event->fork.time;
+                sample->tid = event->fork.tid;
+                sample->pid = event->fork.pid;
+        }
+        print_sample_start(sample, thread, evsel);
+        perf_event__fprintf(event, stdout);
+        return 0;
+}
+static int process_exit_event(struct perf_tool *tool,
+                              union perf_event *event,
+                              struct perf_sample *sample,
+                              struct machine *machine)
+{
+        struct thread *thread;
+        struct perf_script *script = container_of(tool, struct perf_script, tool);
+        struct perf_session *session = script->session;
+        struct perf_evsel *evsel = perf_evlist__first(session->evlist);
+        thread = machine__findnew_thread(machine, event->fork.pid, event->fork.tid);
+        if (thread == NULL) {
+                pr_debug("problem processing EXIT event, skipping it.\n");
+                return -1;
+        }
+        if (!evsel->attr.sample_id_all) {
+                sample->cpu = 0;
+                sample->time = 0;
+                sample->tid = event->comm.tid;
+                sample->pid = event->comm.pid;
+        }
+        print_sample_start(sample, thread, evsel);
+        perf_event__fprintf(event, stdout);
+        if (perf_event__process_exit(tool, event, sample, machine) < 0)
+                return -1;
+        return 0;
+}
+static int process_mmap_event(struct perf_tool *tool,
+                              union perf_event *event,
+                              struct perf_sample *sample,
+                              struct machine *machine)
+{
+        struct thread *thread;
+        struct perf_script *script = container_of(tool, struct perf_script, tool);
+        struct perf_session *session = script->session;
+        struct perf_evsel *evsel = perf_evlist__first(session->evlist);
+        if (perf_event__process_mmap(tool, event, sample, machine) < 0)
+                return -1;
+        thread = machine__findnew_thread(machine, event->mmap.pid, event->mmap.tid);
+        if (thread == NULL) {
+                pr_debug("problem processing MMAP event, skipping it.\n");
+                return -1;
+        }
+        if (!evsel->attr.sample_id_all) {
+                sample->cpu = 0;
+                sample->time = 0;
+                sample->tid = event->mmap.tid;
+                sample->pid = event->mmap.pid;
+        }
+        print_sample_start(sample, thread, evsel);
+        perf_event__fprintf(event, stdout);
+        return 0;
+}
+static int process_mmap2_event(struct perf_tool *tool,
+                              union perf_event *event,
+                              struct perf_sample *sample,
+                              struct machine *machine)
+{
+        struct thread *thread;
+        struct perf_script *script = container_of(tool, struct perf_script, tool);
+        struct perf_session *session = script->session;
+        struct perf_evsel *evsel = perf_evlist__first(session->evlist);
+        if (perf_event__process_mmap2(tool, event, sample, machine) < 0)
+                return -1;
+        thread = machine__findnew_thread(machine, event->mmap2.pid, event->mmap2.tid);
+        if (thread == NULL) {
+                pr_debug("problem processing MMAP2 event, skipping it.\n");
+                return -1;
+        }
+        if (!evsel->attr.sample_id_all) {
+                sample->cpu = 0;
+                sample->time = 0;
+                sample->tid = event->mmap2.tid;
+                sample->pid = event->mmap2.pid;
+        }
+        print_sample_start(sample, thread, evsel);
+        perf_event__fprintf(event, stdout);
+        return 0;
+}
 static void sig_handler(int sig __maybe_unused)
 {
        session_done = 1;
@@ -590,6 +781,17 @@ static int __cmd_script(struct perf_script *script)
        signal(SIGINT, sig_handler);
+        /* override event processing functions */
+        if (script->show_task_events) {
+                script->tool.comm = process_comm_event;
+                script->tool.fork = process_fork_event;
+                script->tool.exit = process_exit_event;
+        }
+        if (script->show_mmap_events) {
+                script->tool.mmap = process_mmap_event;
+                script->tool.mmap2 = process_mmap2_event;
+        }
        ret = perf_session__process_events(script->session, &script->tool);
        if (debug_mode)
@@ -900,9 +1102,9 @@ static struct script_desc *script_desc__new(const char *name)
 static void script_desc__delete(struct script_desc *s)
 {
-        free(s->name);
+        zfree(&s->name);
-        free(s->half_liner);
+        zfree(&s->half_liner);
-        free(s->args);
+        zfree(&s->args);
        free(s);
 }
@@ -1107,8 +1309,7 @@ static int check_ev_match(char *dir_name, char *scriptname,
                        snprintf(evname, len + 1, "%s", p);
                        match = 0;
-                        list_for_each_entry(pos,
+                        evlist__for_each(session->evlist, pos) {
-                                        &session->evlist->entries, node) {
                                if (!strcmp(perf_evsel__name(pos), evname)) {
                                        match = 1;
                                        break;
@@ -1290,6 +1491,8 @@ static int have_cmd(int argc, const char **argv)
 int cmd_script(int argc, const char **argv, const char *prefix __maybe_unused)
 {
        bool show_full_info = false;
+        bool header = false;
+        bool header_only = false;
        char *rec_script_path = NULL;
        char *rep_script_path = NULL;
        struct perf_session *session;
@@ -1328,6 +1531,8 @@ int cmd_script(int argc, const char **argv, const char *prefix __maybe_unused)
        OPT_STRING('i', "input", &input_name, "file", "input file name"),
        OPT_BOOLEAN('d', "debug-mode", &debug_mode,
                   "do various checks like samples ordering and lost events"),
+        OPT_BOOLEAN(0, "header", &header, "Show data header."),
+        OPT_BOOLEAN(0, "header-only", &header_only, "Show only data header."),
        OPT_STRING('k', "vmlinux", &symbol_conf.vmlinux_name,
                   "file", "vmlinux pathname"),
        OPT_STRING(0, "kallsyms", &symbol_conf.kallsyms_name,
@@ -1352,6 +1557,10 @@ int cmd_script(int argc, const char **argv, const char *prefix __maybe_unused)
                    "display extended information from perf.data file"),
        OPT_BOOLEAN('\0', "show-kernel-path", &symbol_conf.show_kernel_path,
                    "Show the path of [kernel.kallsyms]"),
+        OPT_BOOLEAN('\0', "show-task-events", &script.show_task_events,
+                    "Show the fork/comm/exit events"),
+        OPT_BOOLEAN('\0', "show-mmap-events", &script.show_mmap_events,
+                    "Show the mmap events"),
        OPT_END()
        };
        const char * const script_usage[] = {
@@ -1540,6 +1749,12 @@ int cmd_script(int argc, const char **argv, const char *prefix __maybe_unused)
        if (session == NULL)
                return -ENOMEM;
+        if (header || header_only) {
+                perf_session__fprintf_info(session, stdout, show_full_info);
+                if (header_only)
+                        return 0;
+        }
        script.session = session;
        if (cpu_list) {
@@ -1547,9 +1762,6 @@ int cmd_script(int argc, const char **argv, const char *prefix __maybe_unused)
                        return -1;
        }
-        if (!script_name && !generate_script_lang)
-                perf_session__fprintf_info(session, stdout, show_full_info);
        if (!no_callchain)
                symbol_conf.use_callchain = true;
        else
@@ -1588,7 +1800,7 @@ int cmd_script(int argc, const char **argv, const char *prefix __maybe_unused)
                        return -1;
                }
-                err = scripting_ops->generate_script(session->pevent,
+                err = scripting_ops->generate_script(session->tevent.pevent,
                                                     "perf-script");
                goto out;
        }
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index ee0d565f83e3..8b0e1c9234d9 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -138,6 +138,7 @@ static const char		*post_cmd			= NULL;
 static bool                     sync_run                        = false;
 static unsigned int             interval                        = 0;
 static unsigned int             initial_delay                   = 0;
+static unsigned int             unit_width                      = 4; /* strlen("unit") */
 static bool                     forever                         = false;
 static struct timespec          ref_time;
 static struct cpu_map           *aggr_map;
@@ -184,8 +185,7 @@ static int perf_evsel__alloc_stat_priv(struct perf_evsel *evsel)
 static void perf_evsel__free_stat_priv(struct perf_evsel *evsel)
 {
-        free(evsel->priv);
+        zfree(&evsel->priv);
-        evsel->priv = NULL;
 }
 static int perf_evsel__alloc_prev_raw_counts(struct perf_evsel *evsel)
@@ -207,15 +207,14 @@ static int perf_evsel__alloc_prev_raw_counts(struct perf_evsel *evsel)
 static void perf_evsel__free_prev_raw_counts(struct perf_evsel *evsel)
 {
-        free(evsel->prev_raw_counts);
+        zfree(&evsel->prev_raw_counts);
-        evsel->prev_raw_counts = NULL;
 }
 static void perf_evlist__free_stats(struct perf_evlist *evlist)
 {
        struct perf_evsel *evsel;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                perf_evsel__free_stat_priv(evsel);
                perf_evsel__free_counts(evsel);
                perf_evsel__free_prev_raw_counts(evsel);
@@ -226,7 +225,7 @@ static int perf_evlist__alloc_stats(struct perf_evlist *evlist, bool alloc_raw)
 {
        struct perf_evsel *evsel;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                if (perf_evsel__alloc_stat_priv(evsel) < 0 ||
                    perf_evsel__alloc_counts(evsel, perf_evsel__nr_cpus(evsel)) < 0 ||
                    (alloc_raw && perf_evsel__alloc_prev_raw_counts(evsel) < 0))
@@ -260,7 +259,7 @@ static void perf_stat__reset_stats(struct perf_evlist *evlist)
 {
        struct perf_evsel *evsel;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                perf_evsel__reset_stat_priv(evsel);
                perf_evsel__reset_counts(evsel, perf_evsel__nr_cpus(evsel));
        }
@@ -327,13 +326,13 @@ static struct perf_evsel *nth_evsel(int n)
        /* Assumes this only called when evsel_list does not change anymore. */
        if (!array) {
-                list_for_each_entry(ev, &evsel_list->entries, node)
+                evlist__for_each(evsel_list, ev)
                        array_len++;
                array = malloc(array_len * sizeof(void *));
                if (!array)
                        exit(ENOMEM);
                j = 0;
-                list_for_each_entry(ev, &evsel_list->entries, node)
+                evlist__for_each(evsel_list, ev)
                        array[j++] = ev;
        }
        if (n < array_len)
@@ -441,13 +440,13 @@ static void print_interval(void)
        char prefix[64];
        if (aggr_mode == AGGR_GLOBAL) {
-                list_for_each_entry(counter, &evsel_list->entries, node) {
+                evlist__for_each(evsel_list, counter) {
                        ps = counter->priv;
                        memset(ps->res_stats, 0, sizeof(ps->res_stats));
                        read_counter_aggr(counter);
                }
        } else  {
-                list_for_each_entry(counter, &evsel_list->entries, node) {
+                evlist__for_each(evsel_list, counter) {
                        ps = counter->priv;
                        memset(ps->res_stats, 0, sizeof(ps->res_stats));
                        read_counter(counter);
@@ -461,17 +460,17 @@ static void print_interval(void)
        if (num_print_interval == 0 && !csv_output) {
                switch (aggr_mode) {
                case AGGR_SOCKET:
-                        fprintf(output, "#           time socket cpus             counts events\n");
+                        fprintf(output, "#           time socket cpus             counts %*s events\n", unit_width, "unit");
                        break;
                case AGGR_CORE:
-                        fprintf(output, "#           time core         cpus             counts events\n");
+                        fprintf(output, "#           time core         cpus             counts %*s events\n", unit_width, "unit");
                        break;
                case AGGR_NONE:
-                        fprintf(output, "#           time CPU                 counts events\n");
+                        fprintf(output, "#           time CPU                counts %*s events\n", unit_width, "unit");
                        break;
                case AGGR_GLOBAL:
                default:
-                        fprintf(output, "#           time             counts events\n");
+                        fprintf(output, "#           time             counts %*s events\n", unit_width, "unit");
                }
        }
@@ -484,12 +483,12 @@ static void print_interval(void)
                print_aggr(prefix);
                break;
        case AGGR_NONE:
-                list_for_each_entry(counter, &evsel_list->entries, node)
+                evlist__for_each(evsel_list, counter)
                        print_counter(counter, prefix);
                break;
        case AGGR_GLOBAL:
        default:
-                list_for_each_entry(counter, &evsel_list->entries, node)
+                evlist__for_each(evsel_list, counter)
                        print_counter_aggr(counter, prefix);
        }
@@ -505,17 +504,31 @@ static void handle_initial_delay(void)
                        nthreads = thread_map__nr(evsel_list->threads);
                usleep(initial_delay * 1000);
-                list_for_each_entry(counter, &evsel_list->entries, node)
+                evlist__for_each(evsel_list, counter)
                        perf_evsel__enable(counter, ncpus, nthreads);
        }
 }
+static volatile int workload_exec_errno;
+/*
+ * perf_evlist__prepare_workload will send a SIGUSR1
+ * if the fork fails, since we asked by setting its
+ * want_signal to true.
+ */
+static void workload_exec_failed_signal(int signo __maybe_unused, siginfo_t *info,
+                                        void *ucontext __maybe_unused)
+{
+        workload_exec_errno = info->si_value.sival_int;
+}
 static int __run_perf_stat(int argc, const char **argv)
 {
        char msg[512];
        unsigned long long t0, t1;
        struct perf_evsel *counter;
        struct timespec ts;
+        size_t l;
        int status = 0;
        const bool forks = (argc > 0);
@@ -528,8 +541,8 @@ static int __run_perf_stat(int argc, const char **argv)
        }
        if (forks) {
-                if (perf_evlist__prepare_workload(evsel_list, &target, argv,
+                if (perf_evlist__prepare_workload(evsel_list, &target, argv, false,
-                                                  false, false) < 0) {
+                                                  workload_exec_failed_signal) < 0) {
                        perror("failed to prepare workload");
                        return -1;
                }
@@ -539,7 +552,7 @@ static int __run_perf_stat(int argc, const char **argv)
        if (group)
                perf_evlist__set_leader(evsel_list);
-        list_for_each_entry(counter, &evsel_list->entries, node) {
+        evlist__for_each(evsel_list, counter) {
                if (create_perf_stat_counter(counter) < 0) {
                        /*
                         * PPC returns ENXIO for HW counters until 2.6.37
@@ -565,6 +578,10 @@ static int __run_perf_stat(int argc, const char **argv)
                        return -1;
                }
                counter->supported = true;
+                l = strlen(counter->unit);
+                if (l > unit_width)
+                        unit_width = l;
        }
        if (perf_evlist__apply_filters(evsel_list)) {
@@ -590,6 +607,13 @@ static int __run_perf_stat(int argc, const char **argv)
                        }
                }
                wait(&status);
+                if (workload_exec_errno) {
+                        const char *emsg = strerror_r(workload_exec_errno, msg, sizeof(msg));
+                        pr_err("Workload failed: %s\n", emsg);
+                        return -1;
+                }
                if (WIFSIGNALED(status))
                        psignal(WTERMSIG(status), argv[0]);
        } else {
@@ -606,13 +630,13 @@ static int __run_perf_stat(int argc, const char **argv)
        update_stats(&walltime_nsecs_stats, t1 - t0);
        if (aggr_mode == AGGR_GLOBAL) {
-                list_for_each_entry(counter, &evsel_list->entries, node) {
+                evlist__for_each(evsel_list, counter) {
                        read_counter_aggr(counter);
                        perf_evsel__close_fd(counter, perf_evsel__nr_cpus(counter),
                                             thread_map__nr(evsel_list->threads));
                }
        } else {
-                list_for_each_entry(counter, &evsel_list->entries, node) {
+                evlist__for_each(evsel_list, counter) {
                        read_counter(counter);
                        perf_evsel__close_fd(counter, perf_evsel__nr_cpus(counter), 1);
                }
@@ -621,7 +645,7 @@ static int __run_perf_stat(int argc, const char **argv)
        return WEXITSTATUS(status);
 }
-static int run_perf_stat(int argc __maybe_unused, const char **argv)
+static int run_perf_stat(int argc, const char **argv)
 {
        int ret;
@@ -704,14 +728,25 @@ static void aggr_printout(struct perf_evsel *evsel, int id, int nr)
 static void nsec_printout(int cpu, int nr, struct perf_evsel *evsel, double avg)
 {
        double msecs = avg / 1e6;
-        const char *fmt = csv_output ? "%.6f%s%s" : "%18.6f%s%-25s";
+        const char *fmt_v, *fmt_n;
        char name[25];
+        fmt_v = csv_output ? "%.6f%s" : "%18.6f%s";
+        fmt_n = csv_output ? "%s" : "%-25s";
        aggr_printout(evsel, cpu, nr);
        scnprintf(name, sizeof(name), "%s%s",
                  perf_evsel__name(evsel), csv_output ? "" : " (msec)");
-        fprintf(output, fmt, msecs, csv_sep, name);
+        fprintf(output, fmt_v, msecs, csv_sep);
+        if (csv_output)
+                fprintf(output, "%s%s", evsel->unit, csv_sep);
+        else
+                fprintf(output, "%-*s%s", unit_width, evsel->unit, csv_sep);
+        fprintf(output, fmt_n, name);
        if (evsel->cgrp)
                fprintf(output, "%s%s", csv_sep, evsel->cgrp->name);
@@ -908,21 +943,31 @@ static void print_ll_cache_misses(int cpu,
 static void abs_printout(int cpu, int nr, struct perf_evsel *evsel, double avg)
 {
        double total, ratio = 0.0, total2;
+        double sc =  evsel->scale;
        const char *fmt;
-        if (csv_output)
+        if (csv_output) {
-                fmt = "%.0f%s%s";
+                fmt = sc != 1.0 ?  "%.2f%s" : "%.0f%s";
-        else if (big_num)
+        } else {
-                fmt = "%'18.0f%s%-25s";
+                if (big_num)
-        else
+                        fmt = sc != 1.0 ? "%'18.2f%s" : "%'18.0f%s";
-                fmt = "%18.0f%s%-25s";
+                else
+                        fmt = sc != 1.0 ? "%18.2f%s" : "%18.0f%s";
+        }
        aggr_printout(evsel, cpu, nr);
        if (aggr_mode == AGGR_GLOBAL)
                cpu = 0;
-        fprintf(output, fmt, avg, csv_sep, perf_evsel__name(evsel));
+        fprintf(output, fmt, avg, csv_sep);
+        if (evsel->unit)
+                fprintf(output, "%-*s%s",
+                        csv_output ? 0 : unit_width,
+                        evsel->unit, csv_sep);
+        fprintf(output, "%-*s", csv_output ? 0 : 25, perf_evsel__name(evsel));
        if (evsel->cgrp)
                fprintf(output, "%s%s", csv_sep, evsel->cgrp->name);
@@ -941,7 +986,10 @@ static void abs_printout(int cpu, int nr, struct perf_evsel *evsel, double avg)
                if (total && avg) {
                        ratio = total / avg;
-                        fprintf(output, "\n                                             #   %5.2f  stalled cycles per insn", ratio);
+                        fprintf(output, "\n");
+                        if (aggr_mode == AGGR_NONE)
+                                fprintf(output, "        ");
+                        fprintf(output, "                                                  #   %5.2f  stalled cycles per insn", ratio);
                }
        } else if (perf_evsel__match(evsel, HARDWARE, HW_BRANCH_MISSES) &&
@@ -1061,6 +1109,7 @@ static void print_aggr(char *prefix)
 {
        struct perf_evsel *counter;
        int cpu, cpu2, s, s2, id, nr;
+        double uval;
        u64 ena, run, val;
        if (!(aggr_map || aggr_get_id))
@@ -1068,7 +1117,7 @@ static void print_aggr(char *prefix)
        for (s = 0; s < aggr_map->nr; s++) {
                id = aggr_map->map[s];
-                list_for_each_entry(counter, &evsel_list->entries, node) {
+                evlist__for_each(evsel_list, counter) {
                        val = ena = run = 0;
                        nr = 0;
                        for (cpu = 0; cpu < perf_evsel__nr_cpus(counter); cpu++) {
@@ -1087,11 +1136,17 @@ static void print_aggr(char *prefix)
                        if (run == 0 || ena == 0) {
                                aggr_printout(counter, id, nr);
-                                fprintf(output, "%*s%s%*s",
+                                fprintf(output, "%*s%s",
                                        csv_output ? 0 : 18,
                                        counter->supported ? CNTR_NOT_COUNTED : CNTR_NOT_SUPPORTED,
-                                        csv_sep,
+                                        csv_sep);
-                                        csv_output ? 0 : -24,
+                                fprintf(output, "%-*s%s",
+                                        csv_output ? 0 : unit_width,
+                                        counter->unit, csv_sep);
+                                fprintf(output, "%*s",
+                                        csv_output ? 0 : -25,
                                        perf_evsel__name(counter));
                                if (counter->cgrp)
@@ -1101,11 +1156,12 @@ static void print_aggr(char *prefix)
                                fputc('\n', output);
                                continue;
                        }
+                        uval = val * counter->scale;
                        if (nsec_counter(counter))
-                                nsec_printout(id, nr, counter, val);
+                                nsec_printout(id, nr, counter, uval);
                        else
-                                abs_printout(id, nr, counter, val);
+                                abs_printout(id, nr, counter, uval);
                        if (!csv_output) {
                                print_noise(counter, 1.0);
@@ -1128,16 +1184,21 @@ static void print_counter_aggr(struct perf_evsel *counter, char *prefix)
        struct perf_stat *ps = counter->priv;
        double avg = avg_stats(&ps->res_stats[0]);
        int scaled = counter->counts->scaled;
+        double uval;
        if (prefix)
                fprintf(output, "%s", prefix);
        if (scaled == -1) {
-                fprintf(output, "%*s%s%*s",
+                fprintf(output, "%*s%s",
                        csv_output ? 0 : 18,
                        counter->supported ? CNTR_NOT_COUNTED : CNTR_NOT_SUPPORTED,
-                        csv_sep,
+                        csv_sep);
-                        csv_output ? 0 : -24,
+                fprintf(output, "%-*s%s",
+                        csv_output ? 0 : unit_width,
+                        counter->unit, csv_sep);
+                fprintf(output, "%*s",
+                        csv_output ? 0 : -25,
                        perf_evsel__name(counter));
                if (counter->cgrp)
@@ -1147,10 +1208,12 @@ static void print_counter_aggr(struct perf_evsel *counter, char *prefix)
                return;
        }
+        uval = avg * counter->scale;
        if (nsec_counter(counter))
-                nsec_printout(-1, 0, counter, avg);
+                nsec_printout(-1, 0, counter, uval);
        else
-                abs_printout(-1, 0, counter, avg);
+                abs_printout(-1, 0, counter, uval);
        print_noise(counter, avg);
@@ -1177,6 +1240,7 @@ static void print_counter_aggr(struct perf_evsel *counter, char *prefix)
 static void print_counter(struct perf_evsel *counter, char *prefix)
 {
        u64 ena, run, val;
+        double uval;
        int cpu;
        for (cpu = 0; cpu < perf_evsel__nr_cpus(counter); cpu++) {
@@ -1188,14 +1252,20 @@ static void print_counter(struct perf_evsel *counter, char *prefix)
                        fprintf(output, "%s", prefix);
                if (run == 0 || ena == 0) {
-                        fprintf(output, "CPU%*d%s%*s%s%*s",
+                        fprintf(output, "CPU%*d%s%*s%s",
                                csv_output ? 0 : -4,
                                perf_evsel__cpus(counter)->map[cpu], csv_sep,
                                csv_output ? 0 : 18,
                                counter->supported ? CNTR_NOT_COUNTED : CNTR_NOT_SUPPORTED,
-                                csv_sep,
+                                csv_sep);
-                                csv_output ? 0 : -24,
-                                perf_evsel__name(counter));
+                                fprintf(output, "%-*s%s",
+                                        csv_output ? 0 : unit_width,
+                                        counter->unit, csv_sep);
+                                fprintf(output, "%*s",
+                                        csv_output ? 0 : -25,
+                                        perf_evsel__name(counter));
                        if (counter->cgrp)
                                fprintf(output, "%s%s",
@@ -1205,10 +1275,12 @@ static void print_counter(struct perf_evsel *counter, char *prefix)
                        continue;
                }
+                uval = val * counter->scale;
                if (nsec_counter(counter))
-                        nsec_printout(cpu, 0, counter, val);
+                        nsec_printout(cpu, 0, counter, uval);
                else
-                        abs_printout(cpu, 0, counter, val);
+                        abs_printout(cpu, 0, counter, uval);
                if (!csv_output) {
                        print_noise(counter, 1.0);
@@ -1256,11 +1328,11 @@ static void print_stat(int argc, const char **argv)
                print_aggr(NULL);
                break;
        case AGGR_GLOBAL:
-                list_for_each_entry(counter, &evsel_list->entries, node)
+                evlist__for_each(evsel_list, counter)
                        print_counter_aggr(counter, NULL);
                break;
        case AGGR_NONE:
-                list_for_each_entry(counter, &evsel_list->entries, node)
+                evlist__for_each(evsel_list, counter)
                        print_counter(counter, NULL);
                break;
        default:
@@ -1710,14 +1782,14 @@ int cmd_stat(int argc, const char **argv, const char *prefix __maybe_unused)
        if (interval && interval < 100) {
                pr_err("print interval must be >= 100ms\n");
                parse_options_usage(stat_usage, options, "I", 1);
-                goto out_free_maps;
+                goto out;
        }
        if (perf_evlist__alloc_stats(evsel_list, interval))
-                goto out_free_maps;
+                goto out;
        if (perf_stat_init_aggr_mode())
-                goto out_free_maps;
+                goto out;
        /*
         * We dont want to block the signals - that would cause
@@ -1749,8 +1821,6 @@ int cmd_stat(int argc, const char **argv, const char *prefix __maybe_unused)
                print_stat(argc, argv);
        perf_evlist__free_stats(evsel_list);
-out_free_maps:
-        perf_evlist__delete_maps(evsel_list);
 out:
        perf_evlist__delete(evsel_list);
        return status;
diff --git a/tools/perf/builtin-timechart.c b/tools/perf/builtin-timechart.c
index 41c9bde2fb67..652af0b66a62 100644
--- a/tools/perf/builtin-timechart.c
+++ b/tools/perf/builtin-timechart.c
@@ -41,25 +41,29 @@
 #define SUPPORT_OLD_POWER_EVENTS 1
 #define PWR_EVENT_EXIT -1
-static unsigned int     numcpus;
-static u64              min_freq;       /* Lowest CPU frequency seen */
-static u64              max_freq;       /* Highest CPU frequency seen */
-static u64              turbo_frequency;
-static u64              first_time, last_time;
-static bool             power_only;
 struct per_pid;
-struct per_pidcomm;
-struct cpu_sample;
 struct power_event;
 struct wake_event;
-struct sample_wrapper;
+struct timechart {
+        struct perf_tool        tool;
+        struct per_pid          *all_data;
+        struct power_event      *power_events;
+        struct wake_event       *wake_events;
+        int                     proc_num;
+        unsigned int            numcpus;
+        u64                     min_freq,       /* Lowest CPU frequency seen */
+                                max_freq,       /* Highest CPU frequency seen */
+                                turbo_frequency,
+                                first_time, last_time;
+        bool                    power_only,
+                                tasks_only,
+                                with_backtrace,
+                                topology;
+};
+struct per_pidcomm;
+struct cpu_sample;
 /*
 * Datastructure layout:
@@ -124,10 +128,9 @@ struct cpu_sample {
        u64 end_time;
        int type;
        int cpu;
+        const char *backtrace;
 };
-static struct per_pid *all_data;
 #define CSTATE 1
 #define PSTATE 2
@@ -145,12 +148,9 @@ struct wake_event {
        int waker;
        int wakee;
        u64 time;
+        const char *backtrace;
 };
-static struct power_event    *power_events;
-static struct wake_event     *wake_events;
-struct process_filter;
 struct process_filter {
        char                    *name;
        int                     pid;
@@ -160,9 +160,9 @@ struct process_filter {
 static struct process_filter *process_filter;
-static struct per_pid *find_create_pid(int pid)
+static struct per_pid *find_create_pid(struct timechart *tchart, int pid)
 {
-        struct per_pid *cursor = all_data;
+        struct per_pid *cursor = tchart->all_data;
        while (cursor) {
                if (cursor->pid == pid)
@@ -172,16 +172,16 @@ static struct per_pid *find_create_pid(int pid)
        cursor = zalloc(sizeof(*cursor));
        assert(cursor != NULL);
        cursor->pid = pid;
-        cursor->next = all_data;
+        cursor->next = tchart->all_data;
-        all_data = cursor;
+        tchart->all_data = cursor;
        return cursor;
 }
-static void pid_set_comm(int pid, char *comm)
+static void pid_set_comm(struct timechart *tchart, int pid, char *comm)
 {
        struct per_pid *p;
        struct per_pidcomm *c;
-        p = find_create_pid(pid);
+        p = find_create_pid(tchart, pid);
        c = p->all;
        while (c) {
                if (c->comm && strcmp(c->comm, comm) == 0) {
@@ -203,14 +203,14 @@ static void pid_set_comm(int pid, char *comm)
        p->all = c;
 }
-static void pid_fork(int pid, int ppid, u64 timestamp)
+static void pid_fork(struct timechart *tchart, int pid, int ppid, u64 timestamp)
 {
        struct per_pid *p, *pp;
-        p = find_create_pid(pid);
+        p = find_create_pid(tchart, pid);
-        pp = find_create_pid(ppid);
+        pp = find_create_pid(tchart, ppid);
        p->ppid = ppid;
        if (pp->current && pp->current->comm && !p->current)
-                pid_set_comm(pid, pp->current->comm);
+                pid_set_comm(tchart, pid, pp->current->comm);
        p->start_time = timestamp;
        if (p->current) {
@@ -219,23 +219,24 @@ static void pid_fork(int pid, int ppid, u64 timestamp)
        }
 }
-static void pid_exit(int pid, u64 timestamp)
+static void pid_exit(struct timechart *tchart, int pid, u64 timestamp)
 {
        struct per_pid *p;
-        p = find_create_pid(pid);
+        p = find_create_pid(tchart, pid);
        p->end_time = timestamp;
        if (p->current)
                p->current->end_time = timestamp;
 }
-static void
+static void pid_put_sample(struct timechart *tchart, int pid, int type,
-pid_put_sample(int pid, int type, unsigned int cpu, u64 start, u64 end)
+                           unsigned int cpu, u64 start, u64 end,
+                           const char *backtrace)
 {
        struct per_pid *p;
        struct per_pidcomm *c;
        struct cpu_sample *sample;
-        p = find_create_pid(pid);
+        p = find_create_pid(tchart, pid);
        c = p->current;
        if (!c) {
                c = zalloc(sizeof(*c));
@@ -252,6 +253,7 @@ pid_put_sample(int pid, int type, unsigned int cpu, u64 start, u64 end)
        sample->type = type;
        sample->next = c->samples;
        sample->cpu = cpu;
+        sample->backtrace = backtrace;
        c->samples = sample;
        if (sample->type == TYPE_RUNNING && end > start && start > 0) {
@@ -272,84 +274,47 @@ static int cpus_cstate_state[MAX_CPUS];
 static u64 cpus_pstate_start_times[MAX_CPUS];
 static u64 cpus_pstate_state[MAX_CPUS];
-static int process_comm_event(struct perf_tool *tool __maybe_unused,
+static int process_comm_event(struct perf_tool *tool,
                              union perf_event *event,
                              struct perf_sample *sample __maybe_unused,
                              struct machine *machine __maybe_unused)
 {
-        pid_set_comm(event->comm.tid, event->comm.comm);
+        struct timechart *tchart = container_of(tool, struct timechart, tool);
+        pid_set_comm(tchart, event->comm.tid, event->comm.comm);
        return 0;
 }
-static int process_fork_event(struct perf_tool *tool __maybe_unused,
+static int process_fork_event(struct perf_tool *tool,
                              union perf_event *event,
                              struct perf_sample *sample __maybe_unused,
                              struct machine *machine __maybe_unused)
 {
-        pid_fork(event->fork.pid, event->fork.ppid, event->fork.time);
+        struct timechart *tchart = container_of(tool, struct timechart, tool);
+        pid_fork(tchart, event->fork.pid, event->fork.ppid, event->fork.time);
        return 0;
 }
-static int process_exit_event(struct perf_tool *tool __maybe_unused,
+static int process_exit_event(struct perf_tool *tool,
                              union perf_event *event,
                              struct perf_sample *sample __maybe_unused,
                              struct machine *machine __maybe_unused)
 {
-        pid_exit(event->fork.pid, event->fork.time);
+        struct timechart *tchart = container_of(tool, struct timechart, tool);
+        pid_exit(tchart, event->fork.pid, event->fork.time);
        return 0;
 }
-struct trace_entry {
-        unsigned short          type;
-        unsigned char           flags;
-        unsigned char           preempt_count;
-        int                     pid;
-        int                     lock_depth;
-};
 #ifdef SUPPORT_OLD_POWER_EVENTS
 static int use_old_power_events;
-struct power_entry_old {
-        struct trace_entry te;
-        u64     type;
-        u64     value;
-        u64     cpu_id;
-};
 #endif
-struct power_processor_entry {
-        struct trace_entry te;
-        u32     state;
-        u32     cpu_id;
-};
-#define TASK_COMM_LEN 16
-struct wakeup_entry {
-        struct trace_entry te;
-        char comm[TASK_COMM_LEN];
-        int   pid;
-        int   prio;
-        int   success;
-};
-struct sched_switch {
-        struct trace_entry te;
-        char prev_comm[TASK_COMM_LEN];
-        int  prev_pid;
-        int  prev_prio;
-        long prev_state; /* Arjan weeps. */
-        char next_comm[TASK_COMM_LEN];
-        int  next_pid;
-        int  next_prio;
-};
 static void c_state_start(int cpu, u64 timestamp, int state)
 {
        cpus_cstate_start_times[cpu] = timestamp;
        cpus_cstate_state[cpu] = state;
 }
-static void c_state_end(int cpu, u64 timestamp)
+static void c_state_end(struct timechart *tchart, int cpu, u64 timestamp)
 {
        struct power_event *pwr = zalloc(sizeof(*pwr));
@@ -361,12 +326,12 @@ static void c_state_end(int cpu, u64 timestamp)
        pwr->end_time = timestamp;
        pwr->cpu = cpu;
        pwr->type = CSTATE;
-        pwr->next = power_events;
+        pwr->next = tchart->power_events;
-        power_events = pwr;
+        tchart->power_events = pwr;
 }
-static void p_state_change(int cpu, u64 timestamp, u64 new_freq)
+static void p_state_change(struct timechart *tchart, int cpu, u64 timestamp, u64 new_freq)
 {
        struct power_event *pwr;
@@ -382,73 +347,78 @@ static void p_state_change(int cpu, u64 timestamp, u64 new_freq)
        pwr->end_time = timestamp;
        pwr->cpu = cpu;
        pwr->type = PSTATE;
-        pwr->next = power_events;
+        pwr->next = tchart->power_events;
        if (!pwr->start_time)
-                pwr->start_time = first_time;
+                pwr->start_time = tchart->first_time;
-        power_events = pwr;
+        tchart->power_events = pwr;
        cpus_pstate_state[cpu] = new_freq;
        cpus_pstate_start_times[cpu] = timestamp;
-        if ((u64)new_freq > max_freq)
+        if ((u64)new_freq > tchart->max_freq)
-                max_freq = new_freq;
+                tchart->max_freq = new_freq;
-        if (new_freq < min_freq || min_freq == 0)
+        if (new_freq < tchart->min_freq || tchart->min_freq == 0)
-                min_freq = new_freq;
+                tchart->min_freq = new_freq;
-        if (new_freq == max_freq - 1000)
+        if (new_freq == tchart->max_freq - 1000)
-                        turbo_frequency = max_freq;
+                tchart->turbo_frequency = tchart->max_freq;
 }
-static void
+static void sched_wakeup(struct timechart *tchart, int cpu, u64 timestamp,
-sched_wakeup(int cpu, u64 timestamp, int pid, struct trace_entry *te)
+                         int waker, int wakee, u8 flags, const char *backtrace)
 {
        struct per_pid *p;
-        struct wakeup_entry *wake = (void *)te;
        struct wake_event *we = zalloc(sizeof(*we));
        if (!we)
                return;
        we->time = timestamp;
-        we->waker = pid;
+        we->waker = waker;
+        we->backtrace = backtrace;
-        if ((te->flags & TRACE_FLAG_HARDIRQ) || (te->flags & TRACE_FLAG_SOFTIRQ))
+        if ((flags & TRACE_FLAG_HARDIRQ) || (flags & TRACE_FLAG_SOFTIRQ))
                we->waker = -1;
-        we->wakee = wake->pid;
+        we->wakee = wakee;
-        we->next = wake_events;
+        we->next = tchart->wake_events;
-        wake_events = we;
+        tchart->wake_events = we;
-        p = find_create_pid(we->wakee);
+        p = find_create_pid(tchart, we->wakee);
        if (p && p->current && p->current->state == TYPE_NONE) {
                p->current->state_since = timestamp;
                p->current->state = TYPE_WAITING;
        }
        if (p && p->current && p->current->state == TYPE_BLOCKED) {
-                pid_put_sample(p->pid, p->current->state, cpu, p->current->state_since, timestamp);
+                pid_put_sample(tchart, p->pid, p->current->state, cpu,
+                               p->current->state_since, timestamp, NULL);
                p->current->state_since = timestamp;
                p->current->state = TYPE_WAITING;
        }
 }
-static void sched_switch(int cpu, u64 timestamp, struct trace_entry *te)
+static void sched_switch(struct timechart *tchart, int cpu, u64 timestamp,
+                         int prev_pid, int next_pid, u64 prev_state,
+                         const char *backtrace)
 {
        struct per_pid *p = NULL, *prev_p;
-        struct sched_switch *sw = (void *)te;
-        prev_p = find_create_pid(sw->prev_pid);
+        prev_p = find_create_pid(tchart, prev_pid);
-        p = find_create_pid(sw->next_pid);
+        p = find_create_pid(tchart, next_pid);
        if (prev_p->current && prev_p->current->state != TYPE_NONE)
-                pid_put_sample(sw->prev_pid, TYPE_RUNNING, cpu, prev_p->current->state_since, timestamp);
+                pid_put_sample(tchart, prev_pid, TYPE_RUNNING, cpu,
+                               prev_p->current->state_since, timestamp,
+                               backtrace);
        if (p && p->current) {
                if (p->current->state != TYPE_NONE)
-                        pid_put_sample(sw->next_pid, p->current->state, cpu, p->current->state_since, timestamp);
+                        pid_put_sample(tchart, next_pid, p->current->state, cpu,
+                                       p->current->state_since, timestamp,
+                                       backtrace);
                p->current->state_since = timestamp;
                p->current->state = TYPE_RUNNING;
@@ -457,109 +427,211 @@ static void sched_switch(int cpu, u64 timestamp, struct trace_entry *te)
        if (prev_p->current) {
                prev_p->current->state = TYPE_NONE;
                prev_p->current->state_since = timestamp;
-                if (sw->prev_state & 2)
+                if (prev_state & 2)
                        prev_p->current->state = TYPE_BLOCKED;
-                if (sw->prev_state == 0)
+                if (prev_state == 0)
                        prev_p->current->state = TYPE_WAITING;
        }
 }
-typedef int (*tracepoint_handler)(struct perf_evsel *evsel,
+static const char *cat_backtrace(union perf_event *event,
-                                  struct perf_sample *sample);
+                                 struct perf_sample *sample,
+                                 struct machine *machine)
+{
+        struct addr_location al;
+        unsigned int i;
+        char *p = NULL;
+        size_t p_len;
+        u8 cpumode = PERF_RECORD_MISC_USER;
+        struct addr_location tal;
+        struct ip_callchain *chain = sample->callchain;
+        FILE *f = open_memstream(&p, &p_len);
+        if (!f) {
+                perror("open_memstream error");
+                return NULL;
+        }
+        if (!chain)
+                goto exit;
-static int process_sample_event(struct perf_tool *tool __maybe_unused,
+        if (perf_event__preprocess_sample(event, machine, &al, sample) < 0) {
-                                union perf_event *event __maybe_unused,
+                fprintf(stderr, "problem processing %d event, skipping it.\n",
+                        event->header.type);
+                goto exit;
+        }
+        for (i = 0; i < chain->nr; i++) {
+                u64 ip;
+                if (callchain_param.order == ORDER_CALLEE)
+                        ip = chain->ips[i];
+                else
+                        ip = chain->ips[chain->nr - i - 1];
+                if (ip >= PERF_CONTEXT_MAX) {
+                        switch (ip) {
+                        case PERF_CONTEXT_HV:
+                                cpumode = PERF_RECORD_MISC_HYPERVISOR;
+                                break;
+                        case PERF_CONTEXT_KERNEL:
+                                cpumode = PERF_RECORD_MISC_KERNEL;
+                                break;
+                        case PERF_CONTEXT_USER:
+                                cpumode = PERF_RECORD_MISC_USER;
+                                break;
+                        default:
+                                pr_debug("invalid callchain context: "
+                                         "%"PRId64"\n", (s64) ip);
+                                /*
+                                 * It seems the callchain is corrupted.
+                                 * Discard all.
+                                 */
+                                zfree(&p);
+                                goto exit;
+                        }
+                        continue;
+                }
+                tal.filtered = false;
+                thread__find_addr_location(al.thread, machine, cpumode,
+                                           MAP__FUNCTION, ip, &tal);
+                if (tal.sym)
+                        fprintf(f, "..... %016" PRIx64 " %s\n", ip,
+                                tal.sym->name);
+                else
+                        fprintf(f, "..... %016" PRIx64 "\n", ip);
+        }
+exit:
+        fclose(f);
+        return p;
+}
+typedef int (*tracepoint_handler)(struct timechart *tchart,
+                                  struct perf_evsel *evsel,
+                                  struct perf_sample *sample,
+                                  const char *backtrace);
+static int process_sample_event(struct perf_tool *tool,
+                                union perf_event *event,
                                struct perf_sample *sample,
                                struct perf_evsel *evsel,
-                                struct machine *machine __maybe_unused)
+                                struct machine *machine)
 {
+        struct timechart *tchart = container_of(tool, struct timechart, tool);
        if (evsel->attr.sample_type & PERF_SAMPLE_TIME) {
-                if (!first_time || first_time > sample->time)
+                if (!tchart->first_time || tchart->first_time > sample->time)
-                        first_time = sample->time;
+                        tchart->first_time = sample->time;
-                if (last_time < sample->time)
+                if (tchart->last_time < sample->time)
-                        last_time = sample->time;
+                        tchart->last_time = sample->time;
        }
-        if (sample->cpu > numcpus)
-                numcpus = sample->cpu;
        if (evsel->handler != NULL) {
                tracepoint_handler f = evsel->handler;
-                return f(evsel, sample);
+                return f(tchart, evsel, sample,
+                         cat_backtrace(event, sample, machine));
        }
        return 0;
 }
 static int
-process_sample_cpu_idle(struct perf_evsel *evsel __maybe_unused,
+process_sample_cpu_idle(struct timechart *tchart __maybe_unused,
-                        struct perf_sample *sample)
+                        struct perf_evsel *evsel,
+                        struct perf_sample *sample,
+                        const char *backtrace __maybe_unused)
 {
-        struct power_processor_entry *ppe = sample->raw_data;
+        u32 state = perf_evsel__intval(evsel, sample, "state");
+        u32 cpu_id = perf_evsel__intval(evsel, sample, "cpu_id");
-        if (ppe->state == (u32) PWR_EVENT_EXIT)
+        if (state == (u32)PWR_EVENT_EXIT)
-                c_state_end(ppe->cpu_id, sample->time);
+                c_state_end(tchart, cpu_id, sample->time);
        else
-                c_state_start(ppe->cpu_id, sample->time, ppe->state);
+                c_state_start(cpu_id, sample->time, state);
        return 0;
 }
 static int
-process_sample_cpu_frequency(struct perf_evsel *evsel __maybe_unused,
+process_sample_cpu_frequency(struct timechart *tchart,
-                             struct perf_sample *sample)
+                             struct perf_evsel *evsel,
+                             struct perf_sample *sample,
+                             const char *backtrace __maybe_unused)
 {
-        struct power_processor_entry *ppe = sample->raw_data;
+        u32 state = perf_evsel__intval(evsel, sample, "state");
+        u32 cpu_id = perf_evsel__intval(evsel, sample, "cpu_id");
-        p_state_change(ppe->cpu_id, sample->time, ppe->state);
+        p_state_change(tchart, cpu_id, sample->time, state);
        return 0;
 }
 static int
-process_sample_sched_wakeup(struct perf_evsel *evsel __maybe_unused,
+process_sample_sched_wakeup(struct timechart *tchart,
-                            struct perf_sample *sample)
+                            struct perf_evsel *evsel,
+                            struct perf_sample *sample,
+                            const char *backtrace)
 {
-        struct trace_entry *te = sample->raw_data;
+        u8 flags = perf_evsel__intval(evsel, sample, "common_flags");
+        int waker = perf_evsel__intval(evsel, sample, "common_pid");
+        int wakee = perf_evsel__intval(evsel, sample, "pid");
-        sched_wakeup(sample->cpu, sample->time, sample->pid, te);
+        sched_wakeup(tchart, sample->cpu, sample->time, waker, wakee, flags, backtrace);
        return 0;
 }
 static int
-process_sample_sched_switch(struct perf_evsel *evsel __maybe_unused,
+process_sample_sched_switch(struct timechart *tchart,
-                            struct perf_sample *sample)
+                            struct perf_evsel *evsel,
+                            struct perf_sample *sample,
+                            const char *backtrace)
 {
-        struct trace_entry *te = sample->raw_data;
+        int prev_pid = perf_evsel__intval(evsel, sample, "prev_pid");
+        int next_pid = perf_evsel__intval(evsel, sample, "next_pid");
+        u64 prev_state = perf_evsel__intval(evsel, sample, "prev_state");
-        sched_switch(sample->cpu, sample->time, te);
+        sched_switch(tchart, sample->cpu, sample->time, prev_pid, next_pid,
+                     prev_state, backtrace);
        return 0;
 }
 #ifdef SUPPORT_OLD_POWER_EVENTS
 static int
-process_sample_power_start(struct perf_evsel *evsel __maybe_unused,
+process_sample_power_start(struct timechart *tchart __maybe_unused,
-                           struct perf_sample *sample)
+                           struct perf_evsel *evsel,
+                           struct perf_sample *sample,
+                           const char *backtrace __maybe_unused)
 {
-        struct power_entry_old *peo = sample->raw_data;
+        u64 cpu_id = perf_evsel__intval(evsel, sample, "cpu_id");
+        u64 value = perf_evsel__intval(evsel, sample, "value");
-        c_state_start(peo->cpu_id, sample->time, peo->value);
+        c_state_start(cpu_id, sample->time, value);
        return 0;
 }
 static int
-process_sample_power_end(struct perf_evsel *evsel __maybe_unused,
+process_sample_power_end(struct timechart *tchart,
-                         struct perf_sample *sample)
+                         struct perf_evsel *evsel __maybe_unused,
+                         struct perf_sample *sample,
+                         const char *backtrace __maybe_unused)
 {
-        c_state_end(sample->cpu, sample->time);
+        c_state_end(tchart, sample->cpu, sample->time);
        return 0;
 }
 static int
-process_sample_power_frequency(struct perf_evsel *evsel __maybe_unused,
+process_sample_power_frequency(struct timechart *tchart,
-                               struct perf_sample *sample)
+                               struct perf_evsel *evsel,
+                               struct perf_sample *sample,
+                               const char *backtrace __maybe_unused)
 {
-        struct power_entry_old *peo = sample->raw_data;
+        u64 cpu_id = perf_evsel__intval(evsel, sample, "cpu_id");
+        u64 value = perf_evsel__intval(evsel, sample, "value");
-        p_state_change(peo->cpu_id, sample->time, peo->value);
+        p_state_change(tchart, cpu_id, sample->time, value);
        return 0;
 }
 #endif /* SUPPORT_OLD_POWER_EVENTS */
@@ -568,12 +640,12 @@ process_sample_power_frequency(struct perf_evsel *evsel __maybe_unused,
 * After the last sample we need to wrap up the current C/P state
 * and close out each CPU for these.
 */
-static void end_sample_processing(void)
+static void end_sample_processing(struct timechart *tchart)
 {
        u64 cpu;
        struct power_event *pwr;
-        for (cpu = 0; cpu <= numcpus; cpu++) {
+        for (cpu = 0; cpu <= tchart->numcpus; cpu++) {
                /* C state */
 #if 0
                pwr = zalloc(sizeof(*pwr));
@@ -582,12 +654,12 @@ static void end_sample_processing(void)
                pwr->state = cpus_cstate_state[cpu];
                pwr->start_time = cpus_cstate_start_times[cpu];
-                pwr->end_time = last_time;
+                pwr->end_time = tchart->last_time;
                pwr->cpu = cpu;
                pwr->type = CSTATE;
-                pwr->next = power_events;
+                pwr->next = tchart->power_events;
-                power_events = pwr;
+                tchart->power_events = pwr;
 #endif
                /* P state */
@@ -597,32 +669,32 @@ static void end_sample_processing(void)
                pwr->state = cpus_pstate_state[cpu];
                pwr->start_time = cpus_pstate_start_times[cpu];
-                pwr->end_time = last_time;
+                pwr->end_time = tchart->last_time;
                pwr->cpu = cpu;
                pwr->type = PSTATE;
-                pwr->next = power_events;
+                pwr->next = tchart->power_events;
                if (!pwr->start_time)
-                        pwr->start_time = first_time;
+                        pwr->start_time = tchart->first_time;
                if (!pwr->state)
-                        pwr->state = min_freq;
+                        pwr->state = tchart->min_freq;
-                power_events = pwr;
+                tchart->power_events = pwr;
        }
 }
 /*
 * Sort the pid datastructure
 */
-static void sort_pids(void)
+static void sort_pids(struct timechart *tchart)
 {
        struct per_pid *new_list, *p, *cursor, *prev;
        /* sort by ppid first, then by pid, lowest to highest */
        new_list = NULL;
-        while (all_data) {
+        while (tchart->all_data) {
-                p = all_data;
+                p = tchart->all_data;
-                all_data = p->next;
+                tchart->all_data = p->next;
                p->next = NULL;
                if (new_list == NULL) {
@@ -655,14 +727,14 @@ static void sort_pids(void)
                                prev->next = p;
                }
        }
-        all_data = new_list;
+        tchart->all_data = new_list;
 }
-static void draw_c_p_states(void)
+static void draw_c_p_states(struct timechart *tchart)
 {
        struct power_event *pwr;
-        pwr = power_events;
+        pwr = tchart->power_events;
        /*
         * two pass drawing so that the P state bars are on top of the C state blocks
@@ -673,30 +745,30 @@ static void draw_c_p_states(void)
                pwr = pwr->next;
        }
-        pwr = power_events;
+        pwr = tchart->power_events;
        while (pwr) {
                if (pwr->type == PSTATE) {
                        if (!pwr->state)
-                                pwr->state = min_freq;
+                                pwr->state = tchart->min_freq;
                        svg_pstate(pwr->cpu, pwr->start_time, pwr->end_time, pwr->state);
                }
                pwr = pwr->next;
        }
 }
-static void draw_wakeups(void)
+static void draw_wakeups(struct timechart *tchart)
 {
        struct wake_event *we;
        struct per_pid *p;
        struct per_pidcomm *c;
-        we = wake_events;
+        we = tchart->wake_events;
        while (we) {
                int from = 0, to = 0;
                char *task_from = NULL, *task_to = NULL;
                /* locate the column of the waker and wakee */
-                p = all_data;
+                p = tchart->all_data;
                while (p) {
                        if (p->pid == we->waker || p->pid == we->wakee) {
                                c = p->all;
@@ -739,11 +811,12 @@ static void draw_wakeups(void)
                }
                if (we->waker == -1)
-                        svg_interrupt(we->time, to);
+                        svg_interrupt(we->time, to, we->backtrace);
                else if (from && to && abs(from - to) == 1)
-                        svg_wakeline(we->time, from, to);
+                        svg_wakeline(we->time, from, to, we->backtrace);
                else
-                        svg_partial_wakeline(we->time, from, task_from, to, task_to);
+                        svg_partial_wakeline(we->time, from, task_from, to,
+                                             task_to, we->backtrace);
                we = we->next;
                free(task_from);
@@ -751,19 +824,25 @@ static void draw_wakeups(void)
        }
 }
-static void draw_cpu_usage(void)
+static void draw_cpu_usage(struct timechart *tchart)
 {
        struct per_pid *p;
        struct per_pidcomm *c;
        struct cpu_sample *sample;
-        p = all_data;
+        p = tchart->all_data;
        while (p) {
                c = p->all;
                while (c) {
                        sample = c->samples;
                        while (sample) {
-                                if (sample->type == TYPE_RUNNING)
+                                if (sample->type == TYPE_RUNNING) {
-                                        svg_process(sample->cpu, sample->start_time, sample->end_time, "sample", c->comm);
+                                        svg_process(sample->cpu,
+                                                    sample->start_time,
+                                                    sample->end_time,
+                                                    p->pid,
+                                                    c->comm,
+                                                    sample->backtrace);
+                                }
                                sample = sample->next;
                        }
@@ -773,16 +852,16 @@ static void draw_cpu_usage(void)
        }
 }
-static void draw_process_bars(void)
+static void draw_process_bars(struct timechart *tchart)
 {
        struct per_pid *p;
        struct per_pidcomm *c;
        struct cpu_sample *sample;
        int Y = 0;
-        Y = 2 * numcpus + 2;
+        Y = 2 * tchart->numcpus + 2;
-        p = all_data;
+        p = tchart->all_data;
        while (p) {
                c = p->all;
                while (c) {
@@ -796,11 +875,20 @@ static void draw_process_bars(void)
                        sample = c->samples;
                        while (sample) {
                                if (sample->type == TYPE_RUNNING)
-                                        svg_sample(Y, sample->cpu, sample->start_time, sample->end_time);
+                                        svg_running(Y, sample->cpu,
+                                                    sample->start_time,
+                                                    sample->end_time,
+                                                    sample->backtrace);
                                if (sample->type == TYPE_BLOCKED)
-                                        svg_box(Y, sample->start_time, sample->end_time, "blocked");
+                                        svg_blocked(Y, sample->cpu,
+                                                    sample->start_time,
+                                                    sample->end_time,
+                                                    sample->backtrace);
                                if (sample->type == TYPE_WAITING)
-                                        svg_waiting(Y, sample->start_time, sample->end_time);
+                                        svg_waiting(Y, sample->cpu,
+                                                    sample->start_time,
+                                                    sample->end_time,
+                                                    sample->backtrace);
                                sample = sample->next;
                        }
@@ -853,21 +941,21 @@ static int passes_filter(struct per_pid *p, struct per_pidcomm *c)
        return 0;
 }
-static int determine_display_tasks_filtered(void)
+static int determine_display_tasks_filtered(struct timechart *tchart)
 {
        struct per_pid *p;
        struct per_pidcomm *c;
        int count = 0;
-        p = all_data;
+        p = tchart->all_data;
        while (p) {
                p->display = 0;
                if (p->start_time == 1)
-                        p->start_time = first_time;
+                        p->start_time = tchart->first_time;
                /* no exit marker, task kept running to the end */
                if (p->end_time == 0)
-                        p->end_time = last_time;
+                        p->end_time = tchart->last_time;
                c = p->all;
@@ -875,7 +963,7 @@ static int determine_display_tasks_filtered(void)
                        c->display = 0;
                        if (c->start_time == 1)
-                                c->start_time = first_time;
+                                c->start_time = tchart->first_time;
                        if (passes_filter(p, c)) {
                                c->display = 1;
@@ -884,7 +972,7 @@ static int determine_display_tasks_filtered(void)
                        }
                        if (c->end_time == 0)
-                                c->end_time = last_time;
+                                c->end_time = tchart->last_time;
                        c = c->next;
                }
@@ -893,25 +981,25 @@ static int determine_display_tasks_filtered(void)
        return count;
 }
-static int determine_display_tasks(u64 threshold)
+static int determine_display_tasks(struct timechart *tchart, u64 threshold)
 {
        struct per_pid *p;
        struct per_pidcomm *c;
        int count = 0;
        if (process_filter)
-                return determine_display_tasks_filtered();
+                return determine_display_tasks_filtered(tchart);
-        p = all_data;
+        p = tchart->all_data;
        while (p) {
                p->display = 0;
                if (p->start_time == 1)
-                        p->start_time = first_time;
+                        p->start_time = tchart->first_time;
                /* no exit marker, task kept running to the end */
                if (p->end_time == 0)
-                        p->end_time = last_time;
+                        p->end_time = tchart->last_time;
-                if (p->total_time >= threshold && !power_only)
+                if (p->total_time >= threshold)
                        p->display = 1;
                c = p->all;
@@ -920,15 +1008,15 @@ static int determine_display_tasks(u64 threshold)
                        c->display = 0;
                        if (c->start_time == 1)
-                                c->start_time = first_time;
+                                c->start_time = tchart->first_time;
-                        if (c->total_time >= threshold && !power_only) {
+                        if (c->total_time >= threshold) {
                                c->display = 1;
                                count++;
                        }
                        if (c->end_time == 0)
-                                c->end_time = last_time;
+                                c->end_time = tchart->last_time;
                        c = c->next;
                }
@@ -941,45 +1029,74 @@ static int determine_display_tasks(u64 threshold)
 #define TIME_THRESH 10000000
-static void write_svg_file(const char *filename)
+static void write_svg_file(struct timechart *tchart, const char *filename)
 {
        u64 i;
        int count;
+        int thresh = TIME_THRESH;
-        numcpus++;
+        if (tchart->power_only)
+                tchart->proc_num = 0;
-        count = determine_display_tasks(TIME_THRESH);
+        /* We'd like to show at least proc_num tasks;
+         * be less picky if we have fewer */
+        do {
+                count = determine_display_tasks(tchart, thresh);
+                thresh /= 10;
+        } while (!process_filter && thresh && count < tchart->proc_num);
-        /* We'd like to show at least 15 tasks; be less picky if we have fewer */
+        open_svg(filename, tchart->numcpus, count, tchart->first_time, tchart->last_time);
-        if (count < 15)
-                count = determine_display_tasks(TIME_THRESH / 10);
-        open_svg(filename, numcpus, count, first_time, last_time);
        svg_time_grid();
        svg_legenda();
-        for (i = 0; i < numcpus; i++)
+        for (i = 0; i < tchart->numcpus; i++)
-                svg_cpu_box(i, max_freq, turbo_frequency);
+                svg_cpu_box(i, tchart->max_freq, tchart->turbo_frequency);
-        draw_cpu_usage();
+        draw_cpu_usage(tchart);
-        draw_process_bars();
+        if (tchart->proc_num)
-        draw_c_p_states();
+                draw_process_bars(tchart);
-        draw_wakeups();
+        if (!tchart->tasks_only)
+                draw_c_p_states(tchart);
+        if (tchart->proc_num)
+                draw_wakeups(tchart);
        svg_close();
 }
-static int __cmd_timechart(const char *output_name)
+static int process_header(struct perf_file_section *section __maybe_unused,
+                          struct perf_header *ph,
+                          int feat,
+                          int fd __maybe_unused,
+                          void *data)
+{
+        struct timechart *tchart = data;
+        switch (feat) {
+        case HEADER_NRCPUS:
+                tchart->numcpus = ph->env.nr_cpus_avail;
+                break;
+        case HEADER_CPU_TOPOLOGY:
+                if (!tchart->topology)
+                        break;
+                if (svg_build_topology_map(ph->env.sibling_cores,
+                                           ph->env.nr_sibling_cores,
+                                           ph->env.sibling_threads,
+                                           ph->env.nr_sibling_threads))
+                        fprintf(stderr, "problem building topology\n");
+                break;
+        default:
+                break;
+        }
+        return 0;
+}
+static int __cmd_timechart(struct timechart *tchart, const char *output_name)
 {
-        struct perf_tool perf_timechart = {
-                .comm            = process_comm_event,
-                .fork            = process_fork_event,
-                .exit            = process_exit_event,
-                .sample          = process_sample_event,
-                .ordered_samples = true,
-        };
        const struct perf_evsel_str_handler power_tracepoints[] = {
                { "power:cpu_idle",             process_sample_cpu_idle },
                { "power:cpu_frequency",        process_sample_cpu_frequency },
@@ -997,12 +1114,17 @@ static int __cmd_timechart(const char *output_name)
        };
        struct perf_session *session = perf_session__new(&file, false,
-                                                         &perf_timechart);
+                                                         &tchart->tool);
        int ret = -EINVAL;
        if (session == NULL)
                return -ENOMEM;
+        (void)perf_header__process_sections(&session->header,
+                                            perf_data_file__fd(session->file),
+                                            tchart,
+                                            process_header);
        if (!perf_session__has_traces(session, "timechart record"))
                goto out_delete;
@@ -1012,69 +1134,111 @@ static int __cmd_timechart(const char *output_name)
                goto out_delete;
        }
-        ret = perf_session__process_events(session, &perf_timechart);
+        ret = perf_session__process_events(session, &tchart->tool);
        if (ret)
                goto out_delete;
-        end_sample_processing();
+        end_sample_processing(tchart);
-        sort_pids();
+        sort_pids(tchart);
-        write_svg_file(output_name);
+        write_svg_file(tchart, output_name);
        pr_info("Written %2.1f seconds of trace to %s.\n",
-                (last_time - first_time) / 1000000000.0, output_name);
+                (tchart->last_time - tchart->first_time) / 1000000000.0, output_name);
 out_delete:
        perf_session__delete(session);
        return ret;
 }
-static int __cmd_record(int argc, const char **argv)
+static int timechart__record(struct timechart *tchart, int argc, const char **argv)
 {
-#ifdef SUPPORT_OLD_POWER_EVENTS
+        unsigned int rec_argc, i, j;
-        const char * const record_old_args[] = {
+        const char **rec_argv;
+        const char **p;
+        unsigned int record_elems;
+        const char * const common_args[] = {
                "record", "-a", "-R", "-c", "1",
+        };
+        unsigned int common_args_nr = ARRAY_SIZE(common_args);
+        const char * const backtrace_args[] = {
+                "-g",
+        };
+        unsigned int backtrace_args_no = ARRAY_SIZE(backtrace_args);
+        const char * const power_args[] = {
+                "-e", "power:cpu_frequency",
+                "-e", "power:cpu_idle",
+        };
+        unsigned int power_args_nr = ARRAY_SIZE(power_args);
+        const char * const old_power_args[] = {
+#ifdef SUPPORT_OLD_POWER_EVENTS
                "-e", "power:power_start",
                "-e", "power:power_end",
                "-e", "power:power_frequency",
-                "-e", "sched:sched_wakeup",
-                "-e", "sched:sched_switch",
-        };
 #endif
-        const char * const record_new_args[] = {
+        };
-                "record", "-a", "-R", "-c", "1",
+        unsigned int old_power_args_nr = ARRAY_SIZE(old_power_args);
-                "-e", "power:cpu_frequency",
-                "-e", "power:cpu_idle",
+        const char * const tasks_args[] = {
                "-e", "sched:sched_wakeup",
                "-e", "sched:sched_switch",
        };
-        unsigned int rec_argc, i, j;
+        unsigned int tasks_args_nr = ARRAY_SIZE(tasks_args);
-        const char **rec_argv;
-        const char * const *record_args = record_new_args;
-        unsigned int record_elems = ARRAY_SIZE(record_new_args);
 #ifdef SUPPORT_OLD_POWER_EVENTS
        if (!is_valid_tracepoint("power:cpu_idle") &&
            is_valid_tracepoint("power:power_start")) {
                use_old_power_events = 1;
-                record_args = record_old_args;
+                power_args_nr = 0;
-                record_elems = ARRAY_SIZE(record_old_args);
+        } else {
+                old_power_args_nr = 0;
        }
 #endif
-        rec_argc = record_elems + argc - 1;
+        if (tchart->power_only)
+                tasks_args_nr = 0;
+        if (tchart->tasks_only) {
+                power_args_nr = 0;
+                old_power_args_nr = 0;
+        }
+        if (!tchart->with_backtrace)
+                backtrace_args_no = 0;
+        record_elems = common_args_nr + tasks_args_nr +
+                power_args_nr + old_power_args_nr + backtrace_args_no;
+        rec_argc = record_elems + argc;
        rec_argv = calloc(rec_argc + 1, sizeof(char *));
        if (rec_argv == NULL)
                return -ENOMEM;
-        for (i = 0; i < record_elems; i++)
+        p = rec_argv;
-                rec_argv[i] = strdup(record_args[i]);
+        for (i = 0; i < common_args_nr; i++)
+                *p++ = strdup(common_args[i]);
+        for (i = 0; i < backtrace_args_no; i++)
+                *p++ = strdup(backtrace_args[i]);
+        for (i = 0; i < tasks_args_nr; i++)
+                *p++ = strdup(tasks_args[i]);
+        for (i = 0; i < power_args_nr; i++)
+                *p++ = strdup(power_args[i]);
-        for (j = 1; j < (unsigned int)argc; j++, i++)
+        for (i = 0; i < old_power_args_nr; i++)
-                rec_argv[i] = argv[j];
+                *p++ = strdup(old_power_args[i]);
-        return cmd_record(i, rec_argv, NULL);
+        for (j = 1; j < (unsigned int)argc; j++)
+                *p++ = argv[j];
+        return cmd_record(rec_argc, rec_argv, NULL);
 }
 static int
@@ -1086,20 +1250,56 @@ parse_process(const struct option *opt __maybe_unused, const char *arg,
        return 0;
 }
+static int
+parse_highlight(const struct option *opt __maybe_unused, const char *arg,
+                int __maybe_unused unset)
+{
+        unsigned long duration = strtoul(arg, NULL, 0);
+        if (svg_highlight || svg_highlight_name)
+                return -1;
+        if (duration)
+                svg_highlight = duration;
+        else
+                svg_highlight_name = strdup(arg);
+        return 0;
+}
 int cmd_timechart(int argc, const char **argv,
                  const char *prefix __maybe_unused)
 {
+        struct timechart tchart = {
+                .tool = {
+                        .comm            = process_comm_event,
+                        .fork            = process_fork_event,
+                        .exit            = process_exit_event,
+                        .sample          = process_sample_event,
+                        .ordered_samples = true,
+                },
+                .proc_num = 15,
+        };
        const char *output_name = "output.svg";
-        const struct option options[] = {
+        const struct option timechart_options[] = {
        OPT_STRING('i', "input", &input_name, "file", "input file name"),
        OPT_STRING('o', "output", &output_name, "file", "output file name"),
        OPT_INTEGER('w', "width", &svg_page_width, "page width"),
-        OPT_BOOLEAN('P', "power-only", &power_only, "output power data only"),
+        OPT_CALLBACK(0, "highlight", NULL, "duration or task name",
+                      "highlight tasks. Pass duration in ns or process name.",
+                       parse_highlight),
+        OPT_BOOLEAN('P', "power-only", &tchart.power_only, "output power data only"),
+        OPT_BOOLEAN('T', "tasks-only", &tchart.tasks_only,
+                    "output processes data only"),
        OPT_CALLBACK('p', "process", NULL, "process",
                      "process selector. Pass a pid or process name.",
                       parse_process),
        OPT_STRING(0, "symfs", &symbol_conf.symfs, "directory",
                    "Look for files with symbols relative to this directory"),
+        OPT_INTEGER('n', "proc-num", &tchart.proc_num,
+                    "min. number of tasks to print"),
+        OPT_BOOLEAN('t', "topology", &tchart.topology,
+                    "sort CPUs according to topology"),
        OPT_END()
        };
        const char * const timechart_usage[] = {
@@ -1107,17 +1307,41 @@ int cmd_timechart(int argc, const char **argv,
                NULL
        };
-        argc = parse_options(argc, argv, options, timechart_usage,
+        const struct option record_options[] = {
+        OPT_BOOLEAN('P', "power-only", &tchart.power_only, "output power data only"),
+        OPT_BOOLEAN('T', "tasks-only", &tchart.tasks_only,
+                    "output processes data only"),
+        OPT_BOOLEAN('g', "callchain", &tchart.with_backtrace, "record callchain"),
+        OPT_END()
+        };
+        const char * const record_usage[] = {
+                "perf timechart record [<options>]",
+                NULL
+        };
+        argc = parse_options(argc, argv, timechart_options, timechart_usage,
                        PARSE_OPT_STOP_AT_NON_OPTION);
+        if (tchart.power_only && tchart.tasks_only) {
+                pr_err("-P and -T options cannot be used at the same time.\n");
+                return -1;
+        }
        symbol__init();
-        if (argc && !strncmp(argv[0], "rec", 3))
+        if (argc && !strncmp(argv[0], "rec", 3)) {
-                return __cmd_record(argc, argv);
+                argc = parse_options(argc, argv, record_options, record_usage,
-        else if (argc)
+                                     PARSE_OPT_STOP_AT_NON_OPTION);
-                usage_with_options(timechart_usage, options);
+                if (tchart.power_only && tchart.tasks_only) {
+                        pr_err("-P and -T options cannot be used at the same time.\n");
+                        return -1;
+                }
+                return timechart__record(&tchart, argc, argv);
+        } else if (argc)
+                usage_with_options(timechart_usage, timechart_options);
        setup_pager();
-        return __cmd_timechart(output_name);
+        return __cmd_timechart(&tchart, output_name);
 }
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 71e6402729a8..76cd510d34d0 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -189,21 +189,18 @@ static void perf_top__record_precise_ip(struct perf_top *top,
        if (pthread_mutex_trylock(&notes->lock))
                return;
-        if (notes->src == NULL && symbol__alloc_hist(sym) < 0) {
-                pthread_mutex_unlock(&notes->lock);
-                pr_err("Not enough memory for annotating '%s' symbol!\n",
-                       sym->name);
-                sleep(1);
-                return;
-        }
        ip = he->ms.map->map_ip(he->ms.map, ip);
-        err = symbol__inc_addr_samples(sym, he->ms.map, counter, ip);
+        err = hist_entry__inc_addr_samples(he, counter, ip);
        pthread_mutex_unlock(&notes->lock);
        if (err == -ERANGE && !he->ms.map->erange_warned)
                ui__warn_map_erange(he->ms.map, sym, ip);
+        else if (err == -ENOMEM) {
+                pr_err("Not enough memory for annotating '%s' symbol!\n",
+                       sym->name);
+                sleep(1);
+        }
 }
 static void perf_top__show_details(struct perf_top *top)
@@ -485,7 +482,7 @@ static bool perf_top__handle_keypress(struct perf_top *top, int c)
                                fprintf(stderr, "\nAvailable events:");
-                                list_for_each_entry(top->sym_evsel, &top->evlist->entries, node)
+                                evlist__for_each(top->evlist, top->sym_evsel)
                                        fprintf(stderr, "\n\t%d %s", top->sym_evsel->idx, perf_evsel__name(top->sym_evsel));
                                prompt_integer(&counter, "Enter details event counter");
@@ -496,7 +493,7 @@ static bool perf_top__handle_keypress(struct perf_top *top, int c)
                                        sleep(1);
                                        break;
                                }
-                                list_for_each_entry(top->sym_evsel, &top->evlist->entries, node)
+                                evlist__for_each(top->evlist, top->sym_evsel)
                                        if (top->sym_evsel->idx == counter)
                                                break;
                        } else
@@ -578,7 +575,7 @@ static void *display_thread_tui(void *arg)
         * Zooming in/out UIDs. For now juse use whatever the user passed
         * via --uid.
         */
-        list_for_each_entry(pos, &top->evlist->entries, node)
+        evlist__for_each(top->evlist, pos)
                pos->hists.uid_filter_str = top->record_opts.target.uid_str;
        perf_evlist__tui_browse_hists(top->evlist, help, &hbt, top->min_percent,
@@ -634,26 +631,9 @@ repeat:
        return NULL;
 }
-/* Tag samples to be skipped. */
-static const char *skip_symbols[] = {
-        "intel_idle",
-        "default_idle",
-        "native_safe_halt",
-        "cpu_idle",
-        "enter_idle",
-        "exit_idle",
-        "mwait_idle",
-        "mwait_idle_with_hints",
-        "poll_idle",
-        "ppc64_runlatch_off",
-        "pseries_dedicated_idle_sleep",
-        NULL
-};
 static int symbol_filter(struct map *map __maybe_unused, struct symbol *sym)
 {
        const char *name = sym->name;
-        int i;
        /*
         * ppc64 uses function descriptors and appends a '.' to the
@@ -671,12 +651,8 @@ static int symbol_filter(struct map *map __maybe_unused, struct symbol *sym)
            strstr(name, "_text_end"))
                return 1;
-        for (i = 0; skip_symbols[i]; i++) {
+        if (symbol__is_idle(sym))
-                if (!strcmp(skip_symbols[i], name)) {
+                sym->ignore = true;
-                        sym->ignore = true;
-                        break;
-                }
-        }
        return 0;
 }
@@ -767,15 +743,10 @@ static void perf_event__process_sample(struct perf_tool *tool,
        if (al.sym == NULL || !al.sym->ignore) {
                struct hist_entry *he;
-                if ((sort__has_parent || symbol_conf.use_callchain) &&
+                err = sample__resolve_callchain(sample, &parent, evsel, &al,
-                    sample->callchain) {
+                                                top->max_stack);
-                        err = machine__resolve_callchain(machine, evsel,
+                if (err)
-                                                         al.thread, sample,
+                        return;
-                                                         &parent, &al,
-                                                         top->max_stack);
-                        if (err)
-                                return;
-                }
                he = perf_evsel__add_hist_entry(evsel, &al, sample);
                if (he == NULL) {
@@ -783,12 +754,9 @@ static void perf_event__process_sample(struct perf_tool *tool,
                        return;
                }
-                if (symbol_conf.use_callchain) {
+                err = hist_entry__append_callchain(he, sample);
-                        err = callchain_append(he->callchain, &callchain_cursor,
+                if (err)
-                                               sample->period);
+                        return;
-                        if (err)
-                                return;
-                }
                if (sort__has_sym)
                        perf_top__record_precise_ip(top, he, evsel->idx, ip);
@@ -878,11 +846,11 @@ static int perf_top__start_counters(struct perf_top *top)
        char msg[512];
        struct perf_evsel *counter;
        struct perf_evlist *evlist = top->evlist;
-        struct perf_record_opts *opts = &top->record_opts;
+        struct record_opts *opts = &top->record_opts;
        perf_evlist__config(evlist, opts);
-        list_for_each_entry(counter, &evlist->entries, node) {
+        evlist__for_each(evlist, counter) {
 try_again:
                if (perf_evsel__open(counter, top->evlist->cpus,
                                     top->evlist->threads) < 0) {
@@ -930,7 +898,7 @@ static int perf_top__setup_sample_type(struct perf_top *top __maybe_unused)
 static int __cmd_top(struct perf_top *top)
 {
-        struct perf_record_opts *opts = &top->record_opts;
+        struct record_opts *opts = &top->record_opts;
        pthread_t thread;
        int ret;
@@ -1052,7 +1020,7 @@ int cmd_top(int argc, const char **argv, const char *prefix __maybe_unused)
                .max_stack           = PERF_MAX_STACK_DEPTH,
                .sym_pcnt_filter     = 5,
        };
-        struct perf_record_opts *opts = &top.record_opts;
+        struct record_opts *opts = &top.record_opts;
        struct target *target = &opts->target;
        const struct option options[] = {
        OPT_CALLBACK('e', "event", &top.evlist, "event",
@@ -1084,7 +1052,7 @@ int cmd_top(int argc, const char **argv, const char *prefix __maybe_unused)
                            "dump the symbol table used for profiling"),
        OPT_INTEGER('f', "count-filter", &top.count_filter,
                    "only display functions with more events than this"),
-        OPT_BOOLEAN('g', "group", &opts->group,
+        OPT_BOOLEAN(0, "group", &opts->group,
                            "put the counters into a counter group"),
        OPT_BOOLEAN('i', "no-inherit", &opts->no_inherit,
                    "child tasks do not inherit counters"),
@@ -1105,7 +1073,7 @@ int cmd_top(int argc, const char **argv, const char *prefix __maybe_unused)
                   " abort, in_tx, transaction"),
        OPT_BOOLEAN('n', "show-nr-samples", &symbol_conf.show_nr_samples,
                    "Show a column with the number of samples"),
-        OPT_CALLBACK_NOOPT('G', NULL, &top.record_opts,
+        OPT_CALLBACK_NOOPT('g', NULL, &top.record_opts,
                           NULL, "enables call-graph recording",
                           &callchain_opt),
        OPT_CALLBACK(0, "call-graph", &top.record_opts,
@@ -1195,7 +1163,7 @@ int cmd_top(int argc, const char **argv, const char *prefix __maybe_unused)
        if (!top.evlist->nr_entries &&
            perf_evlist__add_default(top.evlist) < 0) {
                ui__error("Not enough memory for event selector list\n");
-                goto out_delete_maps;
+                goto out_delete_evlist;
        }
        symbol_conf.nr_events = top.evlist->nr_entries;
@@ -1203,9 +1171,9 @@ int cmd_top(int argc, const char **argv, const char *prefix __maybe_unused)
        if (top.delay_secs < 1)
                top.delay_secs = 1;
-        if (perf_record_opts__config(opts)) {
+        if (record_opts__config(opts)) {
                status = -EINVAL;
-                goto out_delete_maps;
+                goto out_delete_evlist;
        }
        top.sym_evsel = perf_evlist__first(top.evlist);
@@ -1230,8 +1198,6 @@ int cmd_top(int argc, const char **argv, const char *prefix __maybe_unused)
        status = __cmd_top(&top);
-out_delete_maps:
-        perf_evlist__delete_maps(top.evlist);
 out_delete_evlist:
        perf_evlist__delete(top.evlist);
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 8be17fc462ba..896f27047ed6 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -11,6 +11,8 @@
 #include "util/intlist.h"
 #include "util/thread_map.h"
 #include "util/stat.h"
+#include "trace-event.h"
+#include "util/parse-events.h"
 #include <libaudit.h>
 #include <stdlib.h>
@@ -144,8 +146,7 @@ static int perf_evsel__init_tp_ptr_field(struct perf_evsel *evsel,
 static void perf_evsel__delete_priv(struct perf_evsel *evsel)
 {
-        free(evsel->priv);
+        zfree(&evsel->priv);
-        evsel->priv = NULL;
        perf_evsel__delete(evsel);
 }
@@ -163,8 +164,7 @@ static int perf_evsel__init_syscall_tp(struct perf_evsel *evsel, void *handler)
        return -ENOMEM;
 out_delete:
-        free(evsel->priv);
+        zfree(&evsel->priv);
-        evsel->priv = NULL;
        return -ENOENT;
 }
@@ -172,6 +172,10 @@ static struct perf_evsel *perf_evsel__syscall_newtp(const char *direction, void
 {
        struct perf_evsel *evsel = perf_evsel__newtp("raw_syscalls", direction);
+        /* older kernel (e.g., RHEL6) use syscalls:{enter,exit} */
+        if (evsel == NULL)
+                evsel = perf_evsel__newtp("syscalls", direction);
        if (evsel) {
                if (perf_evsel__init_syscall_tp(evsel, handler))
                        goto out_delete;
@@ -1153,29 +1157,30 @@ struct trace {
                int             max;
                struct syscall  *table;
        } syscalls;
-        struct perf_record_opts opts;
+        struct record_opts      opts;
        struct machine          *host;
        u64                     base_time;
-        bool                    full_time;
        FILE                    *output;
        unsigned long           nr_events;
        struct strlist          *ev_qualifier;
-        bool                    not_ev_qualifier;
-        bool                    live;
        const char              *last_vfs_getname;
        struct intlist          *tid_list;
        struct intlist          *pid_list;
+        double                  duration_filter;
+        double                  runtime_ms;
+        struct {
+                u64             vfs_getname,
+                                proc_getname;
+        } stats;
+        bool                    not_ev_qualifier;
+        bool                    live;
+        bool                    full_time;
        bool                    sched;
        bool                    multiple_threads;
        bool                    summary;
        bool                    summary_only;
        bool                    show_comm;
        bool                    show_tool_stats;
-        double                  duration_filter;
-        double                  runtime_ms;
-        struct {
-                u64             vfs_getname, proc_getname;
-        } stats;
 };
 static int trace__set_fd_pathname(struct thread *thread, int fd, const char *pathname)
@@ -1272,10 +1277,8 @@ static size_t syscall_arg__scnprintf_close_fd(char *bf, size_t size,
        size_t printed = syscall_arg__scnprintf_fd(bf, size, arg);
        struct thread_trace *ttrace = arg->thread->priv;
-        if (ttrace && fd >= 0 && fd <= ttrace->paths.max) {
+        if (ttrace && fd >= 0 && fd <= ttrace->paths.max)
-                free(ttrace->paths.table[fd]);
+                zfree(&ttrace->paths.table[fd]);
-                ttrace->paths.table[fd] = NULL;
-        }
        return printed;
 }
@@ -1430,11 +1433,11 @@ static int trace__read_syscall_info(struct trace *trace, int id)
        sc->fmt  = syscall_fmt__find(sc->name);
        snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->name);
-        sc->tp_format = event_format__new("syscalls", tp_name);
+        sc->tp_format = trace_event__tp_format("syscalls", tp_name);
        if (sc->tp_format == NULL && sc->fmt && sc->fmt->alias) {
                snprintf(tp_name, sizeof(tp_name), "sys_enter_%s", sc->fmt->alias);
-                sc->tp_format = event_format__new("syscalls", tp_name);
+                sc->tp_format = trace_event__tp_format("syscalls", tp_name);
        }
        if (sc->tp_format == NULL)
@@ -1764,8 +1767,10 @@ static int trace__process_sample(struct perf_tool *tool,
        if (!trace->full_time && trace->base_time == 0)
                trace->base_time = sample->time;
-        if (handler)
+        if (handler) {
+                ++trace->nr_events;
                handler(trace, evsel, sample);
+        }
        return err;
 }
@@ -1800,10 +1805,11 @@ static int trace__record(int argc, const char **argv)
                "-R",
                "-m", "1024",
                "-c", "1",
-                "-e", "raw_syscalls:sys_enter,raw_syscalls:sys_exit",
+                "-e",
        };
-        rec_argc = ARRAY_SIZE(record_args) + argc;
+        /* +1 is for the event string below */
+        rec_argc = ARRAY_SIZE(record_args) + 1 + argc;
        rec_argv = calloc(rec_argc + 1, sizeof(char *));
        if (rec_argv == NULL)
@@ -1812,6 +1818,17 @@ static int trace__record(int argc, const char **argv)
        for (i = 0; i < ARRAY_SIZE(record_args); i++)
                rec_argv[i] = record_args[i];
+        /* event string may be different for older kernels - e.g., RHEL6 */
+        if (is_valid_tracepoint("raw_syscalls:sys_enter"))
+                rec_argv[i] = "raw_syscalls:sys_enter,raw_syscalls:sys_exit";
+        else if (is_valid_tracepoint("syscalls:sys_enter"))
+                rec_argv[i] = "syscalls:sys_enter,syscalls:sys_exit";
+        else {
+                pr_err("Neither raw_syscalls nor syscalls events exist.\n");
+                return -1;
+        }
+        i++;
        for (j = 0; j < (unsigned int)argc; j++, i++)
                rec_argv[i] = argv[j];
@@ -1869,7 +1886,7 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
        err = trace__symbols_init(trace, evlist);
        if (err < 0) {
                fprintf(trace->output, "Problems initializing symbol libraries!\n");
-                goto out_delete_maps;
+                goto out_delete_evlist;
        }
        perf_evlist__config(evlist, &trace->opts);
@@ -1879,10 +1896,10 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
        if (forks) {
                err = perf_evlist__prepare_workload(evlist, &trace->opts.target,
-                                                    argv, false, false);
+                                                    argv, false, NULL);
                if (err < 0) {
                        fprintf(trace->output, "Couldn't run the workload!\n");
-                        goto out_delete_maps;
+                        goto out_delete_evlist;
                }
        }
@@ -1890,10 +1907,10 @@ static int trace__run(struct trace *trace, int argc, const char **argv)
        if (err < 0)
                goto out_error_open;
-        err = perf_evlist__mmap(evlist, UINT_MAX, false);
+        err = perf_evlist__mmap(evlist, trace->opts.mmap_pages, false);
        if (err < 0) {
                fprintf(trace->output, "Couldn't mmap the events: %s\n", strerror(errno));
-                goto out_close_evlist;
+                goto out_delete_evlist;
        }
        perf_evlist__enable(evlist);
@@ -1977,11 +1994,6 @@ out_disable:
                }
        }
-        perf_evlist__munmap(evlist);
-out_close_evlist:
-        perf_evlist__close(evlist);
-out_delete_maps:
-        perf_evlist__delete_maps(evlist);
 out_delete_evlist:
        perf_evlist__delete(evlist);
 out:
@@ -2047,6 +2059,10 @@ static int trace__replay(struct trace *trace)
        evsel = perf_evlist__find_tracepoint_by_name(session->evlist,
                                                     "raw_syscalls:sys_enter");
+        /* older kernels have syscalls tp versus raw_syscalls */
+        if (evsel == NULL)
+                evsel = perf_evlist__find_tracepoint_by_name(session->evlist,
+                                                             "syscalls:sys_enter");
        if (evsel == NULL) {
                pr_err("Data file does not have raw_syscalls:sys_enter event\n");
                goto out;
@@ -2060,6 +2076,9 @@ static int trace__replay(struct trace *trace)
        evsel = perf_evlist__find_tracepoint_by_name(session->evlist,
                                                     "raw_syscalls:sys_exit");
+        if (evsel == NULL)
+                evsel = perf_evlist__find_tracepoint_by_name(session->evlist,
+                                                             "syscalls:sys_exit");
        if (evsel == NULL) {
                pr_err("Data file does not have raw_syscalls:sys_exit event\n");
                goto out;
@@ -2158,7 +2177,6 @@ static int trace__fprintf_one_thread(struct thread *thread, void *priv)
        size_t printed = data->printed;
        struct trace *trace = data->trace;
        struct thread_trace *ttrace = thread->priv;
-        const char *color;
        double ratio;
        if (ttrace == NULL)
@@ -2166,17 +2184,9 @@ static int trace__fprintf_one_thread(struct thread *thread, void *priv)
        ratio = (double)ttrace->nr_events / trace->nr_events * 100.0;
-        color = PERF_COLOR_NORMAL;
+        printed += fprintf(fp, " %s (%d), ", thread__comm_str(thread), thread->tid);
-        if (ratio > 50.0)
-                color = PERF_COLOR_RED;
-        else if (ratio > 25.0)
-                color = PERF_COLOR_GREEN;
-        else if (ratio > 5.0)
-                color = PERF_COLOR_YELLOW;
-        printed += color_fprintf(fp, color, " %s (%d), ", thread__comm_str(thread), thread->tid);
        printed += fprintf(fp, "%lu events, ", ttrace->nr_events);
-        printed += color_fprintf(fp, color, "%.1f%%", ratio);
+        printed += fprintf(fp, "%.1f%%", ratio);
        printed += fprintf(fp, ", %.3f msec\n", ttrace->runtime_ms);
        printed += thread__dump_stats(ttrace, trace, fp);
@@ -2248,7 +2258,7 @@ int cmd_trace(int argc, const char **argv, const char *prefix __maybe_unused)
                        },
                        .user_freq     = UINT_MAX,
                        .user_interval = ULLONG_MAX,
-                        .no_delay      = true,
+                        .no_buffering  = true,
                        .mmap_pages    = 1024,
                },
                .output = stdout,
diff --git a/tools/perf/config/Makefile b/tools/perf/config/Makefile
index f7d11a811c74..d604e50fc167 100644
--- a/tools/perf/config/Makefile
+++ b/tools/perf/config/Makefile
@@ -1,28 +1,26 @@
-uname_M := $(shell uname -m 2>/dev/null || echo not)
-ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ \
+ifeq ($(src-perf),)
-                                  -e s/arm.*/arm/ -e s/sa110/arm/ \
+src-perf := $(srctree)/tools/perf
-                                  -e s/s390x/s390/ -e s/parisc64/parisc/ \
+endif
-                                  -e s/ppc.*/powerpc/ -e s/mips.*/mips/ \
-                                  -e s/sh[234].*/sh/ -e s/aarch64.*/arm64/ )
-NO_PERF_REGS := 1
-CFLAGS := $(EXTRA_CFLAGS) $(EXTRA_WARNINGS)
-# Additional ARCH settings for x86
+ifeq ($(obj-perf),)
-ifeq ($(ARCH),i386)
+obj-perf := $(OUTPUT)
-  override ARCH := x86
-  NO_PERF_REGS := 0
-  LIBUNWIND_LIBS = -lunwind -lunwind-x86
 endif
-ifeq ($(ARCH),x86_64)
+ifneq ($(obj-perf),)
-  override ARCH := x86
+obj-perf := $(abspath $(obj-perf))/
-  IS_X86_64 := 0
+endif
-  ifeq (, $(findstring m32,$(CFLAGS)))
-    IS_X86_64 := $(shell echo __x86_64__ | ${CC} -E -x c - | tail -n 1)
+LIB_INCLUDE := $(srctree)/tools/lib/
-  endif
+CFLAGS := $(EXTRA_CFLAGS) $(EXTRA_WARNINGS)
+include $(src-perf)/config/Makefile.arch
+NO_PERF_REGS := 1
+# Additional ARCH settings for x86
+ifeq ($(ARCH),x86)
  ifeq (${IS_X86_64}, 1)
-    RAW_ARCH := x86_64
    CFLAGS += -DHAVE_ARCH_X86_64_SUPPORT
    ARCH_INCLUDE = ../../arch/x86/lib/memcpy_64.S ../../arch/x86/lib/memset_64.S
    LIBUNWIND_LIBS = -lunwind -lunwind-x86_64
@@ -36,24 +34,31 @@ ifeq ($(ARCH),arm)
  LIBUNWIND_LIBS = -lunwind -lunwind-arm
 endif
-ifeq ($(NO_PERF_REGS),0)
+ifeq ($(LIBUNWIND_LIBS),)
-  CFLAGS += -DHAVE_PERF_REGS_SUPPORT
+  NO_LIBUNWIND := 1
-endif
+else
+  #
-ifeq ($(src-perf),)
+  # For linking with debug library, run like:
-src-perf := $(srctree)/tools/perf
+  #
-endif
+  #   make DEBUG=1 LIBUNWIND_DIR=/opt/libunwind/
+  #
+  ifdef LIBUNWIND_DIR
+    LIBUNWIND_CFLAGS  = -I$(LIBUNWIND_DIR)/include
+    LIBUNWIND_LDFLAGS = -L$(LIBUNWIND_DIR)/lib
+  endif
+  LIBUNWIND_LDFLAGS += $(LIBUNWIND_LIBS)
-ifeq ($(obj-perf),)
+  # Set per-feature check compilation flags
-obj-perf := $(OUTPUT)
+  FEATURE_CHECK_CFLAGS-libunwind = $(LIBUNWIND_CFLAGS)
+  FEATURE_CHECK_LDFLAGS-libunwind = $(LIBUNWIND_LDFLAGS)
+  FEATURE_CHECK_CFLAGS-libunwind-debug-frame = $(LIBUNWIND_CFLAGS)
+  FEATURE_CHECK_LDFLAGS-libunwind-debug-frame = $(LIBUNWIND_LDFLAGS)
 endif
-ifneq ($(obj-perf),)
+ifeq ($(NO_PERF_REGS),0)
-obj-perf := $(abspath $(obj-perf))/
+  CFLAGS += -DHAVE_PERF_REGS_SUPPORT
 endif
-LIB_INCLUDE := $(srctree)/tools/lib/
 # include ARCH specific config
 -include $(src-perf)/arch/$(ARCH)/Makefile
@@ -102,7 +107,7 @@ endif
 feature_check = $(eval $(feature_check_code))
 define feature_check_code
-  feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CFLAGS="$(EXTRA_CFLAGS)" LDFLAGS="$(LDFLAGS)" LIBUNWIND_LIBS="$(LIBUNWIND_LIBS)" -C config/feature-checks test-$1 >/dev/null 2>/dev/null && echo 1 || echo 0)
+  feature-$(1) := $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CFLAGS="$(EXTRA_CFLAGS) $(FEATURE_CHECK_CFLAGS-$(1))" LDFLAGS="$(LDFLAGS) $(FEATURE_CHECK_LDFLAGS-$(1))" -C config/feature-checks test-$1.bin >/dev/null 2>/dev/null && echo 1 || echo 0)
 endef
 feature_set = $(eval $(feature_set_code))
@@ -141,16 +146,26 @@ CORE_FEATURE_TESTS =			\
        libslang                        \
        libunwind                       \
        on-exit                         \
-        stackprotector                  \
        stackprotector-all              \
        timerfd
+# Set FEATURE_CHECK_(C|LD)FLAGS-all for all CORE_FEATURE_TESTS features.
+# If in the future we need per-feature checks/flags for features not
+# mentioned in this list we need to refactor this ;-).
+set_test_all_flags = $(eval $(set_test_all_flags_code))
+define set_test_all_flags_code
+  FEATURE_CHECK_CFLAGS-all  += $(FEATURE_CHECK_CFLAGS-$(1))
+  FEATURE_CHECK_LDFLAGS-all += $(FEATURE_CHECK_LDFLAGS-$(1))
+endef
+$(foreach feat,$(CORE_FEATURE_TESTS),$(call set_test_all_flags,$(feat)))
 #
 # So here we detect whether test-all was rebuilt, to be able
 # to skip the print-out of the long features list if the file
 # existed before and after it was built:
 #
-ifeq ($(wildcard $(OUTPUT)config/feature-checks/test-all),)
+ifeq ($(wildcard $(OUTPUT)config/feature-checks/test-all.bin),)
  test-all-failed := 1
 else
  test-all-failed := 0
@@ -180,7 +195,7 @@ ifeq ($(feature-all), 1)
  #
  $(foreach feat,$(CORE_FEATURE_TESTS),$(call feature_set,$(feat)))
 else
-  $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CFLAGS="$(EXTRA_CFLAGS)" LDFLAGS=$(LDFLAGS) -i -j -C config/feature-checks $(CORE_FEATURE_TESTS) >/dev/null 2>&1)
+  $(shell $(MAKE) OUTPUT=$(OUTPUT_FEATURES) CFLAGS="$(EXTRA_CFLAGS)" LDFLAGS=$(LDFLAGS) -i -j -C config/feature-checks $(addsuffix .bin,$(CORE_FEATURE_TESTS)) >/dev/null 2>&1)
  $(foreach feat,$(CORE_FEATURE_TESTS),$(call feature_check,$(feat)))
 endif
@@ -209,10 +224,6 @@ ifeq ($(feature-stackprotector-all), 1)
  CFLAGS += -fstack-protector-all
 endif
-ifeq ($(feature-stackprotector), 1)
-  CFLAGS += -Wstack-protector
-endif
 ifeq ($(DEBUG),0)
  ifeq ($(feature-fortify-source), 1)
    CFLAGS += -D_FORTIFY_SOURCE=2
@@ -221,6 +232,7 @@ endif
 CFLAGS += -I$(src-perf)/util/include
 CFLAGS += -I$(src-perf)/arch/$(ARCH)/include
+CFLAGS += -I$(srctree)/tools/include/
 CFLAGS += -I$(srctree)/arch/$(ARCH)/include/uapi
 CFLAGS += -I$(srctree)/arch/$(ARCH)/include
 CFLAGS += -I$(srctree)/include/uapi
@@ -310,21 +322,7 @@ ifndef NO_LIBELF
  endif # NO_DWARF
 endif # NO_LIBELF
-ifeq ($(LIBUNWIND_LIBS),)
-  NO_LIBUNWIND := 1
-endif
 ifndef NO_LIBUNWIND
-  #
-  # For linking with debug library, run like:
-  #
-  #   make DEBUG=1 LIBUNWIND_DIR=/opt/libunwind/
-  #
-  ifdef LIBUNWIND_DIR
-    LIBUNWIND_CFLAGS  := -I$(LIBUNWIND_DIR)/include
-    LIBUNWIND_LDFLAGS := -L$(LIBUNWIND_DIR)/lib
-  endif
  ifneq ($(feature-libunwind), 1)
    msg := $(warning No libunwind found, disabling post unwind support. Please install libunwind-dev[el] >= 1.1);
    NO_LIBUNWIND := 1
@@ -339,14 +337,12 @@ ifndef NO_LIBUNWIND
      # non-ARM has no dwarf_find_debug_frame() function:
      CFLAGS += -DNO_LIBUNWIND_DEBUG_FRAME
    endif
-  endif
-endif
-ifndef NO_LIBUNWIND
+    CFLAGS += -DHAVE_LIBUNWIND_SUPPORT
-  CFLAGS += -DHAVE_LIBUNWIND_SUPPORT
+    EXTLIBS += $(LIBUNWIND_LIBS)
-  EXTLIBS += $(LIBUNWIND_LIBS)
+    CFLAGS += $(LIBUNWIND_CFLAGS)
-  CFLAGS += $(LIBUNWIND_CFLAGS)
+    LDFLAGS += $(LIBUNWIND_LDFLAGS)
-  LDFLAGS += $(LIBUNWIND_LDFLAGS)
+  endif # ifneq ($(feature-libunwind), 1)
 endif
 ifndef NO_LIBAUDIT
@@ -376,7 +372,7 @@ ifndef NO_SLANG
 endif
 ifndef NO_GTK2
-  FLAGS_GTK2=$(CFLAGS) $(LDFLAGS) $(EXTLIBS) $(shell pkg-config --libs --cflags gtk+-2.0 2>/dev/null)
+  FLAGS_GTK2=$(CFLAGS) $(LDFLAGS) $(EXTLIBS) $(shell $(PKG_CONFIG) --libs --cflags gtk+-2.0 2>/dev/null)
  ifneq ($(feature-gtk2), 1)
    msg := $(warning GTK2 not found, disables GTK2 support. Please install gtk2-devel or libgtk2.0-dev);
    NO_GTK2 := 1
@@ -385,8 +381,8 @@ ifndef NO_GTK2
      GTK_CFLAGS := -DHAVE_GTK_INFO_BAR_SUPPORT
    endif
    CFLAGS += -DHAVE_GTK2_SUPPORT
-    GTK_CFLAGS += $(shell pkg-config --cflags gtk+-2.0 2>/dev/null)
+    GTK_CFLAGS += $(shell $(PKG_CONFIG) --cflags gtk+-2.0 2>/dev/null)
-    GTK_LIBS := $(shell pkg-config --libs gtk+-2.0 2>/dev/null)
+    GTK_LIBS := $(shell $(PKG_CONFIG) --libs gtk+-2.0 2>/dev/null)
    EXTLIBS += -ldl
  endif
 endif
@@ -533,7 +529,7 @@ endif
 ifndef NO_LIBNUMA
  ifeq ($(feature-libnuma), 0)
-    msg := $(warning No numa.h found, disables 'perf bench numa mem' benchmark, please install numa-libs-devel or libnuma-dev);
+    msg := $(warning No numa.h found, disables 'perf bench numa mem' benchmark, please install numactl-devel/libnuma-devel/libnuma-dev);
    NO_LIBNUMA := 1
  else
    CFLAGS += -DHAVE_LIBNUMA_SUPPORT
@@ -598,3 +594,11 @@ else
 perfexec_instdir = $(prefix)/$(perfexecdir)
 endif
 perfexec_instdir_SQ = $(subst ','\'',$(perfexec_instdir))
+# If we install to $(HOME) we keep the traceevent default:
+# $(HOME)/.traceevent/plugins
+# Otherwise we install plugins into the global $(libdir).
+ifdef DESTDIR
+plugindir=$(libdir)/traceevent/plugins
+plugindir_SQ= $(subst ','\'',$(prefix)/$(plugindir))
+endif
diff --git a/tools/perf/config/Makefile.arch b/tools/perf/config/Makefile.arch
new file mode 100644
index 000000000000..fef8ae922800
--- /dev/null
+++ b/tools/perf/config/Makefile.arch
@@ -0,0 +1,22 @@
+uname_M := $(shell uname -m 2>/dev/null || echo not)
+ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/i386/ -e s/sun4u/sparc64/ \
+                                  -e s/arm.*/arm/ -e s/sa110/arm/ \
+                                  -e s/s390x/s390/ -e s/parisc64/parisc/ \
+                                  -e s/ppc.*/powerpc/ -e s/mips.*/mips/ \
+                                  -e s/sh[234].*/sh/ -e s/aarch64.*/arm64/ )
+# Additional ARCH settings for x86
+ifeq ($(ARCH),i386)
+  override ARCH := x86
+endif
+ifeq ($(ARCH),x86_64)
+  override ARCH := x86
+  IS_X86_64 := 0
+  ifeq (, $(findstring m32,$(CFLAGS)))
+    IS_X86_64 := $(shell echo __x86_64__ | ${CC} -E -x c - | tail -n 1)
+    RAW_ARCH := x86_64
+  endif
+endif
diff --git a/tools/perf/config/feature-checks/.gitignore b/tools/perf/config/feature-checks/.gitignore
new file mode 100644
index 000000000000..80f3da0c3515
--- /dev/null
+++ b/tools/perf/config/feature-checks/.gitignore
@@ -0,0 +1,2 @@
+*.d
+*.bin
diff --git a/tools/perf/config/feature-checks/Makefile b/tools/perf/config/feature-checks/Makefile
index 87e790017c69..12e551346fa6 100644
--- a/tools/perf/config/feature-checks/Makefile
+++ b/tools/perf/config/feature-checks/Makefile
@@ -1,95 +1,92 @@
 FILES=                                  \
-        test-all                        \
+        test-all.bin                    \
-        test-backtrace                  \
+        test-backtrace.bin              \
-        test-bionic                     \
+        test-bionic.bin                 \
-        test-dwarf                      \
+        test-dwarf.bin                  \
-        test-fortify-source             \
+        test-fortify-source.bin         \
-        test-glibc                      \
+        test-glibc.bin                  \
-        test-gtk2                       \
+        test-gtk2.bin                   \
-        test-gtk2-infobar               \
+        test-gtk2-infobar.bin           \
-        test-hello                      \
+        test-hello.bin                  \
-        test-libaudit                   \
+        test-libaudit.bin               \
-        test-libbfd                     \
+        test-libbfd.bin                 \
-        test-liberty                    \
+        test-liberty.bin                \
-        test-liberty-z                  \
+        test-liberty-z.bin              \
-        test-cplus-demangle             \
+        test-cplus-demangle.bin         \
-        test-libelf                     \
+        test-libelf.bin                 \
-        test-libelf-getphdrnum          \
+        test-libelf-getphdrnum.bin      \
-        test-libelf-mmap                \
+        test-libelf-mmap.bin            \
-        test-libnuma                    \
+        test-libnuma.bin                \
-        test-libperl                    \
+        test-libperl.bin                \
-        test-libpython                  \
+        test-libpython.bin              \
-        test-libpython-version          \
+        test-libpython-version.bin      \
-        test-libslang                   \
+        test-libslang.bin               \
-        test-libunwind                  \
+        test-libunwind.bin              \
-        test-libunwind-debug-frame      \
+        test-libunwind-debug-frame.bin  \
-        test-on-exit                    \
+        test-on-exit.bin                \
-        test-stackprotector-all         \
+        test-stackprotector-all.bin     \
-        test-stackprotector             \
+        test-timerfd.bin
-        test-timerfd
+CC := $(CROSS_COMPILE)gcc -MD
-CC := $(CC) -MD
+PKG_CONFIG := $(CROSS_COMPILE)pkg-config
 all: $(FILES)
-BUILD = $(CC) $(CFLAGS) $(LDFLAGS) -o $(OUTPUT)$@ $@.c
+BUILD = $(CC) $(CFLAGS) -o $(OUTPUT)$@ $(patsubst %.bin,%.c,$@) $(LDFLAGS)
 ###############################
-test-all:
+test-all.bin:
-        $(BUILD) -Werror -fstack-protector -fstack-protector-all -O2 -Werror -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma $(LIBUNWIND_LIBS) -lelf -laudit -I/usr/include/slang -lslang $(shell pkg-config --libs --cflags gtk+-2.0 2>/dev/null) $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -DPACKAGE='"perf"' -lbfd -ldl
+        $(BUILD) -Werror -fstack-protector-all -O2 -Werror -D_FORTIFY_SOURCE=2 -ldw -lelf -lnuma -lelf -laudit -I/usr/include/slang -lslang $(shell $(PKG_CONFIG) --libs --cflags gtk+-2.0 2>/dev/null) $(FLAGS_PERL_EMBED) $(FLAGS_PYTHON_EMBED) -DPACKAGE='"perf"' -lbfd -ldl
-test-hello:
+test-hello.bin:
        $(BUILD)
-test-stackprotector-all:
+test-stackprotector-all.bin:
        $(BUILD) -Werror -fstack-protector-all
-test-stackprotector:
+test-fortify-source.bin:
-        $(BUILD) -Werror -fstack-protector -Wstack-protector
-test-fortify-source:
        $(BUILD) -O2 -Werror -D_FORTIFY_SOURCE=2
-test-bionic:
+test-bionic.bin:
        $(BUILD)
-test-libelf:
+test-libelf.bin:
        $(BUILD) -lelf
-test-glibc:
+test-glibc.bin:
        $(BUILD)
-test-dwarf:
+test-dwarf.bin:
        $(BUILD) -ldw
-test-libelf-mmap:
+test-libelf-mmap.bin:
        $(BUILD) -lelf
-test-libelf-getphdrnum:
+test-libelf-getphdrnum.bin:
        $(BUILD) -lelf
-test-libnuma:
+test-libnuma.bin:
        $(BUILD) -lnuma
-test-libunwind:
+test-libunwind.bin:
-        $(BUILD) $(LIBUNWIND_LIBS) -lelf
+        $(BUILD) -lelf
-test-libunwind-debug-frame:
+test-libunwind-debug-frame.bin:
-        $(BUILD) $(LIBUNWIND_LIBS) -lelf
+        $(BUILD) -lelf
-test-libaudit:
+test-libaudit.bin:
        $(BUILD) -laudit
-test-libslang:
+test-libslang.bin:
        $(BUILD) -I/usr/include/slang -lslang
-test-gtk2:
+test-gtk2.bin:
-        $(BUILD) $(shell pkg-config --libs --cflags gtk+-2.0 2>/dev/null)
+        $(BUILD) $(shell $(PKG_CONFIG) --libs --cflags gtk+-2.0 2>/dev/null)
-test-gtk2-infobar:
+test-gtk2-infobar.bin:
-        $(BUILD) $(shell pkg-config --libs --cflags gtk+-2.0 2>/dev/null)
+        $(BUILD) $(shell $(PKG_CONFIG) --libs --cflags gtk+-2.0 2>/dev/null)
 grep-libs  = $(filter -l%,$(1))
 strip-libs = $(filter-out -l%,$(1))
@@ -100,7 +97,7 @@ PERL_EMBED_LIBADD = $(call grep-libs,$(PERL_EMBED_LDOPTS))
 PERL_EMBED_CCOPTS = `perl -MExtUtils::Embed -e ccopts 2>/dev/null`
 FLAGS_PERL_EMBED=$(PERL_EMBED_CCOPTS) $(PERL_EMBED_LDOPTS)
-test-libperl:
+test-libperl.bin:
        $(BUILD) $(FLAGS_PERL_EMBED)
 override PYTHON := python
@@ -117,31 +114,31 @@ PYTHON_EMBED_LIBADD = $(call grep-libs,$(PYTHON_EMBED_LDOPTS))
 PYTHON_EMBED_CCOPTS = $(shell $(PYTHON_CONFIG_SQ) --cflags 2>/dev/null)
 FLAGS_PYTHON_EMBED = $(PYTHON_EMBED_CCOPTS) $(PYTHON_EMBED_LDOPTS)
-test-libpython:
+test-libpython.bin:
        $(BUILD) $(FLAGS_PYTHON_EMBED)
-test-libpython-version:
+test-libpython-version.bin:
        $(BUILD) $(FLAGS_PYTHON_EMBED)
-test-libbfd:
+test-libbfd.bin:
        $(BUILD) -DPACKAGE='"perf"' -lbfd -ldl
-test-liberty:
+test-liberty.bin:
        $(CC) -o $(OUTPUT)$@ test-libbfd.c -DPACKAGE='"perf"' -lbfd -ldl -liberty
-test-liberty-z:
+test-liberty-z.bin:
        $(CC) -o $(OUTPUT)$@ test-libbfd.c -DPACKAGE='"perf"' -lbfd -ldl -liberty -lz
-test-cplus-demangle:
+test-cplus-demangle.bin:
        $(BUILD) -liberty
-test-on-exit:
+test-on-exit.bin:
        $(BUILD)
-test-backtrace:
+test-backtrace.bin:
        $(BUILD)
-test-timerfd:
+test-timerfd.bin:
        $(BUILD)
 -include *.d
diff --git a/tools/perf/config/feature-checks/test-all.c b/tools/perf/config/feature-checks/test-all.c
index 59e7a705e146..9b8a544155bb 100644
--- a/tools/perf/config/feature-checks/test-all.c
+++ b/tools/perf/config/feature-checks/test-all.c
@@ -85,6 +85,10 @@
 # include "test-timerfd.c"
 #undef main
+#define main main_test_stackprotector_all
+# include "test-stackprotector-all.c"
+#undef main
 int main(int argc, char *argv[])
 {
        main_test_libpython();
@@ -106,6 +110,7 @@ int main(int argc, char *argv[])
        main_test_backtrace();
        main_test_libnuma();
        main_test_timerfd();
+        main_test_stackprotector_all();
        return 0;
 }
diff --git a/tools/perf/config/feature-checks/test-stackprotector.c b/tools/perf/config/feature-checks/test-stackprotector.c
deleted file mode 100644
index c9f398d87868..000000000000
--- a/tools/perf/config/feature-checks/test-stackprotector.c
+++ /dev/null
@@ -1,6 +0,0 @@
-#include <stdio.h>
-int main(void)
-{
-        return puts("hi");
-}
diff --git a/tools/perf/config/feature-checks/test-volatile-register-var.c b/tools/perf/config/feature-checks/test-volatile-register-var.c
deleted file mode 100644
index c9f398d87868..000000000000
--- a/tools/perf/config/feature-checks/test-volatile-register-var.c
+++ /dev/null
@@ -1,6 +0,0 @@
-#include <stdio.h>
-int main(void)
-{
-        return puts("hi");
-}
diff --git a/tools/perf/config/utilities.mak b/tools/perf/config/utilities.mak
index f168debc5be2..4d985e0f03f5 100644
--- a/tools/perf/config/utilities.mak
+++ b/tools/perf/config/utilities.mak
@@ -178,10 +178,3 @@ endef
 _ge_attempt = $(if $(get-executable),$(get-executable),$(_gea_warn)$(call _gea_err,$(2)))
 _gea_warn = $(warning The path '$(1)' is not executable.)
 _gea_err  = $(if $(1),$(error Please set '$(1)' appropriately))
-ifneq ($(findstring $(MAKEFLAGS),s),s)
-  ifneq ($(V),1)
-    QUIET_CLEAN         = @printf '  CLEAN    %s\n' $1;
-    QUIET_INSTALL       = @printf '  INSTALL  %s\n' $1;
-  endif
-endif
diff --git a/tools/perf/bash_completion b/tools/perf/perf-completion.sh
index 62e157db2e2b..496e2abb5482 100644
--- a/tools/perf/bash_completion
+++ b/tools/perf/perf-completion.sh
@@ -1,4 +1,4 @@
-# perf completion
+# perf bash and zsh completion
 # Taken from git.git's completion script.
 __my_reassemble_comp_words_by_ref()
@@ -89,37 +89,117 @@ __ltrim_colon_completions()
        fi
 }
-type perf &>/dev/null &&
+__perfcomp ()
-_perf()
 {
-        local cur words cword prev cmd
+        COMPREPLY=( $( compgen -W "$1" -- "$2" ) )
+}
-        COMPREPLY=()
+__perfcomp_colon ()
-        _get_comp_words_by_ref -n =: cur words cword prev
+{
+        __perfcomp "$1" "$2"
+        __ltrim_colon_completions $cur
+}
+__perf_main ()
+{
+        local cmd
        cmd=${words[0]}
+        COMPREPLY=()
        # List perf subcommands or long options
        if [ $cword -eq 1 ]; then
                if [[ $cur == --* ]]; then
-                        COMPREPLY=( $( compgen -W '--help --version \
+                        __perfcomp '--help --version \
                        --exec-path --html-path --paginate --no-pager \
-                        --perf-dir --work-tree --debugfs-dir' -- "$cur" ) )
+                        --perf-dir --work-tree --debugfs-dir' -- "$cur"
                else
                        cmds=$($cmd --list-cmds)
-                        COMPREPLY=( $( compgen -W '$cmds' -- "$cur" ) )
+                        __perfcomp "$cmds" "$cur"
                fi
        # List possible events for -e option
        elif [[ $prev == "-e" && "${words[1]}" == @(record|stat|top) ]]; then
                evts=$($cmd list --raw-dump)
-                COMPREPLY=( $( compgen -W '$evts' -- "$cur" ) )
+                __perfcomp_colon "$evts" "$cur"
-                __ltrim_colon_completions $cur
+        # List subcommands for 'perf kvm'
+        elif [[ $prev == "kvm" ]]; then
+                subcmds="top record report diff buildid-list stat"
+                __perfcomp_colon "$subcmds" "$cur"
        # List long option names
        elif [[ $cur == --* ]];  then
                subcmd=${words[1]}
                opts=$($cmd $subcmd --list-opts)
-                COMPREPLY=( $( compgen -W '$opts' -- "$cur" ) )
+                __perfcomp "$opts" "$cur"
        fi
+}
+if [[ -n ${ZSH_VERSION-} ]]; then
+        autoload -U +X compinit && compinit
+        __perfcomp ()
+        {
+                emulate -L zsh
+                local c IFS=$' \t\n'
+                local -a array
+                for c in ${=1}; do
+                        case $c in
+                        --*=*|*.) ;;
+                        *) c="$c " ;;
+                        esac
+                        array[${#array[@]}+1]="$c"
+                done
+                compset -P '*[=:]'
+                compadd -Q -S '' -a -- array && _ret=0
+        }
+        __perfcomp_colon ()
+        {
+                emulate -L zsh
+                local cur_="${2-$cur}"
+                local c IFS=$' \t\n'
+                local -a array
+                if [[ "$cur_" == *:* ]]; then
+                        local colon_word=${cur_%"${cur_##*:}"}
+                fi
+                for c in ${=1}; do
+                        case $c in
+                        --*=*|*.) ;;
+                        *) c="$c " ;;
+                        esac
+                        array[$#array+1]=${c#"$colon_word"}
+                done
+                compset -P '*[=:]'
+                compadd -Q -S '' -a -- array && _ret=0
+        }
+        _perf ()
+        {
+                local _ret=1 cur cword prev
+                cur=${words[CURRENT]}
+                prev=${words[CURRENT-1]}
+                let cword=CURRENT-1
+                emulate ksh -c __perf_main
+                let _ret && _default && _ret=0
+                return _ret
+        }
+        compdef _perf perf
+        return
+fi
+type perf &>/dev/null &&
+_perf()
+{
+        local cur words cword prev
+        _get_comp_words_by_ref -n =: cur words cword prev
+        __perf_main
 } &&
 complete -o bashdefault -o default -o nospace -F _perf perf 2>/dev/null \
diff --git a/tools/perf/perf.c b/tools/perf/perf.c
index 8b38b4e80ec2..431798a4110d 100644
--- a/tools/perf/perf.c
+++ b/tools/perf/perf.c
@@ -13,7 +13,7 @@
 #include "util/quote.h"
 #include "util/run-command.h"
 #include "util/parse-events.h"
-#include <lk/debugfs.h>
+#include <api/fs/debugfs.h>
 #include <pthread.h>
 const char perf_usage_string[] =
diff --git a/tools/perf/perf.h b/tools/perf/perf.h
index b079304bd53d..3c2f213e979d 100644
--- a/tools/perf/perf.h
+++ b/tools/perf/perf.h
@@ -247,13 +247,14 @@ enum perf_call_graph_mode {
        CALLCHAIN_DWARF
 };
-struct perf_record_opts {
+struct record_opts {
        struct target target;
        int          call_graph;
        bool         group;
        bool         inherit_stat;
-        bool         no_delay;
+        bool         no_buffering;
        bool         no_inherit;
+        bool         no_inherit_set;
        bool         no_samples;
        bool         raw_samples;
        bool         sample_address;
@@ -268,6 +269,7 @@ struct perf_record_opts {
        u64          user_interval;
        u16          stack_dump_size;
        bool         sample_transaction;
+        unsigned     initial_delay;
 };
 #endif
diff --git a/tools/perf/tests/attr/test-record-no-inherit b/tools/perf/tests/attr/test-record-no-inherit
index 9079a25cd643..44edcb2edcd5 100644
--- a/tools/perf/tests/attr/test-record-no-inherit
+++ b/tools/perf/tests/attr/test-record-no-inherit
@@ -3,5 +3,5 @@ command = record
 args    = -i kill >/dev/null 2>&1
 [event:base-record]
-sample_type=259
+sample_type=263
 inherit=0
diff --git a/tools/perf/tests/code-reading.c b/tools/perf/tests/code-reading.c
index 85d4919dd623..653a8fe2db95 100644
--- a/tools/perf/tests/code-reading.c
+++ b/tools/perf/tests/code-reading.c
@@ -391,7 +391,7 @@ static int do_test_code_reading(bool try_kcore)
        struct machines machines;
        struct machine *machine;
        struct thread *thread;
-        struct perf_record_opts opts = {
+        struct record_opts opts = {
                .mmap_pages          = UINT_MAX,
                .user_freq           = UINT_MAX,
                .user_interval       = ULLONG_MAX,
@@ -540,14 +540,11 @@ static int do_test_code_reading(bool try_kcore)
                err = TEST_CODE_READING_OK;
 out_err:
        if (evlist) {
-                perf_evlist__munmap(evlist);
-                perf_evlist__close(evlist);
                perf_evlist__delete(evlist);
-        }
+        } else {
-        if (cpus)
                cpu_map__delete(cpus);
-        if (threads)
                thread_map__delete(threads);
+        }
        machines__destroy_kernel_maps(&machines);
        machine__delete_threads(machine);
        machines__exit(&machines);
diff --git a/tools/perf/tests/evsel-roundtrip-name.c b/tools/perf/tests/evsel-roundtrip-name.c
index 0197bda9c461..465cdbc345cf 100644
--- a/tools/perf/tests/evsel-roundtrip-name.c
+++ b/tools/perf/tests/evsel-roundtrip-name.c
@@ -79,7 +79,7 @@ static int __perf_evsel__name_array_test(const char *names[], int nr_names)
        }
        err = 0;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                if (strcmp(perf_evsel__name(evsel), names[evsel->idx])) {
                        --err;
                        pr_debug("%s != %s\n", perf_evsel__name(evsel), names[evsel->idx]);
diff --git a/tools/perf/tests/hists_link.c b/tools/perf/tests/hists_link.c
index 173bf42cc03e..2b6519e0e36f 100644
--- a/tools/perf/tests/hists_link.c
+++ b/tools/perf/tests/hists_link.c
@@ -208,7 +208,7 @@ static int add_hist_entries(struct perf_evlist *evlist, struct machine *machine)
         * However the second evsel also has a collapsed entry for
         * "bash [libc] malloc" so total 9 entries will be in the tree.
         */
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                for (k = 0; k < ARRAY_SIZE(fake_common_samples); k++) {
                        const union perf_event event = {
                                .header = {
@@ -466,7 +466,7 @@ int test__hists_link(void)
        if (err < 0)
                goto out;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                hists__collapse_resort(&evsel->hists, NULL);
                if (verbose > 2)
diff --git a/tools/perf/tests/keep-tracking.c b/tools/perf/tests/keep-tracking.c
index 376c35608534..497957f269d8 100644
--- a/tools/perf/tests/keep-tracking.c
+++ b/tools/perf/tests/keep-tracking.c
@@ -51,7 +51,7 @@ static int find_comm(struct perf_evlist *evlist, const char *comm)
 */
 int test__keep_tracking(void)
 {
-        struct perf_record_opts opts = {
+        struct record_opts opts = {
                .mmap_pages          = UINT_MAX,
                .user_freq           = UINT_MAX,
                .user_interval       = ULLONG_MAX,
@@ -142,14 +142,11 @@ int test__keep_tracking(void)
 out_err:
        if (evlist) {
                perf_evlist__disable(evlist);
-                perf_evlist__munmap(evlist);
-                perf_evlist__close(evlist);
                perf_evlist__delete(evlist);
-        }
+        } else {
-        if (cpus)
                cpu_map__delete(cpus);
-        if (threads)
                thread_map__delete(threads);
+        }
        return err;
 }
diff --git a/tools/perf/tests/make b/tools/perf/tests/make
index 2ca0abf1b2b6..00544b8b644b 100644
--- a/tools/perf/tests/make
+++ b/tools/perf/tests/make
@@ -1,6 +1,16 @@
 PERF := .
 MK   := Makefile
+include config/Makefile.arch
+# FIXME looks like x86 is the only arch running tests ;-)
+# we need some IS_(32/64) flag to make this generic
+ifeq ($(IS_X86_64),1)
+lib = lib64
+else
+lib = lib
+endif
 has = $(shell which $1 2>/dev/null)
 # standard single make variable specified
@@ -106,10 +116,36 @@ test_make_python_perf_so := test -f $(PERF)/python/perf.so
 test_make_perf_o     := test -f $(PERF)/perf.o
 test_make_util_map_o := test -f $(PERF)/util/map.o
-test_make_install       := test -x $$TMP_DEST/bin/perf
+define test_dest_files
-test_make_install_O     := $(test_make_install)
+  for file in $(1); do                          \
-test_make_install_bin   := $(test_make_install)
+    if [ ! -x $$TMP_DEST/$$file ]; then         \
-test_make_install_bin_O := $(test_make_install)
+      echo "  failed to find: $$file";          \
+    fi                                          \
+  done
+endef
+installed_files_bin := bin/perf
+installed_files_bin += etc/bash_completion.d/perf
+installed_files_bin += libexec/perf-core/perf-archive
+installed_files_plugins := $(lib)/traceevent/plugins/plugin_cfg80211.so
+installed_files_plugins += $(lib)/traceevent/plugins/plugin_scsi.so
+installed_files_plugins += $(lib)/traceevent/plugins/plugin_xen.so
+installed_files_plugins += $(lib)/traceevent/plugins/plugin_function.so
+installed_files_plugins += $(lib)/traceevent/plugins/plugin_sched_switch.so
+installed_files_plugins += $(lib)/traceevent/plugins/plugin_mac80211.so
+installed_files_plugins += $(lib)/traceevent/plugins/plugin_kvm.so
+installed_files_plugins += $(lib)/traceevent/plugins/plugin_kmem.so
+installed_files_plugins += $(lib)/traceevent/plugins/plugin_hrtimer.so
+installed_files_plugins += $(lib)/traceevent/plugins/plugin_jbd2.so
+installed_files_all := $(installed_files_bin)
+installed_files_all += $(installed_files_plugins)
+test_make_install       := $(call test_dest_files,$(installed_files_all))
+test_make_install_O     := $(call test_dest_files,$(installed_files_all))
+test_make_install_bin   := $(call test_dest_files,$(installed_files_bin))
+test_make_install_bin_O := $(call test_dest_files,$(installed_files_bin))
 # FIXME nothing gets installed
 test_make_install_man    := test -f $$TMP_DEST/share/man/man1/perf.1
@@ -162,7 +198,7 @@ $(run):
        cmd="cd $(PERF) && make -f $(MK) DESTDIR=$$TMP_DEST $($@)"; \
        echo "- $@: $$cmd" && echo $$cmd > $@ && \
        ( eval $$cmd ) >> $@ 2>&1; \
-        echo "  test: $(call test,$@)"; \
+        echo "  test: $(call test,$@)" >> $@ 2>&1; \
        $(call test,$@) && \
        rm -f $@ \
        rm -rf $$TMP_DEST
@@ -174,16 +210,22 @@ $(run_O):
        cmd="cd $(PERF) && make -f $(MK) O=$$TMP_O DESTDIR=$$TMP_DEST $($(patsubst %_O,%,$@))"; \
        echo "- $@: $$cmd" && echo $$cmd > $@ && \
        ( eval $$cmd ) >> $@ 2>&1 && \
-        echo "  test: $(call test_O,$@)"; \
+        echo "  test: $(call test_O,$@)" >> $@ 2>&1; \
        $(call test_O,$@) && \
        rm -f $@ && \
        rm -rf $$TMP_O \
        rm -rf $$TMP_DEST
-all: $(run) $(run_O)
+tarpkg:
+        @cmd="$(PERF)/tests/perf-targz-src-pkg $(PERF)"; \
+        echo "- $@: $$cmd" && echo $$cmd > $@ && \
+        ( eval $$cmd ) >> $@ 2>&1
+        
+all: $(run) $(run_O) tarpkg
        @echo OK
 out: $(run_O)
        @echo OK
-.PHONY: all $(run) $(run_O) clean
+.PHONY: all $(run) $(run_O) tarpkg clean
diff --git a/tools/perf/tests/mmap-basic.c b/tools/perf/tests/mmap-basic.c
index d64ab79c6d35..142263492f6f 100644
--- a/tools/perf/tests/mmap-basic.c
+++ b/tools/perf/tests/mmap-basic.c
@@ -68,7 +68,7 @@ int test__basic_mmap(void)
                evsels[i] = perf_evsel__newtp("syscalls", name);
                if (evsels[i] == NULL) {
                        pr_debug("perf_evsel__new\n");
-                        goto out_free_evlist;
+                        goto out_delete_evlist;
                }
                evsels[i]->attr.wakeup_events = 1;
@@ -80,7 +80,7 @@ int test__basic_mmap(void)
                        pr_debug("failed to open counter: %s, "
                                 "tweak /proc/sys/kernel/perf_event_paranoid?\n",
                                 strerror(errno));
-                        goto out_close_fd;
+                        goto out_delete_evlist;
                }
                nr_events[i] = 0;
@@ -90,7 +90,7 @@ int test__basic_mmap(void)
        if (perf_evlist__mmap(evlist, 128, true) < 0) {
                pr_debug("failed to mmap events: %d (%s)\n", errno,
                         strerror(errno));
-                goto out_close_fd;
+                goto out_delete_evlist;
        }
        for (i = 0; i < nsyscalls; ++i)
@@ -105,13 +105,13 @@ int test__basic_mmap(void)
                if (event->header.type != PERF_RECORD_SAMPLE) {
                        pr_debug("unexpected %s event\n",
                                 perf_event__name(event->header.type));
-                        goto out_munmap;
+                        goto out_delete_evlist;
                }
                err = perf_evlist__parse_sample(evlist, event, &sample);
                if (err) {
                        pr_err("Can't parse sample, err = %d\n", err);
-                        goto out_munmap;
+                        goto out_delete_evlist;
                }
                err = -1;
@@ -119,30 +119,27 @@ int test__basic_mmap(void)
                if (evsel == NULL) {
                        pr_debug("event with id %" PRIu64
                                 " doesn't map to an evsel\n", sample.id);
-                        goto out_munmap;
+                        goto out_delete_evlist;
                }
                nr_events[evsel->idx]++;
                perf_evlist__mmap_consume(evlist, 0);
        }
        err = 0;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                if (nr_events[evsel->idx] != expected_nr_events[evsel->idx]) {
                        pr_debug("expected %d %s events, got %d\n",
                                 expected_nr_events[evsel->idx],
                                 perf_evsel__name(evsel), nr_events[evsel->idx]);
                        err = -1;
-                        goto out_munmap;
+                        goto out_delete_evlist;
                }
        }
-out_munmap:
+out_delete_evlist:
-        perf_evlist__munmap(evlist);
-out_close_fd:
-        for (i = 0; i < nsyscalls; ++i)
-                perf_evsel__close_fd(evsels[i], 1, threads->nr);
-out_free_evlist:
        perf_evlist__delete(evlist);
+        cpus    = NULL;
+        threads = NULL;
 out_free_cpus:
        cpu_map__delete(cpus);
 out_free_threads:
diff --git a/tools/perf/tests/open-syscall-tp-fields.c b/tools/perf/tests/open-syscall-tp-fields.c
index 41cc0badb74b..c505ef2af245 100644
--- a/tools/perf/tests/open-syscall-tp-fields.c
+++ b/tools/perf/tests/open-syscall-tp-fields.c
@@ -6,15 +6,15 @@
 int test__syscall_open_tp_fields(void)
 {
-        struct perf_record_opts opts = {
+        struct record_opts opts = {
                .target = {
                        .uid = UINT_MAX,
                        .uses_mmap = true,
                },
-                .no_delay   = true,
+                .no_buffering = true,
-                .freq       = 1,
+                .freq         = 1,
-                .mmap_pages = 256,
+                .mmap_pages   = 256,
-                .raw_samples = true,
+                .raw_samples  = true,
        };
        const char *filename = "/etc/passwd";
        int flags = O_RDONLY | O_DIRECTORY;
@@ -48,13 +48,13 @@ int test__syscall_open_tp_fields(void)
        err = perf_evlist__open(evlist);
        if (err < 0) {
                pr_debug("perf_evlist__open: %s\n", strerror(errno));
-                goto out_delete_maps;
+                goto out_delete_evlist;
        }
        err = perf_evlist__mmap(evlist, UINT_MAX, false);
        if (err < 0) {
                pr_debug("perf_evlist__mmap: %s\n", strerror(errno));
-                goto out_close_evlist;
+                goto out_delete_evlist;
        }
        perf_evlist__enable(evlist);
@@ -85,7 +85,7 @@ int test__syscall_open_tp_fields(void)
                                err = perf_evsel__parse_sample(evsel, event, &sample);
                                if (err) {
                                        pr_err("Can't parse sample, err = %d\n", err);
-                                        goto out_munmap;
+                                        goto out_delete_evlist;
                                }
                                tp_flags = perf_evsel__intval(evsel, &sample, "flags");
@@ -93,7 +93,7 @@ int test__syscall_open_tp_fields(void)
                                if (flags != tp_flags) {
                                        pr_debug("%s: Expected flags=%#x, got %#x\n",
                                                 __func__, flags, tp_flags);
-                                        goto out_munmap;
+                                        goto out_delete_evlist;
                                }
                                goto out_ok;
@@ -105,17 +105,11 @@ int test__syscall_open_tp_fields(void)
                if (++nr_polls > 5) {
                        pr_debug("%s: no events!\n", __func__);
-                        goto out_munmap;
+                        goto out_delete_evlist;
                }
        }
 out_ok:
        err = 0;
-out_munmap:
-        perf_evlist__munmap(evlist);
-out_close_evlist:
-        perf_evlist__close(evlist);
-out_delete_maps:
-        perf_evlist__delete_maps(evlist);
 out_delete_evlist:
        perf_evlist__delete(evlist);
 out:
diff --git a/tools/perf/tests/parse-events.c b/tools/perf/tests/parse-events.c
index 3cbd10496087..4db0ae617d70 100644
--- a/tools/perf/tests/parse-events.c
+++ b/tools/perf/tests/parse-events.c
@@ -3,7 +3,7 @@
 #include "evsel.h"
 #include "evlist.h"
 #include "fs.h"
-#include <lk/debugfs.h>
+#include <api/fs/debugfs.h>
 #include "tests.h"
 #include <linux/hw_breakpoint.h>
@@ -30,7 +30,7 @@ static int test__checkevent_tracepoint_multi(struct perf_evlist *evlist)
        TEST_ASSERT_VAL("wrong number of entries", evlist->nr_entries > 1);
        TEST_ASSERT_VAL("wrong number of groups", 0 == evlist->nr_groups);
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                TEST_ASSERT_VAL("wrong type",
                        PERF_TYPE_TRACEPOINT == evsel->attr.type);
                TEST_ASSERT_VAL("wrong sample_type",
@@ -201,7 +201,7 @@ test__checkevent_tracepoint_multi_modifier(struct perf_evlist *evlist)
        TEST_ASSERT_VAL("wrong number of entries", evlist->nr_entries > 1);
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                TEST_ASSERT_VAL("wrong exclude_user",
                                !evsel->attr.exclude_user);
                TEST_ASSERT_VAL("wrong exclude_kernel",
@@ -1385,10 +1385,10 @@ static int test_event(struct evlist_test *e)
        if (ret) {
                pr_debug("failed to parse event '%s', err %d\n",
                         e->name, ret);
-                return ret;
+        } else {
+                ret = e->check(evlist);
        }
+        
-        ret = e->check(evlist);
        perf_evlist__delete(evlist);
        return ret;
diff --git a/tools/perf/tests/perf-record.c b/tools/perf/tests/perf-record.c
index 93a62b06c3af..aca1a83dd13a 100644
--- a/tools/perf/tests/perf-record.c
+++ b/tools/perf/tests/perf-record.c
@@ -34,14 +34,14 @@ realloc:
 int test__PERF_RECORD(void)
 {
-        struct perf_record_opts opts = {
+        struct record_opts opts = {
                .target = {
                        .uid = UINT_MAX,
                        .uses_mmap = true,
                },
-                .no_delay   = true,
+                .no_buffering = true,
-                .freq       = 10,
+                .freq         = 10,
-                .mmap_pages = 256,
+                .mmap_pages   = 256,
        };
        cpu_set_t cpu_mask;
        size_t cpu_mask_size = sizeof(cpu_mask);
@@ -83,11 +83,10 @@ int test__PERF_RECORD(void)
         * so that we have time to open the evlist (calling sys_perf_event_open
         * on all the fds) and then mmap them.
         */
-        err = perf_evlist__prepare_workload(evlist, &opts.target, argv,
+        err = perf_evlist__prepare_workload(evlist, &opts.target, argv, false, NULL);
-                                            false, false);
        if (err < 0) {
                pr_debug("Couldn't run the workload!\n");
-                goto out_delete_maps;
+                goto out_delete_evlist;
        }
        /*
@@ -102,7 +101,7 @@ int test__PERF_RECORD(void)
        err = sched__get_first_possible_cpu(evlist->workload.pid, &cpu_mask);
        if (err < 0) {
                pr_debug("sched__get_first_possible_cpu: %s\n", strerror(errno));
-                goto out_delete_maps;
+                goto out_delete_evlist;
        }
        cpu = err;
@@ -112,7 +111,7 @@ int test__PERF_RECORD(void)
         */
        if (sched_setaffinity(evlist->workload.pid, cpu_mask_size, &cpu_mask) < 0) {
                pr_debug("sched_setaffinity: %s\n", strerror(errno));
-                goto out_delete_maps;
+                goto out_delete_evlist;
        }
        /*
@@ -122,7 +121,7 @@ int test__PERF_RECORD(void)
        err = perf_evlist__open(evlist);
        if (err < 0) {
                pr_debug("perf_evlist__open: %s\n", strerror(errno));
-                goto out_delete_maps;
+                goto out_delete_evlist;
        }
        /*
@@ -133,7 +132,7 @@ int test__PERF_RECORD(void)
        err = perf_evlist__mmap(evlist, opts.mmap_pages, false);
        if (err < 0) {
                pr_debug("perf_evlist__mmap: %s\n", strerror(errno));
-                goto out_close_evlist;
+                goto out_delete_evlist;
        }
        /*
@@ -166,7 +165,7 @@ int test__PERF_RECORD(void)
                                        if (verbose)
                                                perf_event__fprintf(event, stderr);
                                        pr_debug("Couldn't parse sample\n");
-                                        goto out_err;
+                                        goto out_delete_evlist;
                                }
                                if (verbose) {
@@ -303,12 +302,6 @@ found_exit:
                pr_debug("PERF_RECORD_MMAP for %s missing!\n", "[vdso]");
                ++errs;
        }
-out_err:
-        perf_evlist__munmap(evlist);
-out_close_evlist:
-        perf_evlist__close(evlist);
-out_delete_maps:
-        perf_evlist__delete_maps(evlist);
 out_delete_evlist:
        perf_evlist__delete(evlist);
 out:
diff --git a/tools/perf/tests/perf-targz-src-pkg b/tools/perf/tests/perf-targz-src-pkg
new file mode 100755
index 000000000000..238aa3927c71
--- /dev/null
+++ b/tools/perf/tests/perf-targz-src-pkg
@@ -0,0 +1,21 @@
+#!/bin/sh
+# Test one of the main kernel Makefile targets to generate a perf sources tarball
+# suitable for build outside the full kernel sources.
+#
+# This is to test that the tools/perf/MANIFEST file lists all the files needed to
+# be in such tarball, which sometimes gets broken when we move files around,
+# like when we made some files that were in tools/perf/ available to other tools/
+# codebases by moving it to tools/include/, etc.
+PERF=$1
+cd ${PERF}/../..
+make perf-targz-src-pkg > /dev/null
+TARBALL=$(ls -rt perf-*.tar.gz)
+TMP_DEST=$(mktemp -d)
+tar xf ${TARBALL} -C $TMP_DEST
+rm -f ${TARBALL}
+cd - > /dev/null
+make -C $TMP_DEST/perf*/tools/perf > /dev/null 2>&1
+RC=$?
+rm -rf ${TMP_DEST}
+exit $RC
diff --git a/tools/perf/tests/perf-time-to-tsc.c b/tools/perf/tests/perf-time-to-tsc.c
index 4ca1b938f6a6..47146d388dbf 100644
--- a/tools/perf/tests/perf-time-to-tsc.c
+++ b/tools/perf/tests/perf-time-to-tsc.c
@@ -46,7 +46,7 @@ static u64 rdtsc(void)
 */
 int test__perf_time_to_tsc(void)
 {
-        struct perf_record_opts opts = {
+        struct record_opts opts = {
                .mmap_pages          = UINT_MAX,
                .user_freq           = UINT_MAX,
                .user_interval       = ULLONG_MAX,
@@ -166,14 +166,8 @@ next_event:
 out_err:
        if (evlist) {
                perf_evlist__disable(evlist);
-                perf_evlist__munmap(evlist);
-                perf_evlist__close(evlist);
                perf_evlist__delete(evlist);
        }
-        if (cpus)
-                cpu_map__delete(cpus);
-        if (threads)
-                thread_map__delete(threads);
        return err;
 }
diff --git a/tools/perf/tests/sw-clock.c b/tools/perf/tests/sw-clock.c
index 6664a7cd828c..983d6b8562a8 100644
--- a/tools/perf/tests/sw-clock.c
+++ b/tools/perf/tests/sw-clock.c
@@ -45,7 +45,7 @@ static int __test__sw_clock_freq(enum perf_sw_ids clock_id)
        evsel = perf_evsel__new(&attr);
        if (evsel == NULL) {
                pr_debug("perf_evsel__new\n");
-                goto out_free_evlist;
+                goto out_delete_evlist;
        }
        perf_evlist__add(evlist, evsel);
@@ -54,7 +54,7 @@ static int __test__sw_clock_freq(enum perf_sw_ids clock_id)
        if (!evlist->cpus || !evlist->threads) {
                err = -ENOMEM;
                pr_debug("Not enough memory to create thread/cpu maps\n");
-                goto out_delete_maps;
+                goto out_delete_evlist;
        }
        if (perf_evlist__open(evlist)) {
@@ -63,14 +63,14 @@ static int __test__sw_clock_freq(enum perf_sw_ids clock_id)
                err = -errno;
                pr_debug("Couldn't open evlist: %s\nHint: check %s, using %" PRIu64 " in this test.\n",
                         strerror(errno), knob, (u64)attr.sample_freq);
-                goto out_delete_maps;
+                goto out_delete_evlist;
        }
        err = perf_evlist__mmap(evlist, 128, true);
        if (err < 0) {
                pr_debug("failed to mmap event: %d (%s)\n", errno,
                         strerror(errno));
-                goto out_close_evlist;
+                goto out_delete_evlist;
        }
        perf_evlist__enable(evlist);
@@ -90,7 +90,7 @@ static int __test__sw_clock_freq(enum perf_sw_ids clock_id)
                err = perf_evlist__parse_sample(evlist, event, &sample);
                if (err < 0) {
                        pr_debug("Error during parse sample\n");
-                        goto out_unmap_evlist;
+                        goto out_delete_evlist;
                }
                total_periods += sample.period;
@@ -105,13 +105,7 @@ next_event:
                err = -1;
        }
-out_unmap_evlist:
+out_delete_evlist:
-        perf_evlist__munmap(evlist);
-out_close_evlist:
-        perf_evlist__close(evlist);
-out_delete_maps:
-        perf_evlist__delete_maps(evlist);
-out_free_evlist:
        perf_evlist__delete(evlist);
        return err;
 }
diff --git a/tools/perf/tests/task-exit.c b/tools/perf/tests/task-exit.c
index d09ab579119e..5ff3db318f12 100644
--- a/tools/perf/tests/task-exit.c
+++ b/tools/perf/tests/task-exit.c
@@ -9,12 +9,21 @@
 static int exited;
 static int nr_exit;
-static void sig_handler(int sig)
+static void sig_handler(int sig __maybe_unused)
 {
        exited = 1;
+}
-        if (sig == SIGUSR1)
+/*
-                nr_exit = -1;
+ * perf_evlist__prepare_workload will send a SIGUSR1 if the fork fails, since
+ * we asked by setting its exec_error to this handler.
+ */
+static void workload_exec_failed_signal(int signo __maybe_unused,
+                                        siginfo_t *info __maybe_unused,
+                                        void *ucontext __maybe_unused)
+{
+        exited  = 1;
+        nr_exit = -1;
 }
 /*
@@ -35,7 +44,6 @@ int test__task_exit(void)
        const char *argv[] = { "true", NULL };
        signal(SIGCHLD, sig_handler);
-        signal(SIGUSR1, sig_handler);
        evlist = perf_evlist__new_default();
        if (evlist == NULL) {
@@ -54,13 +62,14 @@ int test__task_exit(void)
        if (!evlist->cpus || !evlist->threads) {
                err = -ENOMEM;
                pr_debug("Not enough memory to create thread/cpu maps\n");
-                goto out_delete_maps;
+                goto out_delete_evlist;
        }
-        err = perf_evlist__prepare_workload(evlist, &target, argv, false, true);
+        err = perf_evlist__prepare_workload(evlist, &target, argv, false,
+                                            workload_exec_failed_signal);
        if (err < 0) {
                pr_debug("Couldn't run the workload!\n");
-                goto out_delete_maps;
+                goto out_delete_evlist;
        }
        evsel = perf_evlist__first(evlist);
@@ -74,13 +83,13 @@ int test__task_exit(void)
        err = perf_evlist__open(evlist);
        if (err < 0) {
                pr_debug("Couldn't open the evlist: %s\n", strerror(-err));
-                goto out_delete_maps;
+                goto out_delete_evlist;
        }
        if (perf_evlist__mmap(evlist, 128, true) < 0) {
                pr_debug("failed to mmap events: %d (%s)\n", errno,
                         strerror(errno));
-                goto out_close_evlist;
+                goto out_delete_evlist;
        }
        perf_evlist__start_workload(evlist);
@@ -103,11 +112,7 @@ retry:
                err = -1;
        }
-        perf_evlist__munmap(evlist);
+out_delete_evlist:
-out_close_evlist:
-        perf_evlist__close(evlist);
-out_delete_maps:
-        perf_evlist__delete_maps(evlist);
        perf_evlist__delete(evlist);
        return err;
 }
diff --git a/tools/perf/ui/browser.c b/tools/perf/ui/browser.c
index cbaa7af45513..d11541d4d7d7 100644
--- a/tools/perf/ui/browser.c
+++ b/tools/perf/ui/browser.c
@@ -256,8 +256,7 @@ int ui_browser__show(struct ui_browser *browser, const char *title,
        __ui_browser__show_title(browser, title);
        browser->title = title;
-        free(browser->helpline);
+        zfree(&browser->helpline);
-        browser->helpline = NULL;
        va_start(ap, helpline);
        err = vasprintf(&browser->helpline, helpline, ap);
@@ -268,12 +267,11 @@ int ui_browser__show(struct ui_browser *browser, const char *title,
        return err ? 0 : -1;
 }
-void ui_browser__hide(struct ui_browser *browser __maybe_unused)
+void ui_browser__hide(struct ui_browser *browser)
 {
        pthread_mutex_lock(&ui__lock);
        ui_helpline__pop();
-        free(browser->helpline);
+        zfree(&browser->helpline);
-        browser->helpline = NULL;
        pthread_mutex_unlock(&ui__lock);
 }
diff --git a/tools/perf/ui/browser.h b/tools/perf/ui/browser.h
index 7d45d2f53601..118cca29dd26 100644
--- a/tools/perf/ui/browser.h
+++ b/tools/perf/ui/browser.h
@@ -59,6 +59,8 @@ int ui_browser__help_window(struct ui_browser *browser, const char *text);
 bool ui_browser__dialog_yesno(struct ui_browser *browser, const char *text);
 int ui_browser__input_window(const char *title, const char *text, char *input,
                             const char *exit_msg, int delay_sec);
+struct perf_session_env;
+int tui__header_window(struct perf_session_env *env);
 void ui_browser__argv_seek(struct ui_browser *browser, off_t offset, int whence);
 unsigned int ui_browser__argv_refresh(struct ui_browser *browser);
diff --git a/tools/perf/ui/browsers/header.c b/tools/perf/ui/browsers/header.c
new file mode 100644
index 000000000000..89c16b988618
--- /dev/null
+++ b/tools/perf/ui/browsers/header.c
@@ -0,0 +1,127 @@
+#include "util/cache.h"
+#include "util/debug.h"
+#include "ui/browser.h"
+#include "ui/ui.h"
+#include "ui/util.h"
+#include "ui/libslang.h"
+#include "util/header.h"
+#include "util/session.h"
+static void ui_browser__argv_write(struct ui_browser *browser,
+                                   void *entry, int row)
+{
+        char **arg = entry;
+        char *str = *arg;
+        char empty[] = " ";
+        bool current_entry = ui_browser__is_current_entry(browser, row);
+        unsigned long offset = (unsigned long)browser->priv;
+        if (offset >= strlen(str))
+                str = empty;
+        else
+                str = str + offset;
+        ui_browser__set_color(browser, current_entry ? HE_COLORSET_SELECTED :
+                                                       HE_COLORSET_NORMAL);
+        slsmg_write_nstring(str, browser->width);
+}
+static int list_menu__run(struct ui_browser *menu)
+{
+        int key;
+        unsigned long offset;
+        const char help[] =
+        "h/?/F1        Show this window\n"
+        "UP/DOWN/PGUP\n"
+        "PGDN/SPACE\n"
+        "LEFT/RIGHT    Navigate\n"
+        "q/ESC/CTRL+C  Exit browser";
+        if (ui_browser__show(menu, "Header information", "Press 'q' to exit") < 0)
+                return -1;
+        while (1) {
+                key = ui_browser__run(menu, 0);
+                switch (key) {
+                case K_RIGHT:
+                        offset = (unsigned long)menu->priv;
+                        offset += 10;
+                        menu->priv = (void *)offset;
+                        continue;
+                case K_LEFT:
+                        offset = (unsigned long)menu->priv;
+                        if (offset >= 10)
+                                offset -= 10;
+                        menu->priv = (void *)offset;
+                        continue;
+                case K_F1:
+                case 'h':
+                case '?':
+                        ui_browser__help_window(menu, help);
+                        continue;
+                case K_ESC:
+                case 'q':
+                case CTRL('c'):
+                        key = -1;
+                        break;
+                default:
+                        continue;
+                }
+                break;
+        }
+        ui_browser__hide(menu);
+        return key;
+}
+static int ui__list_menu(int argc, char * const argv[])
+{
+        struct ui_browser menu = {
+                .entries    = (void *)argv,
+                .refresh    = ui_browser__argv_refresh,
+                .seek       = ui_browser__argv_seek,
+                .write      = ui_browser__argv_write,
+                .nr_entries = argc,
+        };
+        return list_menu__run(&menu);
+}
+int tui__header_window(struct perf_session_env *env)
+{
+        int i, argc = 0;
+        char **argv;
+        struct perf_session *session;
+        char *ptr, *pos;
+        size_t size;
+        FILE *fp = open_memstream(&ptr, &size);
+        session = container_of(env, struct perf_session, header.env);
+        perf_header__fprintf_info(session, fp, true);
+        fclose(fp);
+        for (pos = ptr, argc = 0; (pos = strchr(pos, '\n')) != NULL; pos++)
+                argc++;
+        argv = calloc(argc + 1, sizeof(*argv));
+        if (argv == NULL)
+                goto out;
+        argv[0] = pos = ptr;
+        for (i = 1; (pos = strchr(pos, '\n')) != NULL; i++) {
+                *pos++ = '\0';
+                argv[i] = pos;
+        }
+        BUG_ON(i != argc + 1);
+        ui__list_menu(argc, argv);
+out:
+        free(argv);
+        free(ptr);
+        return 0;
+}
diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index a440e03cd8c2..b720b92eba6e 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -1267,10 +1267,8 @@ static inline void free_popup_options(char **options, int n)
 {
        int i;
-        for (i = 0; i < n; ++i) {
+        for (i = 0; i < n; ++i)
-                free(options[i]);
+                zfree(&options[i]);
-                options[i] = NULL;
-        }
 }
 /* Check whether the browser is for 'top' or 'report' */
@@ -1329,7 +1327,7 @@ static int switch_data_file(void)
                        abs_path[nr_options] = strdup(path);
                        if (!abs_path[nr_options]) {
-                                free(options[nr_options]);
+                                zfree(&options[nr_options]);
                                ui__warning("Can't search all data files due to memory shortage.\n");
                                fclose(file);
                                break;
@@ -1400,6 +1398,36 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
        char script_opt[64];
        int delay_secs = hbt ? hbt->refresh : 0;
+#define HIST_BROWSER_HELP_COMMON                                        \
+        "h/?/F1        Show this window\n"                              \
+        "UP/DOWN/PGUP\n"                                                \
+        "PGDN/SPACE    Navigate\n"                                      \
+        "q/ESC/CTRL+C  Exit browser\n\n"                                \
+        "For multiple event sessions:\n\n"                              \
+        "TAB/UNTAB     Switch events\n\n"                               \
+        "For symbolic views (--sort has sym):\n\n"                      \
+        "->            Zoom into DSO/Threads & Annotate current symbol\n" \
+        "<-            Zoom out\n"                                      \
+        "a             Annotate current symbol\n"                       \
+        "C             Collapse all callchains\n"                       \
+        "d             Zoom into current DSO\n"                         \
+        "E             Expand all callchains\n"                         \
+        /* help messages are sorted by lexical order of the hotkey */
+        const char report_help[] = HIST_BROWSER_HELP_COMMON
+        "i             Show header information\n"
+        "P             Print histograms to perf.hist.N\n"
+        "r             Run available scripts\n"
+        "s             Switch to another data file in PWD\n"
+        "t             Zoom into current Thread\n"
+        "V             Verbose (DSO names in callchains, etc)\n"
+        "/             Filter symbol by name";
+        const char top_help[] = HIST_BROWSER_HELP_COMMON
+        "P             Print histograms to perf.hist.N\n"
+        "t             Zoom into current Thread\n"
+        "V             Verbose (DSO names in callchains, etc)\n"
+        "/             Filter symbol by name";
        if (browser == NULL)
                return -1;
@@ -1484,29 +1512,16 @@ static int perf_evsel__hists_browse(struct perf_evsel *evsel, int nr_events,
                        if (is_report_browser(hbt))
                                goto do_data_switch;
                        continue;
+                case 'i':
+                        /* env->arch is NULL for live-mode (i.e. perf top) */
+                        if (env->arch)
+                                tui__header_window(env);
+                        continue;
                case K_F1:
                case 'h':
                case '?':
                        ui_browser__help_window(&browser->b,
-                                        "h/?/F1        Show this window\n"
+                                is_report_browser(hbt) ? report_help : top_help);
-                                        "UP/DOWN/PGUP\n"
-                                        "PGDN/SPACE    Navigate\n"
-                                        "q/ESC/CTRL+C  Exit browser\n\n"
-                                        "For multiple event sessions:\n\n"
-                                        "TAB/UNTAB Switch events\n\n"
-                                        "For symbolic views (--sort has sym):\n\n"
-                                        "->            Zoom into DSO/Threads & Annotate current symbol\n"
-                                        "<-            Zoom out\n"
-                                        "a             Annotate current symbol\n"
-                                        "C             Collapse all callchains\n"
-                                        "E             Expand all callchains\n"
-                                        "d             Zoom into current DSO\n"
-                                        "t             Zoom into current Thread\n"
-                                        "r             Run available scripts('perf report' only)\n"
-                                        "s             Switch to another data file in PWD ('perf report' only)\n"
-                                        "P             Print histograms to perf.hist.N\n"
-                                        "V             Verbose (DSO names in callchains, etc)\n"
-                                        "/             Filter symbol by name");
                        continue;
                case K_ENTER:
                case K_RIGHT:
@@ -1923,7 +1938,7 @@ static int __perf_evlist__tui_browse_hists(struct perf_evlist *evlist,
        ui_helpline__push("Press ESC to exit");
-        list_for_each_entry(pos, &evlist->entries, node) {
+        evlist__for_each(evlist, pos) {
                const char *ev_name = perf_evsel__name(pos);
                size_t line_len = strlen(ev_name) + 7;
@@ -1955,9 +1970,10 @@ single_entry:
                struct perf_evsel *pos;
                nr_entries = 0;
-                list_for_each_entry(pos, &evlist->entries, node)
+                evlist__for_each(evlist, pos) {
                        if (perf_evsel__is_group_leader(pos))
                                nr_entries++;
+                }
                if (nr_entries == 1)
                        goto single_entry;
diff --git a/tools/perf/ui/browsers/scripts.c b/tools/perf/ui/browsers/scripts.c
index d63c68ea02a8..402d2bd30b09 100644
--- a/tools/perf/ui/browsers/scripts.c
+++ b/tools/perf/ui/browsers/scripts.c
@@ -173,8 +173,7 @@ int script_browse(const char *script_opt)
        if (script.b.width > AVERAGE_LINE_LEN)
                script.b.width = AVERAGE_LINE_LEN;
-        if (line)
+        free(line);
-                free(line);
        pclose(fp);
        script.nr_lines = nr_entries;
diff --git a/tools/perf/ui/gtk/hists.c b/tools/perf/ui/gtk/hists.c
index 2ca66cc1160f..5b95c44f3435 100644
--- a/tools/perf/ui/gtk/hists.c
+++ b/tools/perf/ui/gtk/hists.c
@@ -375,7 +375,7 @@ int perf_evlist__gtk_browse_hists(struct perf_evlist *evlist,
        gtk_container_add(GTK_CONTAINER(window), vbox);
-        list_for_each_entry(pos, &evlist->entries, node) {
+        evlist__for_each(evlist, pos) {
                struct hists *hists = &pos->hists;
                const char *evname = perf_evsel__name(pos);
                GtkWidget *scrolled_window;
diff --git a/tools/perf/ui/gtk/util.c b/tools/perf/ui/gtk/util.c
index 696c1fbe4248..52e7fc48af9f 100644
--- a/tools/perf/ui/gtk/util.c
+++ b/tools/perf/ui/gtk/util.c
@@ -23,8 +23,7 @@ int perf_gtk__deactivate_context(struct perf_gtk_context **ctx)
        if (!perf_gtk__is_active_context(*ctx))
                return -1;
-        free(*ctx);
+        zfree(ctx);
-        *ctx = NULL;
        return 0;
 }
diff --git a/tools/perf/ui/stdio/hist.c b/tools/perf/ui/stdio/hist.c
index c244cb524ef2..831fbb77d1ff 100644
--- a/tools/perf/ui/stdio/hist.c
+++ b/tools/perf/ui/stdio/hist.c
@@ -510,7 +510,7 @@ print_entries:
        free(line);
 out:
-        free(rem_sq_bracket);
+        zfree(&rem_sq_bracket);
        return ret;
 }
diff --git a/tools/perf/ui/tui/util.c b/tools/perf/ui/tui/util.c
index 092902e30cee..bf890f72fe80 100644
--- a/tools/perf/ui/tui/util.c
+++ b/tools/perf/ui/tui/util.c
@@ -92,6 +92,8 @@ int ui_browser__input_window(const char *title, const char *text, char *input,
                t = sep + 1;
        }
+        pthread_mutex_lock(&ui__lock);
        max_len += 2;
        nr_lines += 8;
        y = SLtt_Screen_Rows / 2 - nr_lines / 2;
@@ -120,13 +122,19 @@ int ui_browser__input_window(const char *title, const char *text, char *input,
        SLsmg_write_nstring((char *)exit_msg, max_len);
        SLsmg_refresh();
+        pthread_mutex_unlock(&ui__lock);
        x += 2;
        len = 0;
        key = ui__getch(delay_secs);
        while (key != K_TIMER && key != K_ENTER && key != K_ESC) {
+                pthread_mutex_lock(&ui__lock);
                if (key == K_BKSPC) {
-                        if (len == 0)
+                        if (len == 0) {
+                                pthread_mutex_unlock(&ui__lock);
                                goto next_key;
+                        }
                        SLsmg_gotorc(y, x + --len);
                        SLsmg_write_char(' ');
                } else {
@@ -136,6 +144,8 @@ int ui_browser__input_window(const char *title, const char *text, char *input,
                }
                SLsmg_refresh();
+                pthread_mutex_unlock(&ui__lock);
                /* XXX more graceful overflow handling needed */
                if (len == sizeof(buf) - 1) {
                        ui_helpline__push("maximum size of symbol name reached!");
@@ -174,6 +184,8 @@ int ui__question_window(const char *title, const char *text,
                t = sep + 1;
        }
+        pthread_mutex_lock(&ui__lock);
        max_len += 2;
        nr_lines += 4;
        y = SLtt_Screen_Rows / 2 - nr_lines / 2,
@@ -195,6 +207,9 @@ int ui__question_window(const char *title, const char *text,
        SLsmg_gotorc(y + nr_lines - 1, x);
        SLsmg_write_nstring((char *)exit_msg, max_len);
        SLsmg_refresh();
+        pthread_mutex_unlock(&ui__lock);
        return ui__getch(delay_secs);
 }
@@ -215,9 +230,7 @@ static int __ui__warning(const char *title, const char *format, va_list args)
        if (vasprintf(&s, format, args) > 0) {
                int key;
-                pthread_mutex_lock(&ui__lock);
                key = ui__question_window(title, s, "Press any key...", 0);
-                pthread_mutex_unlock(&ui__lock);
                free(s);
                return key;
        }
diff --git a/tools/perf/util/alias.c b/tools/perf/util/alias.c
index e6d134773d0a..c0b43ee40d95 100644
--- a/tools/perf/util/alias.c
+++ b/tools/perf/util/alias.c
@@ -55,8 +55,7 @@ int split_cmdline(char *cmdline, const char ***argv)
                                src++;
                                c = cmdline[src];
                                if (!c) {
-                                        free(*argv);
+                                        zfree(argv);
-                                        *argv = NULL;
                                        return error("cmdline ends with \\");
                                }
                        }
@@ -68,8 +67,7 @@ int split_cmdline(char *cmdline, const char ***argv)
        cmdline[dst] = 0;
        if (quoted) {
-                free(*argv);
+                zfree(argv);
-                *argv = NULL;
                return error("unclosed quote");
        }
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index cf6242c92ee2..469eb679fb9d 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -26,10 +26,10 @@ static int disasm_line__parse(char *line, char **namep, char **rawp);
 static void ins__delete(struct ins_operands *ops)
 {
-        free(ops->source.raw);
+        zfree(&ops->source.raw);
-        free(ops->source.name);
+        zfree(&ops->source.name);
-        free(ops->target.raw);
+        zfree(&ops->target.raw);
-        free(ops->target.name);
+        zfree(&ops->target.name);
 }
 static int ins__raw_scnprintf(struct ins *ins, char *bf, size_t size,
@@ -185,8 +185,7 @@ static int lock__parse(struct ins_operands *ops)
        return 0;
 out_free_ops:
-        free(ops->locked.ops);
+        zfree(&ops->locked.ops);
-        ops->locked.ops = NULL;
        return 0;
 }
@@ -205,9 +204,9 @@ static int lock__scnprintf(struct ins *ins, char *bf, size_t size,
 static void lock__delete(struct ins_operands *ops)
 {
-        free(ops->locked.ops);
+        zfree(&ops->locked.ops);
-        free(ops->target.raw);
+        zfree(&ops->target.raw);
-        free(ops->target.name);
+        zfree(&ops->target.name);
 }
 static struct ins_ops lock_ops = {
@@ -256,8 +255,7 @@ static int mov__parse(struct ins_operands *ops)
        return 0;
 out_free_source:
-        free(ops->source.raw);
+        zfree(&ops->source.raw);
-        ops->source.raw = NULL;
        return -1;
 }
@@ -464,17 +462,12 @@ void symbol__annotate_zero_histograms(struct symbol *sym)
        pthread_mutex_unlock(&notes->lock);
 }
-int symbol__inc_addr_samples(struct symbol *sym, struct map *map,
+static int __symbol__inc_addr_samples(struct symbol *sym, struct map *map,
-                             int evidx, u64 addr)
+                                      struct annotation *notes, int evidx, u64 addr)
 {
        unsigned offset;
-        struct annotation *notes;
        struct sym_hist *h;
-        notes = symbol__annotation(sym);
-        if (notes->src == NULL)
-                return -ENOMEM;
        pr_debug3("%s: addr=%#" PRIx64 "\n", __func__, map->unmap_ip(map, addr));
        if (addr < sym->start || addr > sym->end)
@@ -491,6 +484,33 @@ int symbol__inc_addr_samples(struct symbol *sym, struct map *map,
        return 0;
 }
+static int symbol__inc_addr_samples(struct symbol *sym, struct map *map,
+                                    int evidx, u64 addr)
+{
+        struct annotation *notes;
+        if (sym == NULL || use_browser != 1 || !sort__has_sym)
+                return 0;
+        notes = symbol__annotation(sym);
+        if (notes->src == NULL) {
+                if (symbol__alloc_hist(sym) < 0)
+                        return -ENOMEM;
+        }
+        return __symbol__inc_addr_samples(sym, map, notes, evidx, addr);
+}
+int addr_map_symbol__inc_samples(struct addr_map_symbol *ams, int evidx)
+{
+        return symbol__inc_addr_samples(ams->sym, ams->map, evidx, ams->al_addr);
+}
+int hist_entry__inc_addr_samples(struct hist_entry *he, int evidx, u64 ip)
+{
+        return symbol__inc_addr_samples(he->ms.sym, he->ms.map, evidx, ip);
+}
 static void disasm_line__init_ins(struct disasm_line *dl)
 {
        dl->ins = ins__find(dl->name);
@@ -538,8 +558,7 @@ static int disasm_line__parse(char *line, char **namep, char **rawp)
        return 0;
 out_free_name:
-        free(*namep);
+        zfree(namep);
-        *namep = NULL;
        return -1;
 }
@@ -564,7 +583,7 @@ static struct disasm_line *disasm_line__new(s64 offset, char *line, size_t privs
        return dl;
 out_free_line:
-        free(dl->line);
+        zfree(&dl->line);
 out_delete:
        free(dl);
        return NULL;
@@ -572,8 +591,8 @@ out_delete:
 void disasm_line__free(struct disasm_line *dl)
 {
-        free(dl->line);
+        zfree(&dl->line);
-        free(dl->name);
+        zfree(&dl->name);
        if (dl->ins && dl->ins->ops->free)
                dl->ins->ops->free(&dl->ops);
        else
@@ -900,7 +919,7 @@ fallback:
                 * cache, or is just a kallsyms file, well, lets hope that this
                 * DSO is the same as when 'perf record' ran.
                 */
-                filename = dso->long_name;
+                filename = (char *)dso->long_name;
                snprintf(symfs_filename, sizeof(symfs_filename), "%s%s",
                         symbol_conf.symfs, filename);
                free_filename = false;
@@ -1091,8 +1110,7 @@ static void symbol__free_source_line(struct symbol *sym, int len)
                src_line = (void *)src_line + sizeof_src_line;
        }
-        free(notes->src->lines);
+        zfree(&notes->src->lines);
-        notes->src->lines = NULL;
 }
 /* Get the filename:line for the colored entries */
@@ -1376,3 +1394,8 @@ int symbol__tty_annotate(struct symbol *sym, struct map *map,
        return 0;
 }
+int hist_entry__annotate(struct hist_entry *he, size_t privsize)
+{
+        return symbol__annotate(he->ms.sym, he->ms.map, privsize);
+}
diff --git a/tools/perf/util/annotate.h b/tools/perf/util/annotate.h
index 834b7b57b788..b2aef59d6bb2 100644
--- a/tools/perf/util/annotate.h
+++ b/tools/perf/util/annotate.h
@@ -132,12 +132,17 @@ static inline struct annotation *symbol__annotation(struct symbol *sym)
        return &a->annotation;
 }
-int symbol__inc_addr_samples(struct symbol *sym, struct map *map,
+int addr_map_symbol__inc_samples(struct addr_map_symbol *ams, int evidx);
-                             int evidx, u64 addr);
+int hist_entry__inc_addr_samples(struct hist_entry *he, int evidx, u64 addr);
 int symbol__alloc_hist(struct symbol *sym);
 void symbol__annotate_zero_histograms(struct symbol *sym);
 int symbol__annotate(struct symbol *sym, struct map *map, size_t privsize);
+int hist_entry__annotate(struct hist_entry *he, size_t privsize);
 int symbol__annotate_init(struct map *map __maybe_unused, struct symbol *sym);
 int symbol__annotate_printf(struct symbol *sym, struct map *map,
                            struct perf_evsel *evsel, bool full_paths,
diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c
index a92770c98cc7..6baabe63182b 100644
--- a/tools/perf/util/build-id.c
+++ b/tools/perf/util/build-id.c
@@ -89,7 +89,7 @@ int build_id__sprintf(const u8 *build_id, int len, char *bf)
        return raw - build_id;
 }
-char *dso__build_id_filename(struct dso *dso, char *bf, size_t size)
+char *dso__build_id_filename(const struct dso *dso, char *bf, size_t size)
 {
        char build_id_hex[BUILD_ID_SIZE * 2 + 1];
diff --git a/tools/perf/util/build-id.h b/tools/perf/util/build-id.h
index 929f28a7c14d..845ef865eced 100644
--- a/tools/perf/util/build-id.h
+++ b/tools/perf/util/build-id.h
@@ -10,7 +10,7 @@ extern struct perf_tool build_id__mark_dso_hit_ops;
 struct dso;
 int build_id__sprintf(const u8 *build_id, int len, char *bf);
-char *dso__build_id_filename(struct dso *dso, char *bf, size_t size);
+char *dso__build_id_filename(const struct dso *dso, char *bf, size_t size);
 int build_id__mark_dso_hit(struct perf_tool *tool, union perf_event *event,
                           struct perf_sample *sample, struct perf_evsel *evsel,
diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c
index e3970e3eaacf..8d9db454f1a9 100644
--- a/tools/perf/util/callchain.c
+++ b/tools/perf/util/callchain.c
@@ -15,8 +15,12 @@
 #include <errno.h>
 #include <math.h>
+#include "asm/bug.h"
 #include "hist.h"
 #include "util.h"
+#include "sort.h"
+#include "machine.h"
 #include "callchain.h"
 __thread struct callchain_cursor callchain_cursor;
@@ -356,19 +360,14 @@ append_chain_children(struct callchain_node *root,
        /* lookup in childrens */
        while (*p) {
                s64 ret;
-                struct callchain_list *cnode;
                parent = *p;
                rnode = rb_entry(parent, struct callchain_node, rb_node_in);
-                cnode = list_first_entry(&rnode->val, struct callchain_list,
-                                         list);
-                /* just check first entry */
+                /* If at least first entry matches, rely to children */
-                ret = match_chain(node, cnode);
+                ret = append_chain(rnode, cursor, period);
-                if (ret == 0) {
+                if (ret == 0)
-                        append_chain(rnode, cursor, period);
                        goto inc_children_hit;
-                }
                if (ret < 0)
                        p = &parent->rb_left;
@@ -389,11 +388,11 @@ append_chain(struct callchain_node *root,
             struct callchain_cursor *cursor,
             u64 period)
 {
-        struct callchain_cursor_node *curr_snap = cursor->curr;
        struct callchain_list *cnode;
        u64 start = cursor->pos;
        bool found = false;
        u64 matches;
+        int cmp = 0;
        /*
         * Lookup in the current node
@@ -408,7 +407,8 @@ append_chain(struct callchain_node *root,
                if (!node)
                        break;
-                if (match_chain(node, cnode) != 0)
+                cmp = match_chain(node, cnode);
+                if (cmp)
                        break;
                found = true;
@@ -418,9 +418,8 @@ append_chain(struct callchain_node *root,
        /* matches not, relay no the parent */
        if (!found) {
-                cursor->curr = curr_snap;
+                WARN_ONCE(!cmp, "Chain comparison error\n");
-                cursor->pos = start;
+                return cmp;
-                return -1;
        }
        matches = cursor->pos - start;
@@ -531,3 +530,24 @@ int callchain_cursor_append(struct callchain_cursor *cursor,
        return 0;
 }
+int sample__resolve_callchain(struct perf_sample *sample, struct symbol **parent,
+                              struct perf_evsel *evsel, struct addr_location *al,
+                              int max_stack)
+{
+        if (sample->callchain == NULL)
+                return 0;
+        if (symbol_conf.use_callchain || sort__has_parent) {
+                return machine__resolve_callchain(al->machine, evsel, al->thread,
+                                                  sample, parent, al, max_stack);
+        }
+        return 0;
+}
+int hist_entry__append_callchain(struct hist_entry *he, struct perf_sample *sample)
+{
+        if (!symbol_conf.use_callchain)
+                return 0;
+        return callchain_append(he->callchain, &callchain_cursor, sample->period);
+}
diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h
index 4f7f989876ec..8ad97e9b119f 100644
--- a/tools/perf/util/callchain.h
+++ b/tools/perf/util/callchain.h
@@ -145,10 +145,16 @@ static inline void callchain_cursor_advance(struct callchain_cursor *cursor)
 }
 struct option;
+struct hist_entry;
-int record_parse_callchain(const char *arg, struct perf_record_opts *opts);
+int record_parse_callchain(const char *arg, struct record_opts *opts);
 int record_parse_callchain_opt(const struct option *opt, const char *arg, int unset);
 int record_callchain_opt(const struct option *opt, const char *arg, int unset);
+int sample__resolve_callchain(struct perf_sample *sample, struct symbol **parent,
+                              struct perf_evsel *evsel, struct addr_location *al,
+                              int max_stack);
+int hist_entry__append_callchain(struct hist_entry *he, struct perf_sample *sample);
 extern const char record_callchain_help[];
 #endif  /* __PERF_CALLCHAIN_H */
diff --git a/tools/perf/util/cgroup.c b/tools/perf/util/cgroup.c
index 96bbda1ddb83..88f7be399432 100644
--- a/tools/perf/util/cgroup.c
+++ b/tools/perf/util/cgroup.c
@@ -81,7 +81,7 @@ static int add_cgroup(struct perf_evlist *evlist, char *str)
        /*
         * check if cgrp is already defined, if so we reuse it
         */
-        list_for_each_entry(counter, &evlist->entries, node) {
+        evlist__for_each(evlist, counter) {
                cgrp = counter->cgrp;
                if (!cgrp)
                        continue;
@@ -110,7 +110,7 @@ static int add_cgroup(struct perf_evlist *evlist, char *str)
         * if add cgroup N, then need to find event N
         */
        n = 0;
-        list_for_each_entry(counter, &evlist->entries, node) {
+        evlist__for_each(evlist, counter) {
                if (n == nr_cgroups)
                        goto found;
                n++;
@@ -133,7 +133,7 @@ void close_cgroup(struct cgroup_sel *cgrp)
        /* XXX: not reentrant */
        if (--cgrp->refcnt == 0) {
                close(cgrp->fd);
-                free(cgrp->name);
+                zfree(&cgrp->name);
                free(cgrp);
        }
 }
diff --git a/tools/perf/util/color.c b/tools/perf/util/color.c
index 66e44a5019d5..87b8672eb413 100644
--- a/tools/perf/util/color.c
+++ b/tools/perf/util/color.c
@@ -1,6 +1,7 @@
 #include <linux/kernel.h>
 #include "cache.h"
 #include "color.h"
+#include <math.h>
 int perf_use_color_default = -1;
@@ -298,10 +299,10 @@ const char *get_percent_color(double percent)
         * entries in green - and keep the low overhead places
         * normal:
         */
-        if (percent >= MIN_RED)
+        if (fabs(percent) >= MIN_RED)
                color = PERF_COLOR_RED;
        else {
-                if (percent > MIN_GREEN)
+                if (fabs(percent) > MIN_GREEN)
                        color = PERF_COLOR_GREEN;
        }
        return color;
@@ -318,15 +319,19 @@ int percent_color_fprintf(FILE *fp, const char *fmt, double percent)
        return r;
 }
+int value_color_snprintf(char *bf, size_t size, const char *fmt, double value)
+{
+        const char *color = get_percent_color(value);
+        return color_snprintf(bf, size, color, fmt, value);
+}
 int percent_color_snprintf(char *bf, size_t size, const char *fmt, ...)
 {
        va_list args;
        double percent;
-        const char *color;
        va_start(args, fmt);
        percent = va_arg(args, double);
        va_end(args);
-        color = get_percent_color(percent);
+        return value_color_snprintf(bf, size, fmt, percent);
-        return color_snprintf(bf, size, color, fmt, percent);
 }
diff --git a/tools/perf/util/color.h b/tools/perf/util/color.h
index fced3840e99c..7ff30a62a132 100644
--- a/tools/perf/util/color.h
+++ b/tools/perf/util/color.h
@@ -39,6 +39,7 @@ int color_fprintf(FILE *fp, const char *color, const char *fmt, ...);
 int color_snprintf(char *bf, size_t size, const char *color, const char *fmt, ...);
 int color_fprintf_ln(FILE *fp, const char *color, const char *fmt, ...);
 int color_fwrite_lines(FILE *fp, const char *color, size_t count, const char *buf);
+int value_color_snprintf(char *bf, size_t size, const char *fmt, double value);
 int percent_color_snprintf(char *bf, size_t size, const char *fmt, ...);
 int percent_color_fprintf(FILE *fp, const char *fmt, double percent);
 const char *get_percent_color(double percent);
diff --git a/tools/perf/util/comm.c b/tools/perf/util/comm.c
index ee0df0e24cdb..f9e777629e21 100644
--- a/tools/perf/util/comm.c
+++ b/tools/perf/util/comm.c
@@ -21,7 +21,7 @@ static void comm_str__put(struct comm_str *cs)
 {
        if (!--cs->ref) {
                rb_erase(&cs->rb_node, &comm_str_root);
-                free(cs->str);
+                zfree(&cs->str);
                free(cs);
        }
 }
@@ -94,19 +94,20 @@ struct comm *comm__new(const char *str, u64 timestamp)
        return comm;
 }
-void comm__override(struct comm *comm, const char *str, u64 timestamp)
+int comm__override(struct comm *comm, const char *str, u64 timestamp)
 {
-        struct comm_str *old = comm->comm_str;
+        struct comm_str *new, *old = comm->comm_str;
-        comm->comm_str = comm_str__findnew(str, &comm_str_root);
+        new = comm_str__findnew(str, &comm_str_root);
-        if (!comm->comm_str) {
+        if (!new)
-                comm->comm_str = old;
+                return -ENOMEM;
-                return;
-        }
-        comm->start = timestamp;
+        comm_str__get(new);
-        comm_str__get(comm->comm_str);
        comm_str__put(old);
+        comm->comm_str = new;
+        comm->start = timestamp;
+        return 0;
 }
 void comm__free(struct comm *comm)
diff --git a/tools/perf/util/comm.h b/tools/perf/util/comm.h
index 7a86e5656710..fac5bd51befc 100644
--- a/tools/perf/util/comm.h
+++ b/tools/perf/util/comm.h
@@ -16,6 +16,6 @@ struct comm {
 void comm__free(struct comm *comm);
 struct comm *comm__new(const char *str, u64 timestamp);
 const char *comm__str(const struct comm *comm);
-void comm__override(struct comm *comm, const char *str, u64 timestamp);
+int comm__override(struct comm *comm, const char *str, u64 timestamp);
 #endif  /* __PERF_COMM_H */
diff --git a/tools/perf/util/data.c b/tools/perf/util/data.c
index 7d09faf85cf1..1fbcd8bdc11b 100644
--- a/tools/perf/util/data.c
+++ b/tools/perf/util/data.c
@@ -118,3 +118,9 @@ void perf_data_file__close(struct perf_data_file *file)
 {
        close(file->fd);
 }
+ssize_t perf_data_file__write(struct perf_data_file *file,
+                              void *buf, size_t size)
+{
+        return writen(file->fd, buf, size);
+}
diff --git a/tools/perf/util/data.h b/tools/perf/util/data.h
index 8c2df80152a5..2b15d0c95c7f 100644
--- a/tools/perf/util/data.h
+++ b/tools/perf/util/data.h
@@ -9,12 +9,12 @@ enum perf_data_mode {
 };
 struct perf_data_file {
-        const char *path;
+        const char              *path;
-        int fd;
+        int                      fd;
-        bool is_pipe;
+        bool                     is_pipe;
-        bool force;
+        bool                     force;
-        unsigned long size;
+        unsigned long            size;
-        enum perf_data_mode mode;
+        enum perf_data_mode      mode;
 };
 static inline bool perf_data_file__is_read(struct perf_data_file *file)
@@ -44,5 +44,7 @@ static inline unsigned long perf_data_file__size(struct perf_data_file *file)
 int perf_data_file__open(struct perf_data_file *file);
 void perf_data_file__close(struct perf_data_file *file);
+ssize_t perf_data_file__write(struct perf_data_file *file,
+                              void *buf, size_t size);
 #endif /* __PERF_DATA_H */
diff --git a/tools/perf/util/debug.c b/tools/perf/util/debug.c
index 399e74c34c1a..299b55586502 100644
--- a/tools/perf/util/debug.c
+++ b/tools/perf/util/debug.c
@@ -16,23 +16,46 @@
 int verbose;
 bool dump_trace = false, quiet = false;
-int eprintf(int level, const char *fmt, ...)
+static int _eprintf(int level, const char *fmt, va_list args)
 {
-        va_list args;
        int ret = 0;
        if (verbose >= level) {
-                va_start(args, fmt);
                if (use_browser >= 1)
                        ui_helpline__vshow(fmt, args);
                else
                        ret = vfprintf(stderr, fmt, args);
-                va_end(args);
        }
        return ret;
 }
+int eprintf(int level, const char *fmt, ...)
+{
+        va_list args;
+        int ret;
+        va_start(args, fmt);
+        ret = _eprintf(level, fmt, args);
+        va_end(args);
+        return ret;
+}
+/*
+ * Overloading libtraceevent standard info print
+ * function, display with -v in perf.
+ */
+void pr_stat(const char *fmt, ...)
+{
+        va_list args;
+        va_start(args, fmt);
+        _eprintf(1, fmt, args);
+        va_end(args);
+        eprintf(1, "\n");
+}
 int dump_printf(const char *fmt, ...)
 {
        va_list args;
diff --git a/tools/perf/util/debug.h b/tools/perf/util/debug.h
index efbd98805ad0..443694c36b03 100644
--- a/tools/perf/util/debug.h
+++ b/tools/perf/util/debug.h
@@ -17,4 +17,6 @@ void trace_event(union perf_event *event);
 int ui__error(const char *format, ...) __attribute__((format(printf, 1, 2)));
 int ui__warning(const char *format, ...) __attribute__((format(printf, 1, 2)));
+void pr_stat(const char *fmt, ...);
 #endif  /* __PERF_DEBUG_H */
diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index af4c687cc49b..4045d086d9d9 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -28,8 +28,9 @@ char dso__symtab_origin(const struct dso *dso)
        return origin[dso->symtab_type];
 }
-int dso__binary_type_file(struct dso *dso, enum dso_binary_type type,
+int dso__read_binary_type_filename(const struct dso *dso,
-                          char *root_dir, char *file, size_t size)
+                                   enum dso_binary_type type,
+                                   char *root_dir, char *filename, size_t size)
 {
        char build_id_hex[BUILD_ID_SIZE * 2 + 1];
        int ret = 0;
@@ -38,36 +39,36 @@ int dso__binary_type_file(struct dso *dso, enum dso_binary_type type,
        case DSO_BINARY_TYPE__DEBUGLINK: {
                char *debuglink;
-                strncpy(file, dso->long_name, size);
+                strncpy(filename, dso->long_name, size);
-                debuglink = file + dso->long_name_len;
+                debuglink = filename + dso->long_name_len;
-                while (debuglink != file && *debuglink != '/')
+                while (debuglink != filename && *debuglink != '/')
                        debuglink--;
                if (*debuglink == '/')
                        debuglink++;
                filename__read_debuglink(dso->long_name, debuglink,
-                                         size - (debuglink - file));
+                                         size - (debuglink - filename));
                }
                break;
        case DSO_BINARY_TYPE__BUILD_ID_CACHE:
                /* skip the locally configured cache if a symfs is given */
                if (symbol_conf.symfs[0] ||
-                    (dso__build_id_filename(dso, file, size) == NULL))
+                    (dso__build_id_filename(dso, filename, size) == NULL))
                        ret = -1;
                break;
        case DSO_BINARY_TYPE__FEDORA_DEBUGINFO:
-                snprintf(file, size, "%s/usr/lib/debug%s.debug",
+                snprintf(filename, size, "%s/usr/lib/debug%s.debug",
                         symbol_conf.symfs, dso->long_name);
                break;
        case DSO_BINARY_TYPE__UBUNTU_DEBUGINFO:
-                snprintf(file, size, "%s/usr/lib/debug%s",
+                snprintf(filename, size, "%s/usr/lib/debug%s",
                         symbol_conf.symfs, dso->long_name);
                break;
        case DSO_BINARY_TYPE__OPENEMBEDDED_DEBUGINFO:
        {
-                char *last_slash;
+                const char *last_slash;
                size_t len;
                size_t dir_size;
@@ -75,14 +76,14 @@ int dso__binary_type_file(struct dso *dso, enum dso_binary_type type,
                while (last_slash != dso->long_name && *last_slash != '/')
                        last_slash--;
-                len = scnprintf(file, size, "%s", symbol_conf.symfs);
+                len = scnprintf(filename, size, "%s", symbol_conf.symfs);
                dir_size = last_slash - dso->long_name + 2;
                if (dir_size > (size - len)) {
                        ret = -1;
                        break;
                }
-                len += scnprintf(file + len, dir_size, "%s",  dso->long_name);
+                len += scnprintf(filename + len, dir_size, "%s",  dso->long_name);
-                len += scnprintf(file + len , size - len, ".debug%s",
+                len += scnprintf(filename + len , size - len, ".debug%s",
                                                                last_slash);
                break;
        }
@@ -96,7 +97,7 @@ int dso__binary_type_file(struct dso *dso, enum dso_binary_type type,
                build_id__sprintf(dso->build_id,
                                  sizeof(dso->build_id),
                                  build_id_hex);
-                snprintf(file, size,
+                snprintf(filename, size,
                         "%s/usr/lib/debug/.build-id/%.2s/%s.debug",
                         symbol_conf.symfs, build_id_hex, build_id_hex + 2);
                break;
@@ -104,23 +105,23 @@ int dso__binary_type_file(struct dso *dso, enum dso_binary_type type,
        case DSO_BINARY_TYPE__VMLINUX:
        case DSO_BINARY_TYPE__GUEST_VMLINUX:
        case DSO_BINARY_TYPE__SYSTEM_PATH_DSO:
-                snprintf(file, size, "%s%s",
+                snprintf(filename, size, "%s%s",
                         symbol_conf.symfs, dso->long_name);
                break;
        case DSO_BINARY_TYPE__GUEST_KMODULE:
-                snprintf(file, size, "%s%s%s", symbol_conf.symfs,
+                snprintf(filename, size, "%s%s%s", symbol_conf.symfs,
                         root_dir, dso->long_name);
                break;
        case DSO_BINARY_TYPE__SYSTEM_PATH_KMODULE:
-                snprintf(file, size, "%s%s", symbol_conf.symfs,
+                snprintf(filename, size, "%s%s", symbol_conf.symfs,
                         dso->long_name);
                break;
        case DSO_BINARY_TYPE__KCORE:
        case DSO_BINARY_TYPE__GUEST_KCORE:
-                snprintf(file, size, "%s", dso->long_name);
+                snprintf(filename, size, "%s", dso->long_name);
                break;
        default:
@@ -137,19 +138,18 @@ int dso__binary_type_file(struct dso *dso, enum dso_binary_type type,
 static int open_dso(struct dso *dso, struct machine *machine)
 {
-        char *root_dir = (char *) "";
-        char *name;
        int fd;
+        char *root_dir = (char *)"";
+        char *name = malloc(PATH_MAX);
-        name = malloc(PATH_MAX);
        if (!name)
                return -ENOMEM;
        if (machine)
                root_dir = machine->root_dir;
-        if (dso__binary_type_file(dso, dso->data_type,
+        if (dso__read_binary_type_filename(dso, dso->binary_type,
-                                  root_dir, name, PATH_MAX)) {
+                                            root_dir, name, PATH_MAX)) {
                free(name);
                return -EINVAL;
        }
@@ -161,26 +161,26 @@ static int open_dso(struct dso *dso, struct machine *machine)
 int dso__data_fd(struct dso *dso, struct machine *machine)
 {
-        static enum dso_binary_type binary_type_data[] = {
+        enum dso_binary_type binary_type_data[] = {
                DSO_BINARY_TYPE__BUILD_ID_CACHE,
                DSO_BINARY_TYPE__SYSTEM_PATH_DSO,
                DSO_BINARY_TYPE__NOT_FOUND,
        };
        int i = 0;
-        if (dso->data_type != DSO_BINARY_TYPE__NOT_FOUND)
+        if (dso->binary_type != DSO_BINARY_TYPE__NOT_FOUND)
                return open_dso(dso, machine);
        do {
                int fd;
-                dso->data_type = binary_type_data[i++];
+                dso->binary_type = binary_type_data[i++];
                fd = open_dso(dso, machine);
                if (fd >= 0)
                        return fd;
-        } while (dso->data_type != DSO_BINARY_TYPE__NOT_FOUND);
+        } while (dso->binary_type != DSO_BINARY_TYPE__NOT_FOUND);
        return -EINVAL;
 }
@@ -200,11 +200,10 @@ dso_cache__free(struct rb_root *root)
        }
 }
-static struct dso_cache*
+static struct dso_cache *dso_cache__find(const struct rb_root *root, u64 offset)
-dso_cache__find(struct rb_root *root, u64 offset)
 {
-        struct rb_node **p = &root->rb_node;
+        struct rb_node * const *p = &root->rb_node;
-        struct rb_node *parent = NULL;
+        const struct rb_node *parent = NULL;
        struct dso_cache *cache;
        while (*p != NULL) {
@@ -379,32 +378,63 @@ struct dso *dso__kernel_findnew(struct machine *machine, const char *name,
         * processing we had no idea this was the kernel dso.
         */
        if (dso != NULL) {
-                dso__set_short_name(dso, short_name);
+                dso__set_short_name(dso, short_name, false);
                dso->kernel = dso_type;
        }
        return dso;
 }
-void dso__set_long_name(struct dso *dso, char *name)
+void dso__set_long_name(struct dso *dso, const char *name, bool name_allocated)
 {
        if (name == NULL)
                return;
-        dso->long_name = name;
-        dso->long_name_len = strlen(name);
+        if (dso->long_name_allocated)
+                free((char *)dso->long_name);
+        dso->long_name           = name;
+        dso->long_name_len       = strlen(name);
+        dso->long_name_allocated = name_allocated;
 }
-void dso__set_short_name(struct dso *dso, const char *name)
+void dso__set_short_name(struct dso *dso, const char *name, bool name_allocated)
 {
        if (name == NULL)
                return;
-        dso->short_name = name;
-        dso->short_name_len = strlen(name);
+        if (dso->short_name_allocated)
+                free((char *)dso->short_name);
+        dso->short_name           = name;
+        dso->short_name_len       = strlen(name);
+        dso->short_name_allocated = name_allocated;
 }
 static void dso__set_basename(struct dso *dso)
 {
-        dso__set_short_name(dso, basename(dso->long_name));
+       /*
+        * basename() may modify path buffer, so we must pass
+        * a copy.
+        */
+       char *base, *lname = strdup(dso->long_name);
+       if (!lname)
+               return;
+       /*
+        * basename() may return a pointer to internal
+        * storage which is reused in subsequent calls
+        * so copy the result.
+        */
+       base = strdup(basename(lname));
+       free(lname);
+       if (!base)
+               return;
+       dso__set_short_name(dso, base, true);
 }
 int dso__name_len(const struct dso *dso)
@@ -439,18 +469,19 @@ struct dso *dso__new(const char *name)
        if (dso != NULL) {
                int i;
                strcpy(dso->name, name);
-                dso__set_long_name(dso, dso->name);
+                dso__set_long_name(dso, dso->name, false);
-                dso__set_short_name(dso, dso->name);
+                dso__set_short_name(dso, dso->name, false);
                for (i = 0; i < MAP__NR_TYPES; ++i)
                        dso->symbols[i] = dso->symbol_names[i] = RB_ROOT;
                dso->cache = RB_ROOT;
                dso->symtab_type = DSO_BINARY_TYPE__NOT_FOUND;
-                dso->data_type   = DSO_BINARY_TYPE__NOT_FOUND;
+                dso->binary_type = DSO_BINARY_TYPE__NOT_FOUND;
                dso->loaded = 0;
                dso->rel = 0;
                dso->sorted_by_name = 0;
                dso->has_build_id = 0;
                dso->has_srcline = 1;
+                dso->a2l_fails = 1;
                dso->kernel = DSO_TYPE_USER;
                dso->needs_swap = DSO_SWAP__UNSET;
                INIT_LIST_HEAD(&dso->node);
@@ -464,11 +495,20 @@ void dso__delete(struct dso *dso)
        int i;
        for (i = 0; i < MAP__NR_TYPES; ++i)
                symbols__delete(&dso->symbols[i]);
-        if (dso->sname_alloc)
-                free((char *)dso->short_name);
+        if (dso->short_name_allocated) {
-        if (dso->lname_alloc)
+                zfree((char **)&dso->short_name);
-                free(dso->long_name);
+                dso->short_name_allocated = false;
+        }
+        if (dso->long_name_allocated) {
+                zfree((char **)&dso->long_name);
+                dso->long_name_allocated = false;
+        }
        dso_cache__free(&dso->cache);
+        dso__free_a2l(dso);
+        zfree(&dso->symsrc_filename);
        free(dso);
 }
@@ -543,7 +583,7 @@ void dsos__add(struct list_head *head, struct dso *dso)
        list_add_tail(&dso->node, head);
 }
-struct dso *dsos__find(struct list_head *head, const char *name, bool cmp_short)
+struct dso *dsos__find(const struct list_head *head, const char *name, bool cmp_short)
 {
        struct dso *pos;
diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
index 9ac666abbe7e..cd7d6f078cdd 100644
--- a/tools/perf/util/dso.h
+++ b/tools/perf/util/dso.h
@@ -77,23 +77,26 @@ struct dso {
        struct rb_root   symbols[MAP__NR_TYPES];
        struct rb_root   symbol_names[MAP__NR_TYPES];
        struct rb_root   cache;
+        void             *a2l;
+        char             *symsrc_filename;
+        unsigned int     a2l_fails;
        enum dso_kernel_type    kernel;
        enum dso_swap_type      needs_swap;
        enum dso_binary_type    symtab_type;
-        enum dso_binary_type    data_type;
+        enum dso_binary_type    binary_type;
        u8               adjust_symbols:1;
        u8               has_build_id:1;
        u8               has_srcline:1;
        u8               hit:1;
        u8               annotate_warned:1;
-        u8               sname_alloc:1;
+        u8               short_name_allocated:1;
-        u8               lname_alloc:1;
+        u8               long_name_allocated:1;
        u8               sorted_by_name;
        u8               loaded;
        u8               rel;
        u8               build_id[BUILD_ID_SIZE];
        const char       *short_name;
-        char             *long_name;
+        const char       *long_name;
        u16              long_name_len;
        u16              short_name_len;
        char             name[0];
@@ -107,8 +110,8 @@ static inline void dso__set_loaded(struct dso *dso, enum map_type type)
 struct dso *dso__new(const char *name);
 void dso__delete(struct dso *dso);
-void dso__set_short_name(struct dso *dso, const char *name);
+void dso__set_short_name(struct dso *dso, const char *name, bool name_allocated);
-void dso__set_long_name(struct dso *dso, char *name);
+void dso__set_long_name(struct dso *dso, const char *name, bool name_allocated);
 int dso__name_len(const struct dso *dso);
@@ -125,8 +128,8 @@ void dso__read_running_kernel_build_id(struct dso *dso,
 int dso__kernel_module_get_build_id(struct dso *dso, const char *root_dir);
 char dso__symtab_origin(const struct dso *dso);
-int dso__binary_type_file(struct dso *dso, enum dso_binary_type type,
+int dso__read_binary_type_filename(const struct dso *dso, enum dso_binary_type type,
-                          char *root_dir, char *file, size_t size);
+                                   char *root_dir, char *filename, size_t size);
 int dso__data_fd(struct dso *dso, struct machine *machine);
 ssize_t dso__data_read_offset(struct dso *dso, struct machine *machine,
@@ -140,7 +143,7 @@ struct dso *dso__kernel_findnew(struct machine *machine, const char *name,
                                const char *short_name, int dso_type);
 void dsos__add(struct list_head *head, struct dso *dso);
-struct dso *dsos__find(struct list_head *head, const char *name,
+struct dso *dsos__find(const struct list_head *head, const char *name,
                       bool cmp_short);
 struct dso *__dsos__findnew(struct list_head *head, const char *name);
 bool __dsos__read_build_ids(struct list_head *head, bool with_hits);
@@ -156,14 +159,16 @@ size_t dso__fprintf(struct dso *dso, enum map_type type, FILE *fp);
 static inline bool dso__is_vmlinux(struct dso *dso)
 {
-        return dso->data_type == DSO_BINARY_TYPE__VMLINUX ||
+        return dso->binary_type == DSO_BINARY_TYPE__VMLINUX ||
-               dso->data_type == DSO_BINARY_TYPE__GUEST_VMLINUX;
+               dso->binary_type == DSO_BINARY_TYPE__GUEST_VMLINUX;
 }
 static inline bool dso__is_kcore(struct dso *dso)
 {
-        return dso->data_type == DSO_BINARY_TYPE__KCORE ||
+        return dso->binary_type == DSO_BINARY_TYPE__KCORE ||
-               dso->data_type == DSO_BINARY_TYPE__GUEST_KCORE;
+               dso->binary_type == DSO_BINARY_TYPE__GUEST_KCORE;
 }
+void dso__free_a2l(struct dso *dso);
 #endif /* __PERF_DSO */
diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c
index bb788c109fe6..1fc1c2f04772 100644
--- a/tools/perf/util/event.c
+++ b/tools/perf/util/event.c
@@ -7,6 +7,7 @@
 #include "strlist.h"
 #include "thread.h"
 #include "thread_map.h"
+#include "symbol/kallsyms.h"
 static const char *perf_event__names[] = {
        [0]                                     = "TOTAL",
@@ -105,8 +106,12 @@ static pid_t perf_event__synthesize_comm(struct perf_tool *tool,
        memset(&event->comm, 0, sizeof(event->comm));
-        tgid = perf_event__get_comm_tgid(pid, event->comm.comm,
+        if (machine__is_host(machine))
-                                         sizeof(event->comm.comm));
+                tgid = perf_event__get_comm_tgid(pid, event->comm.comm,
+                                                 sizeof(event->comm.comm));
+        else
+                tgid = machine->pid;
        if (tgid < 0)
                goto out;
@@ -128,7 +133,11 @@ static pid_t perf_event__synthesize_comm(struct perf_tool *tool,
                goto out;
        }
-        snprintf(filename, sizeof(filename), "/proc/%d/task", pid);
+        if (machine__is_default_guest(machine))
+                return 0;
+        snprintf(filename, sizeof(filename), "%s/proc/%d/task",
+                 machine->root_dir, pid);
        tasks = opendir(filename);
        if (tasks == NULL) {
@@ -166,18 +175,22 @@ out:
        return tgid;
 }
-static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
+int perf_event__synthesize_mmap_events(struct perf_tool *tool,
-                                              union perf_event *event,
+                                       union perf_event *event,
-                                              pid_t pid, pid_t tgid,
+                                       pid_t pid, pid_t tgid,
-                                              perf_event__handler_t process,
+                                       perf_event__handler_t process,
-                                              struct machine *machine,
+                                       struct machine *machine,
-                                              bool mmap_data)
+                                       bool mmap_data)
 {
        char filename[PATH_MAX];
        FILE *fp;
        int rc = 0;
-        snprintf(filename, sizeof(filename), "/proc/%d/maps", pid);
+        if (machine__is_default_guest(machine))
+                return 0;
+        snprintf(filename, sizeof(filename), "%s/proc/%d/maps",
+                 machine->root_dir, pid);
        fp = fopen(filename, "r");
        if (fp == NULL) {
@@ -217,7 +230,10 @@ static int perf_event__synthesize_mmap_events(struct perf_tool *tool,
                /*
                 * Just like the kernel, see __perf_event_mmap in kernel/perf_event.c
                 */
-                event->header.misc = PERF_RECORD_MISC_USER;
+                if (machine__is_host(machine))
+                        event->header.misc = PERF_RECORD_MISC_USER;
+                else
+                        event->header.misc = PERF_RECORD_MISC_GUEST_USER;
                if (prot[2] != 'x') {
                        if (!mmap_data || prot[0] != 'r')
@@ -386,6 +402,7 @@ int perf_event__synthesize_threads(struct perf_tool *tool,
                                   struct machine *machine, bool mmap_data)
 {
        DIR *proc;
+        char proc_path[PATH_MAX];
        struct dirent dirent, *next;
        union perf_event *comm_event, *mmap_event;
        int err = -1;
@@ -398,7 +415,12 @@ int perf_event__synthesize_threads(struct perf_tool *tool,
        if (mmap_event == NULL)
                goto out_free_comm;
-        proc = opendir("/proc");
+        if (machine__is_default_guest(machine))
+                return 0;
+        snprintf(proc_path, sizeof(proc_path), "%s/proc", machine->root_dir);
+        proc = opendir(proc_path);
        if (proc == NULL)
                goto out_free_mmap;
@@ -637,6 +659,7 @@ void thread__find_addr_map(struct thread *thread,
        struct map_groups *mg = &thread->mg;
        bool load_map = false;
+        al->machine = machine;
        al->thread = thread;
        al->addr = addr;
        al->cpumode = cpumode;
@@ -657,15 +680,10 @@ void thread__find_addr_map(struct thread *thread,
                al->level = 'g';
                mg = &machine->kmaps;
                load_map = true;
+        } else if (cpumode == PERF_RECORD_MISC_GUEST_USER && perf_guest) {
+                al->level = 'u';
        } else {
-                /*
+                al->level = 'H';
-                 * 'u' means guest os user space.
-                 * TODO: We don't support guest user space. Might support late.
-                 */
-                if (cpumode == PERF_RECORD_MISC_GUEST_USER && perf_guest)
-                        al->level = 'u';
-                else
-                        al->level = 'H';
                al->map = NULL;
                if ((cpumode == PERF_RECORD_MISC_GUEST_USER ||
@@ -732,8 +750,7 @@ int perf_event__preprocess_sample(const union perf_event *event,
        if (thread == NULL)
                return -1;
-        if (symbol_conf.comm_list &&
+        if (thread__is_filtered(thread))
-            !strlist__has_entry(symbol_conf.comm_list, thread__comm_str(thread)))
                goto out_filtered;
        dump_printf(" ... thread: %s:%d\n", thread__comm_str(thread), thread->tid);
diff --git a/tools/perf/util/event.h b/tools/perf/util/event.h
index 30fec9901e44..faf6e219be21 100644
--- a/tools/perf/util/event.h
+++ b/tools/perf/util/event.h
@@ -266,6 +266,13 @@ int perf_event__synthesize_sample(union perf_event *event, u64 type,
                                  const struct perf_sample *sample,
                                  bool swapped);
+int perf_event__synthesize_mmap_events(struct perf_tool *tool,
+                                       union perf_event *event,
+                                       pid_t pid, pid_t tgid,
+                                       perf_event__handler_t process,
+                                       struct machine *machine,
+                                       bool mmap_data);
 size_t perf_event__fprintf_comm(union perf_event *event, FILE *fp);
 size_t perf_event__fprintf_mmap(union perf_event *event, FILE *fp);
 size_t perf_event__fprintf_mmap2(union perf_event *event, FILE *fp);
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index bbc746aa5716..40bd2c04df8a 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -7,7 +7,7 @@
 * Released under the GPL v2. (and only v2, not any later version)
 */
 #include "util.h"
-#include <lk/debugfs.h>
+#include <api/fs/debugfs.h>
 #include <poll.h>
 #include "cpumap.h"
 #include "thread_map.h"
@@ -81,7 +81,7 @@ static void perf_evlist__update_id_pos(struct perf_evlist *evlist)
 {
        struct perf_evsel *evsel;
-        list_for_each_entry(evsel, &evlist->entries, node)
+        evlist__for_each(evlist, evsel)
                perf_evsel__calc_id_pos(evsel);
        perf_evlist__set_id_pos(evlist);
@@ -91,7 +91,7 @@ static void perf_evlist__purge(struct perf_evlist *evlist)
 {
        struct perf_evsel *pos, *n;
-        list_for_each_entry_safe(pos, n, &evlist->entries, node) {
+        evlist__for_each_safe(evlist, n, pos) {
                list_del_init(&pos->node);
                perf_evsel__delete(pos);
        }
@@ -101,14 +101,18 @@ static void perf_evlist__purge(struct perf_evlist *evlist)
 void perf_evlist__exit(struct perf_evlist *evlist)
 {
-        free(evlist->mmap);
+        zfree(&evlist->mmap);
-        free(evlist->pollfd);
+        zfree(&evlist->pollfd);
-        evlist->mmap = NULL;
-        evlist->pollfd = NULL;
 }
 void perf_evlist__delete(struct perf_evlist *evlist)
 {
+        perf_evlist__munmap(evlist);
+        perf_evlist__close(evlist);
+        cpu_map__delete(evlist->cpus);
+        thread_map__delete(evlist->threads);
+        evlist->cpus = NULL;
+        evlist->threads = NULL;
        perf_evlist__purge(evlist);
        perf_evlist__exit(evlist);
        free(evlist);
@@ -144,7 +148,7 @@ void __perf_evlist__set_leader(struct list_head *list)
        leader->nr_members = evsel->idx - leader->idx + 1;
-        list_for_each_entry(evsel, list, node) {
+        __evlist__for_each(list, evsel) {
                evsel->leader = leader;
        }
 }
@@ -203,7 +207,7 @@ static int perf_evlist__add_attrs(struct perf_evlist *evlist,
        return 0;
 out_delete_partial_list:
-        list_for_each_entry_safe(evsel, n, &head, node)
+        __evlist__for_each_safe(&head, n, evsel)
                perf_evsel__delete(evsel);
        return -1;
 }
@@ -224,7 +228,7 @@ perf_evlist__find_tracepoint_by_id(struct perf_evlist *evlist, int id)
 {
        struct perf_evsel *evsel;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                if (evsel->attr.type   == PERF_TYPE_TRACEPOINT &&
                    (int)evsel->attr.config == id)
                        return evsel;
@@ -239,7 +243,7 @@ perf_evlist__find_tracepoint_by_name(struct perf_evlist *evlist,
 {
        struct perf_evsel *evsel;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                if ((evsel->attr.type == PERF_TYPE_TRACEPOINT) &&
                    (strcmp(evsel->name, name) == 0))
                        return evsel;
@@ -269,7 +273,7 @@ void perf_evlist__disable(struct perf_evlist *evlist)
        int nr_threads = thread_map__nr(evlist->threads);
        for (cpu = 0; cpu < nr_cpus; cpu++) {
-                list_for_each_entry(pos, &evlist->entries, node) {
+                evlist__for_each(evlist, pos) {
                        if (!perf_evsel__is_group_leader(pos) || !pos->fd)
                                continue;
                        for (thread = 0; thread < nr_threads; thread++)
@@ -287,7 +291,7 @@ void perf_evlist__enable(struct perf_evlist *evlist)
        int nr_threads = thread_map__nr(evlist->threads);
        for (cpu = 0; cpu < nr_cpus; cpu++) {
-                list_for_each_entry(pos, &evlist->entries, node) {
+                evlist__for_each(evlist, pos) {
                        if (!perf_evsel__is_group_leader(pos) || !pos->fd)
                                continue;
                        for (thread = 0; thread < nr_threads; thread++)
@@ -584,11 +588,13 @@ void perf_evlist__munmap(struct perf_evlist *evlist)
 {
        int i;
+        if (evlist->mmap == NULL)
+                return;
        for (i = 0; i < evlist->nr_mmaps; i++)
                __perf_evlist__munmap(evlist, i);
-        free(evlist->mmap);
+        zfree(&evlist->mmap);
-        evlist->mmap = NULL;
 }
 static int perf_evlist__alloc_mmap(struct perf_evlist *evlist)
@@ -624,7 +630,7 @@ static int perf_evlist__mmap_per_evsel(struct perf_evlist *evlist, int idx,
 {
        struct perf_evsel *evsel;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                int fd = FD(evsel, cpu, thread);
                if (*output == -1) {
@@ -732,11 +738,13 @@ static long parse_pages_arg(const char *str, unsigned long min,
                        return -EINVAL;
        }
-        if ((pages == 0) && (min == 0)) {
+        if (pages == 0 && min == 0) {
                /* leave number of pages at 0 */
-        } else if (pages < (1UL << 31) && !is_power_of_2(pages)) {
+        } else if (!is_power_of_2(pages)) {
                /* round pages up to next power of 2 */
-                pages = next_pow2(pages);
+                pages = next_pow2_l(pages);
+                if (!pages)
+                        return -EINVAL;
                pr_info("rounding mmap pages size to %lu bytes (%lu pages)\n",
                        pages * page_size, pages);
        }
@@ -754,7 +762,7 @@ int perf_evlist__parse_mmap_pages(const struct option *opt, const char *str,
        unsigned long max = UINT_MAX;
        long pages;
-        if (max < SIZE_MAX / page_size)
+        if (max > SIZE_MAX / page_size)
                max = SIZE_MAX / page_size;
        pages = parse_pages_arg(str, 1, max);
@@ -798,7 +806,7 @@ int perf_evlist__mmap(struct perf_evlist *evlist, unsigned int pages,
        pr_debug("mmap size %zuB\n", evlist->mmap_len);
        mask = evlist->mmap_len - page_size - 1;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                if ((evsel->attr.read_format & PERF_FORMAT_ID) &&
                    evsel->sample_id == NULL &&
                    perf_evsel__alloc_id(evsel, cpu_map__nr(cpus), threads->nr) < 0)
@@ -819,11 +827,7 @@ int perf_evlist__create_maps(struct perf_evlist *evlist, struct target *target)
        if (evlist->threads == NULL)
                return -1;
-        if (target->force_per_cpu)
+        if (target__uses_dummy_map(target))
-                evlist->cpus = cpu_map__new(target->cpu_list);
-        else if (target__has_task(target))
-                evlist->cpus = cpu_map__dummy_new();
-        else if (!target__has_cpu(target) && !target->uses_mmap)
                evlist->cpus = cpu_map__dummy_new();
        else
                evlist->cpus = cpu_map__new(target->cpu_list);
@@ -838,14 +842,6 @@ out_delete_threads:
        return -1;
 }
-void perf_evlist__delete_maps(struct perf_evlist *evlist)
-{
-        cpu_map__delete(evlist->cpus);
-        thread_map__delete(evlist->threads);
-        evlist->cpus    = NULL;
-        evlist->threads = NULL;
-}
 int perf_evlist__apply_filters(struct perf_evlist *evlist)
 {
        struct perf_evsel *evsel;
@@ -853,7 +849,7 @@ int perf_evlist__apply_filters(struct perf_evlist *evlist)
        const int ncpus = cpu_map__nr(evlist->cpus),
                  nthreads = thread_map__nr(evlist->threads);
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                if (evsel->filter == NULL)
                        continue;
@@ -872,7 +868,7 @@ int perf_evlist__set_filter(struct perf_evlist *evlist, const char *filter)
        const int ncpus = cpu_map__nr(evlist->cpus),
                  nthreads = thread_map__nr(evlist->threads);
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                err = perf_evsel__set_filter(evsel, ncpus, nthreads, filter);
                if (err)
                        break;
@@ -891,7 +887,7 @@ bool perf_evlist__valid_sample_type(struct perf_evlist *evlist)
        if (evlist->id_pos < 0 || evlist->is_pos < 0)
                return false;
-        list_for_each_entry(pos, &evlist->entries, node) {
+        evlist__for_each(evlist, pos) {
                if (pos->id_pos != evlist->id_pos ||
                    pos->is_pos != evlist->is_pos)
                        return false;
@@ -907,7 +903,7 @@ u64 __perf_evlist__combined_sample_type(struct perf_evlist *evlist)
        if (evlist->combined_sample_type)
                return evlist->combined_sample_type;
-        list_for_each_entry(evsel, &evlist->entries, node)
+        evlist__for_each(evlist, evsel)
                evlist->combined_sample_type |= evsel->attr.sample_type;
        return evlist->combined_sample_type;
@@ -925,7 +921,7 @@ bool perf_evlist__valid_read_format(struct perf_evlist *evlist)
        u64 read_format = first->attr.read_format;
        u64 sample_type = first->attr.sample_type;
-        list_for_each_entry_continue(pos, &evlist->entries, node) {
+        evlist__for_each(evlist, pos) {
                if (read_format != pos->attr.read_format)
                        return false;
        }
@@ -982,7 +978,7 @@ bool perf_evlist__valid_sample_id_all(struct perf_evlist *evlist)
 {
        struct perf_evsel *first = perf_evlist__first(evlist), *pos = first;
-        list_for_each_entry_continue(pos, &evlist->entries, node) {
+        evlist__for_each_continue(evlist, pos) {
                if (first->attr.sample_id_all != pos->attr.sample_id_all)
                        return false;
        }
@@ -1008,7 +1004,7 @@ void perf_evlist__close(struct perf_evlist *evlist)
        int ncpus = cpu_map__nr(evlist->cpus);
        int nthreads = thread_map__nr(evlist->threads);
-        list_for_each_entry_reverse(evsel, &evlist->entries, node)
+        evlist__for_each_reverse(evlist, evsel)
                perf_evsel__close(evsel, ncpus, nthreads);
 }
@@ -1019,7 +1015,7 @@ int perf_evlist__open(struct perf_evlist *evlist)
        perf_evlist__update_id_pos(evlist);
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                err = perf_evsel__open(evsel, evlist->cpus, evlist->threads);
                if (err < 0)
                        goto out_err;
@@ -1034,7 +1030,7 @@ out_err:
 int perf_evlist__prepare_workload(struct perf_evlist *evlist, struct target *target,
                                  const char *argv[], bool pipe_output,
-                                  bool want_signal)
+                                  void (*exec_error)(int signo, siginfo_t *info, void *ucontext))
 {
        int child_ready_pipe[2], go_pipe[2];
        char bf;
@@ -1078,12 +1074,25 @@ int perf_evlist__prepare_workload(struct perf_evlist *evlist, struct target *tar
                execvp(argv[0], (char **)argv);
-                perror(argv[0]);
+                if (exec_error) {
-                if (want_signal)
+                        union sigval val;
-                        kill(getppid(), SIGUSR1);
+                        val.sival_int = errno;
+                        if (sigqueue(getppid(), SIGUSR1, val))
+                                perror(argv[0]);
+                } else
+                        perror(argv[0]);
                exit(-1);
        }
+        if (exec_error) {
+                struct sigaction act = {
+                        .sa_flags     = SA_SIGINFO,
+                        .sa_sigaction = exec_error,
+                };
+                sigaction(SIGUSR1, &act, NULL);
+        }
        if (target__none(target))
                evlist->threads->map[0] = evlist->workload.pid;
@@ -1145,7 +1154,7 @@ size_t perf_evlist__fprintf(struct perf_evlist *evlist, FILE *fp)
        struct perf_evsel *evsel;
        size_t printed = 0;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                printed += fprintf(fp, "%s%s", evsel->idx ? ", " : "",
                                   perf_evsel__name(evsel));
        }
@@ -1193,8 +1202,7 @@ int perf_evlist__strerror_open(struct perf_evlist *evlist __maybe_unused,
                                    "Error:\t%s.\n"
                                    "Hint:\tCheck /proc/sys/kernel/perf_event_paranoid setting.", emsg);
-                if (filename__read_int("/proc/sys/kernel/perf_event_paranoid", &value))
+                value = perf_event_paranoid();
-                        break;
                printed += scnprintf(buf + printed, size - printed, "\nHint:\t");
@@ -1215,3 +1223,20 @@ int perf_evlist__strerror_open(struct perf_evlist *evlist __maybe_unused,
        return 0;
 }
+void perf_evlist__to_front(struct perf_evlist *evlist,
+                           struct perf_evsel *move_evsel)
+{
+        struct perf_evsel *evsel, *n;
+        LIST_HEAD(move);
+        if (move_evsel == perf_evlist__first(evlist))
+                return;
+        evlist__for_each_safe(evlist, n, evsel) {
+                if (evsel->leader == move_evsel->leader)
+                        list_move_tail(&evsel->node, &move);
+        }
+        list_splice(&move, &evlist->entries);
+}
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 649d6ea98a84..f5173cd63693 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -12,7 +12,7 @@
 struct pollfd;
 struct thread_map;
 struct cpu_map;
-struct perf_record_opts;
+struct record_opts;
 #define PERF_EVLIST__HLIST_BITS 8
 #define PERF_EVLIST__HLIST_SIZE (1 << PERF_EVLIST__HLIST_BITS)
@@ -97,14 +97,14 @@ void perf_evlist__close(struct perf_evlist *evlist);
 void perf_evlist__set_id_pos(struct perf_evlist *evlist);
 bool perf_can_sample_identifier(void);
-void perf_evlist__config(struct perf_evlist *evlist,
+void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts);
-                         struct perf_record_opts *opts);
+int record_opts__config(struct record_opts *opts);
-int perf_record_opts__config(struct perf_record_opts *opts);
 int perf_evlist__prepare_workload(struct perf_evlist *evlist,
                                  struct target *target,
                                  const char *argv[], bool pipe_output,
-                                  bool want_signal);
+                                  void (*exec_error)(int signo, siginfo_t *info,
+                                                     void *ucontext));
 int perf_evlist__start_workload(struct perf_evlist *evlist);
 int perf_evlist__parse_mmap_pages(const struct option *opt,
@@ -135,7 +135,6 @@ static inline void perf_evlist__set_maps(struct perf_evlist *evlist,
 }
 int perf_evlist__create_maps(struct perf_evlist *evlist, struct target *target);
-void perf_evlist__delete_maps(struct perf_evlist *evlist);
 int perf_evlist__apply_filters(struct perf_evlist *evlist);
 void __perf_evlist__set_leader(struct list_head *list);
@@ -193,4 +192,74 @@ static inline void perf_mmap__write_tail(struct perf_mmap *md,
        pc->data_tail = tail;
 }
+bool perf_evlist__can_select_event(struct perf_evlist *evlist, const char *str);
+void perf_evlist__to_front(struct perf_evlist *evlist,
+                           struct perf_evsel *move_evsel);
+/**
+ * __evlist__for_each - iterate thru all the evsels
+ * @list: list_head instance to iterate
+ * @evsel: struct evsel iterator
+ */
+#define __evlist__for_each(list, evsel) \
+        list_for_each_entry(evsel, list, node)
+/**
+ * evlist__for_each - iterate thru all the evsels
+ * @evlist: evlist instance to iterate
+ * @evsel: struct evsel iterator
+ */
+#define evlist__for_each(evlist, evsel) \
+        __evlist__for_each(&(evlist)->entries, evsel)
+/**
+ * __evlist__for_each_continue - continue iteration thru all the evsels
+ * @list: list_head instance to iterate
+ * @evsel: struct evsel iterator
+ */
+#define __evlist__for_each_continue(list, evsel) \
+        list_for_each_entry_continue(evsel, list, node)
+/**
+ * evlist__for_each_continue - continue iteration thru all the evsels
+ * @evlist: evlist instance to iterate
+ * @evsel: struct evsel iterator
+ */
+#define evlist__for_each_continue(evlist, evsel) \
+        __evlist__for_each_continue(&(evlist)->entries, evsel)
+/**
+ * __evlist__for_each_reverse - iterate thru all the evsels in reverse order
+ * @list: list_head instance to iterate
+ * @evsel: struct evsel iterator
+ */
+#define __evlist__for_each_reverse(list, evsel) \
+        list_for_each_entry_reverse(evsel, list, node)
+/**
+ * evlist__for_each_reverse - iterate thru all the evsels in reverse order
+ * @evlist: evlist instance to iterate
+ * @evsel: struct evsel iterator
+ */
+#define evlist__for_each_reverse(evlist, evsel) \
+        __evlist__for_each_reverse(&(evlist)->entries, evsel)
+/**
+ * __evlist__for_each_safe - safely iterate thru all the evsels
+ * @list: list_head instance to iterate
+ * @tmp: struct evsel temp iterator
+ * @evsel: struct evsel iterator
+ */
+#define __evlist__for_each_safe(list, tmp, evsel) \
+        list_for_each_entry_safe(evsel, tmp, list, node)
+/**
+ * evlist__for_each_safe - safely iterate thru all the evsels
+ * @evlist: evlist instance to iterate
+ * @evsel: struct evsel iterator
+ * @tmp: struct evsel temp iterator
+ */
+#define evlist__for_each_safe(evlist, tmp, evsel) \
+        __evlist__for_each_safe(&(evlist)->entries, tmp, evsel)
 #endif /* __PERF_EVLIST_H */
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index 46dd4c2a41ce..22e18a26b7e6 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -9,7 +9,7 @@
 #include <byteswap.h>
 #include <linux/bitops.h>
-#include <lk/debugfs.h>
+#include <api/fs/debugfs.h>
 #include <traceevent/event-parse.h>
 #include <linux/hw_breakpoint.h>
 #include <linux/perf_event.h>
@@ -23,6 +23,7 @@
 #include "target.h"
 #include "perf_regs.h"
 #include "debug.h"
+#include "trace-event.h"
 static struct {
        bool sample_id_all;
@@ -162,6 +163,8 @@ void perf_evsel__init(struct perf_evsel *evsel,
        evsel->idx         = idx;
        evsel->attr        = *attr;
        evsel->leader      = evsel;
+        evsel->unit        = "";
+        evsel->scale       = 1.0;
        INIT_LIST_HEAD(&evsel->node);
        hists__init(&evsel->hists);
        evsel->sample_size = __perf_evsel__sample_size(attr->sample_type);
@@ -178,47 +181,6 @@ struct perf_evsel *perf_evsel__new_idx(struct perf_event_attr *attr, int idx)
        return evsel;
 }
-struct event_format *event_format__new(const char *sys, const char *name)
-{
-        int fd, n;
-        char *filename;
-        void *bf = NULL, *nbf;
-        size_t size = 0, alloc_size = 0;
-        struct event_format *format = NULL;
-        if (asprintf(&filename, "%s/%s/%s/format", tracing_events_path, sys, name) < 0)
-                goto out;
-        fd = open(filename, O_RDONLY);
-        if (fd < 0)
-                goto out_free_filename;
-        do {
-                if (size == alloc_size) {
-                        alloc_size += BUFSIZ;
-                        nbf = realloc(bf, alloc_size);
-                        if (nbf == NULL)
-                                goto out_free_bf;
-                        bf = nbf;
-                }
-                n = read(fd, bf + size, alloc_size - size);
-                if (n < 0)
-                        goto out_free_bf;
-                size += n;
-        } while (n > 0);
-        pevent_parse_format(&format, bf, size, sys);
-out_free_bf:
-        free(bf);
-        close(fd);
-out_free_filename:
-        free(filename);
-out:
-        return format;
-}
 struct perf_evsel *perf_evsel__newtp_idx(const char *sys, const char *name, int idx)
 {
        struct perf_evsel *evsel = zalloc(sizeof(*evsel));
@@ -233,7 +195,7 @@ struct perf_evsel *perf_evsel__newtp_idx(const char *sys, const char *name, int
                if (asprintf(&evsel->name, "%s:%s", sys, name) < 0)
                        goto out_free;
-                evsel->tp_format = event_format__new(sys, name);
+                evsel->tp_format = trace_event__tp_format(sys, name);
                if (evsel->tp_format == NULL)
                        goto out_free;
@@ -246,7 +208,7 @@ struct perf_evsel *perf_evsel__newtp_idx(const char *sys, const char *name, int
        return evsel;
 out_free:
-        free(evsel->name);
+        zfree(&evsel->name);
        free(evsel);
        return NULL;
 }
@@ -566,12 +528,12 @@ int perf_evsel__group_desc(struct perf_evsel *evsel, char *buf, size_t size)
 *     enable/disable events specifically, as there's no
 *     initial traced exec call.
 */
-void perf_evsel__config(struct perf_evsel *evsel,
+void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts)
-                        struct perf_record_opts *opts)
 {
        struct perf_evsel *leader = evsel->leader;
        struct perf_event_attr *attr = &evsel->attr;
        int track = !evsel->idx; /* only the first counter needs these */
+        bool per_cpu = opts->target.default_per_cpu && !opts->target.per_thread;
        attr->sample_id_all = perf_missing_features.sample_id_all ? 0 : 1;
        attr->inherit       = !opts->no_inherit;
@@ -645,7 +607,7 @@ void perf_evsel__config(struct perf_evsel *evsel,
                }
        }
-        if (target__has_cpu(&opts->target) || opts->target.force_per_cpu)
+        if (target__has_cpu(&opts->target))
                perf_evsel__set_sample_bit(evsel, CPU);
        if (opts->period)
@@ -653,7 +615,7 @@ void perf_evsel__config(struct perf_evsel *evsel,
        if (!perf_missing_features.sample_id_all &&
            (opts->sample_time || !opts->no_inherit ||
-             target__has_cpu(&opts->target) || opts->target.force_per_cpu))
+             target__has_cpu(&opts->target) || per_cpu))
                perf_evsel__set_sample_bit(evsel, TIME);
        if (opts->raw_samples) {
@@ -665,7 +627,7 @@ void perf_evsel__config(struct perf_evsel *evsel,
        if (opts->sample_address)
                perf_evsel__set_sample_bit(evsel, DATA_SRC);
-        if (opts->no_delay) {
+        if (opts->no_buffering) {
                attr->watermark = 0;
                attr->wakeup_events = 1;
        }
@@ -696,7 +658,8 @@ void perf_evsel__config(struct perf_evsel *evsel,
         * Setting enable_on_exec for independent events and
         * group leaders for traced executed by perf.
         */
-        if (target__none(&opts->target) && perf_evsel__is_group_leader(evsel))
+        if (target__none(&opts->target) && perf_evsel__is_group_leader(evsel) &&
+                !opts->initial_delay)
                attr->enable_on_exec = 1;
 }
@@ -788,8 +751,7 @@ void perf_evsel__free_id(struct perf_evsel *evsel)
 {
        xyarray__delete(evsel->sample_id);
        evsel->sample_id = NULL;
-        free(evsel->id);
+        zfree(&evsel->id);
-        evsel->id = NULL;
 }
 void perf_evsel__close_fd(struct perf_evsel *evsel, int ncpus, int nthreads)
@@ -805,7 +767,7 @@ void perf_evsel__close_fd(struct perf_evsel *evsel, int ncpus, int nthreads)
 void perf_evsel__free_counts(struct perf_evsel *evsel)
 {
-        free(evsel->counts);
+        zfree(&evsel->counts);
 }
 void perf_evsel__exit(struct perf_evsel *evsel)
@@ -819,10 +781,10 @@ void perf_evsel__delete(struct perf_evsel *evsel)
 {
        perf_evsel__exit(evsel);
        close_cgroup(evsel->cgrp);
-        free(evsel->group_name);
+        zfree(&evsel->group_name);
        if (evsel->tp_format)
                pevent_free_format(evsel->tp_format);
-        free(evsel->name);
+        zfree(&evsel->name);
        free(evsel);
 }
@@ -1998,8 +1960,7 @@ bool perf_evsel__fallback(struct perf_evsel *evsel, int err,
                evsel->attr.type   = PERF_TYPE_SOFTWARE;
                evsel->attr.config = PERF_COUNT_SW_CPU_CLOCK;
-                free(evsel->name);
+                zfree(&evsel->name);
-                evsel->name = NULL;
                return true;
        }
diff --git a/tools/perf/util/evsel.h b/tools/perf/util/evsel.h
index 1ea7c92e6e33..f1b325665aae 100644
--- a/tools/perf/util/evsel.h
+++ b/tools/perf/util/evsel.h
@@ -68,6 +68,8 @@ struct perf_evsel {
        u32                     ids;
        struct hists            hists;
        char                    *name;
+        double                  scale;
+        const char              *unit;
        struct event_format     *tp_format;
        union {
                void            *priv;
@@ -94,7 +96,7 @@ struct perf_evsel {
 struct cpu_map;
 struct thread_map;
 struct perf_evlist;
-struct perf_record_opts;
+struct record_opts;
 struct perf_evsel *perf_evsel__new_idx(struct perf_event_attr *attr, int idx);
@@ -118,7 +120,7 @@ void perf_evsel__exit(struct perf_evsel *evsel);
 void perf_evsel__delete(struct perf_evsel *evsel);
 void perf_evsel__config(struct perf_evsel *evsel,
-                        struct perf_record_opts *opts);
+                        struct record_opts *opts);
 int __perf_evsel__sample_size(u64 sample_type);
 void perf_evsel__calc_id_pos(struct perf_evsel *evsel);
@@ -138,6 +140,7 @@ extern const char *perf_evsel__sw_names[PERF_COUNT_SW_MAX];
 int __perf_evsel__hw_cache_type_op_res_name(u8 type, u8 op, u8 result,
                                            char *bf, size_t size);
 const char *perf_evsel__name(struct perf_evsel *evsel);
 const char *perf_evsel__group_name(struct perf_evsel *evsel);
 int perf_evsel__group_desc(struct perf_evsel *evsel, char *buf, size_t size);
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 1cd035708931..bb3e0ede6183 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -177,7 +177,7 @@ perf_header__set_cmdline(int argc, const char **argv)
                        continue;               \
                else
-static int write_buildid(char *name, size_t name_len, u8 *build_id,
+static int write_buildid(const char *name, size_t name_len, u8 *build_id,
                         pid_t pid, u16 misc, int fd)
 {
        int err;
@@ -209,7 +209,7 @@ static int __dsos__write_buildid_table(struct list_head *head,
        dsos__for_each_with_build_id(pos, head) {
                int err;
-                char  *name;
+                const char *name;
                size_t name_len;
                if (!pos->hit)
@@ -387,7 +387,7 @@ static int dso__cache_build_id(struct dso *dso, struct machine *machine,
 {
        bool is_kallsyms = dso->kernel && dso->long_name[0] != '/';
        bool is_vdso = is_vdso_map(dso->short_name);
-        char *name = dso->long_name;
+        const char *name = dso->long_name;
        char nm[PATH_MAX];
        if (dso__is_kcore(dso)) {
@@ -643,8 +643,7 @@ static int write_event_desc(int fd, struct perf_header *h __maybe_unused,
        if (ret < 0)
                return ret;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                ret = do_write(fd, &evsel->attr, sz);
                if (ret < 0)
                        return ret;
@@ -800,10 +799,10 @@ static void free_cpu_topo(struct cpu_topo *tp)
                return;
        for (i = 0 ; i < tp->core_sib; i++)
-                free(tp->core_siblings[i]);
+                zfree(&tp->core_siblings[i]);
        for (i = 0 ; i < tp->thread_sib; i++)
-                free(tp->thread_siblings[i]);
+                zfree(&tp->thread_siblings[i]);
        free(tp);
 }
@@ -1092,7 +1091,7 @@ static int write_group_desc(int fd, struct perf_header *h __maybe_unused,
        if (ret < 0)
                return ret;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                if (perf_evsel__is_group_leader(evsel) &&
                    evsel->nr_members > 1) {
                        const char *name = evsel->group_name ?: "{anon_group}";
@@ -1232,10 +1231,8 @@ static void free_event_desc(struct perf_evsel *events)
                return;
        for (evsel = events; evsel->attr.size; evsel++) {
-                if (evsel->name)
+                zfree(&evsel->name);
-                        free(evsel->name);
+                zfree(&evsel->id);
-                if (evsel->id)
-                        free(evsel->id);
        }
        free(events);
@@ -1326,8 +1323,7 @@ read_event_desc(struct perf_header *ph, int fd)
                }
        }
 out:
-        if (buf)
+        free(buf);
-                free(buf);
        return events;
 error:
        if (events)
@@ -1490,7 +1486,7 @@ static void print_group_desc(struct perf_header *ph, int fd __maybe_unused,
        session = container_of(ph, struct perf_session, header);
-        list_for_each_entry(evsel, &session->evlist->entries, node) {
+        evlist__for_each(session->evlist, evsel) {
                if (perf_evsel__is_group_leader(evsel) &&
                    evsel->nr_members > 1) {
                        fprintf(fp, "# group: %s{%s", evsel->group_name ?: "",
@@ -1709,7 +1705,7 @@ static int process_nrcpus(struct perf_file_section *section __maybe_unused,
                          struct perf_header *ph, int fd,
                          void *data __maybe_unused)
 {
-        size_t ret;
+        ssize_t ret;
        u32 nr;
        ret = readn(fd, &nr, sizeof(nr));
@@ -1753,7 +1749,7 @@ static int process_total_mem(struct perf_file_section *section __maybe_unused,
                             void *data __maybe_unused)
 {
        uint64_t mem;
-        size_t ret;
+        ssize_t ret;
        ret = readn(fd, &mem, sizeof(mem));
        if (ret != sizeof(mem))
@@ -1771,7 +1767,7 @@ perf_evlist__find_by_index(struct perf_evlist *evlist, int idx)
 {
        struct perf_evsel *evsel;
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                if (evsel->idx == idx)
                        return evsel;
        }
@@ -1822,7 +1818,7 @@ static int process_cmdline(struct perf_file_section *section __maybe_unused,
                           struct perf_header *ph, int fd,
                           void *data __maybe_unused)
 {
-        size_t ret;
+        ssize_t ret;
        char *str;
        u32 nr, i;
        struct strbuf sb;
@@ -1858,7 +1854,7 @@ static int process_cpu_topology(struct perf_file_section *section __maybe_unused
                                struct perf_header *ph, int fd,
                                void *data __maybe_unused)
 {
-        size_t ret;
+        ssize_t ret;
        u32 nr, i;
        char *str;
        struct strbuf sb;
@@ -1914,7 +1910,7 @@ static int process_numa_topology(struct perf_file_section *section __maybe_unuse
                                 struct perf_header *ph, int fd,
                                 void *data __maybe_unused)
 {
-        size_t ret;
+        ssize_t ret;
        u32 nr, node, i;
        char *str;
        uint64_t mem_total, mem_free;
@@ -1974,7 +1970,7 @@ static int process_pmu_mappings(struct perf_file_section *section __maybe_unused
                                struct perf_header *ph, int fd,
                                void *data __maybe_unused)
 {
-        size_t ret;
+        ssize_t ret;
        char *name;
        u32 pmu_num;
        u32 type;
@@ -2074,7 +2070,7 @@ static int process_group_desc(struct perf_file_section *section __maybe_unused,
        session->evlist->nr_groups = nr_groups;
        i = nr = 0;
-        list_for_each_entry(evsel, &session->evlist->entries, node) {
+        evlist__for_each(session->evlist, evsel) {
                if (evsel->idx == (int) desc[i].leader_idx) {
                        evsel->leader = evsel;
                        /* {anon_group} is a dummy name */
@@ -2108,7 +2104,7 @@ static int process_group_desc(struct perf_file_section *section __maybe_unused,
        ret = 0;
 out_free:
        for (i = 0; i < nr_groups; i++)
-                free(desc[i].name);
+                zfree(&desc[i].name);
        free(desc);
        return ret;
@@ -2301,7 +2297,7 @@ int perf_session__write_header(struct perf_session *session,
        lseek(fd, sizeof(f_header), SEEK_SET);
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(session->evlist, evsel) {
                evsel->id_offset = lseek(fd, 0, SEEK_CUR);
                err = do_write(fd, evsel->id, evsel->ids * sizeof(u64));
                if (err < 0) {
@@ -2312,7 +2308,7 @@ int perf_session__write_header(struct perf_session *session,
        attr_offset = lseek(fd, 0, SEEK_CUR);
-        list_for_each_entry(evsel, &evlist->entries, node) {
+        evlist__for_each(evlist, evsel) {
                f_attr = (struct perf_file_attr){
                        .attr = evsel->attr,
                        .ids  = {
@@ -2327,7 +2323,8 @@ int perf_session__write_header(struct perf_session *session,
                }
        }
-        header->data_offset = lseek(fd, 0, SEEK_CUR);
+        if (!header->data_offset)
+                header->data_offset = lseek(fd, 0, SEEK_CUR);
        header->feat_offset = header->data_offset + header->data_size;
        if (at_exit) {
@@ -2534,7 +2531,7 @@ static int check_magic_endian(u64 magic, uint64_t hdr_sz,
 int perf_file_header__read(struct perf_file_header *header,
                           struct perf_header *ph, int fd)
 {
-        int ret;
+        ssize_t ret;
        lseek(fd, 0, SEEK_SET);
@@ -2628,7 +2625,7 @@ static int perf_file_header__read_pipe(struct perf_pipe_file_header *header,
                                       struct perf_header *ph, int fd,
                                       bool repipe)
 {
-        int ret;
+        ssize_t ret;
        ret = readn(fd, header, sizeof(*header));
        if (ret <= 0)
@@ -2669,7 +2666,7 @@ static int read_attr(int fd, struct perf_header *ph,
        struct perf_event_attr *attr = &f_attr->attr;
        size_t sz, left;
        size_t our_sz = sizeof(f_attr->attr);
-        int ret;
+        ssize_t ret;
        memset(f_attr, 0, sizeof(*f_attr));
@@ -2744,7 +2741,7 @@ static int perf_evlist__prepare_tracepoint_events(struct perf_evlist *evlist,
 {
        struct perf_evsel *pos;
-        list_for_each_entry(pos, &evlist->entries, node) {
+        evlist__for_each(evlist, pos) {
                if (pos->attr.type == PERF_TYPE_TRACEPOINT &&
                    perf_evsel__prepare_tracepoint_event(pos, pevent))
                        return -1;
@@ -2834,11 +2831,11 @@ int perf_session__read_header(struct perf_session *session)
        symbol_conf.nr_events = nr_attrs;
-        perf_header__process_sections(header, fd, &session->pevent,
+        perf_header__process_sections(header, fd, &session->tevent,
                                      perf_file_section__process);
        if (perf_evlist__prepare_tracepoint_events(session->evlist,
-                                                   session->pevent))
+                                                   session->tevent.pevent))
                goto out_delete_evlist;
        return 0;
@@ -2892,7 +2889,7 @@ int perf_event__synthesize_attrs(struct perf_tool *tool,
        struct perf_evsel *evsel;
        int err = 0;
-        list_for_each_entry(evsel, &session->evlist->entries, node) {
+        evlist__for_each(session->evlist, evsel) {
                err = perf_event__synthesize_attr(tool, &evsel->attr, evsel->ids,
                                                  evsel->id, process);
                if (err) {
@@ -3003,7 +3000,7 @@ int perf_event__process_tracing_data(struct perf_tool *tool __maybe_unused,
        lseek(fd, offset + sizeof(struct tracing_data_event),
              SEEK_SET);
-        size_read = trace_report(fd, &session->pevent,
+        size_read = trace_report(fd, &session->tevent,
                                 session->repipe);
        padding = PERF_ALIGN(size_read, sizeof(u64)) - size_read;
@@ -3025,7 +3022,7 @@ int perf_event__process_tracing_data(struct perf_tool *tool __maybe_unused,
        }
        perf_evlist__prepare_tracepoint_events(session->evlist,
-                                               session->pevent);
+                                               session->tevent.pevent);
        return size_read + padding;
 }
diff --git a/tools/perf/util/header.h b/tools/perf/util/header.h
index 307c9aed972e..a2d047bdf4ef 100644
--- a/tools/perf/util/header.h
+++ b/tools/perf/util/header.h
@@ -77,16 +77,16 @@ struct perf_session_env {
        unsigned long long      total_mem;
        int                     nr_cmdline;
-        char                    *cmdline;
        int                     nr_sibling_cores;
-        char                    *sibling_cores;
        int                     nr_sibling_threads;
-        char                    *sibling_threads;
        int                     nr_numa_nodes;
-        char                    *numa_nodes;
        int                     nr_pmu_mappings;
-        char                    *pmu_mappings;
        int                     nr_groups;
+        char                    *cmdline;
+        char                    *sibling_cores;
+        char                    *sibling_threads;
+        char                    *numa_nodes;
+        char                    *pmu_mappings;
 };
 struct perf_header {
diff --git a/tools/perf/util/help.c b/tools/perf/util/help.c
index 8b1f6e891b8a..86c37c472263 100644
--- a/tools/perf/util/help.c
+++ b/tools/perf/util/help.c
@@ -22,8 +22,8 @@ static void clean_cmdnames(struct cmdnames *cmds)
        unsigned int i;
        for (i = 0; i < cmds->cnt; ++i)
-                free(cmds->names[i]);
+                zfree(&cmds->names[i]);
-        free(cmds->names);
+        zfree(&cmds->names);
        cmds->cnt = 0;
        cmds->alloc = 0;
 }
@@ -263,9 +263,8 @@ static void add_cmd_list(struct cmdnames *cmds, struct cmdnames *old)
        for (i = 0; i < old->cnt; i++)
                cmds->names[cmds->cnt++] = old->names[i];
-        free(old->names);
+        zfree(&old->names);
        old->cnt = 0;
-        old->names = NULL;
 }
 const char *help_unknown_cmd(const char *cmd)
diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
index 822903eaa201..e4e6249b87d4 100644
--- a/tools/perf/util/hist.c
+++ b/tools/perf/util/hist.c
@@ -1,4 +1,3 @@
-#include "annotate.h"
 #include "util.h"
 #include "build-id.h"
 #include "hist.h"
@@ -182,21 +181,21 @@ void hists__output_recalc_col_len(struct hists *hists, int max_rows)
        }
 }
-static void hist_entry__add_cpumode_period(struct hist_entry *he,
+static void he_stat__add_cpumode_period(struct he_stat *he_stat,
-                                           unsigned int cpumode, u64 period)
+                                        unsigned int cpumode, u64 period)
 {
        switch (cpumode) {
        case PERF_RECORD_MISC_KERNEL:
-                he->stat.period_sys += period;
+                he_stat->period_sys += period;
                break;
        case PERF_RECORD_MISC_USER:
-                he->stat.period_us += period;
+                he_stat->period_us += period;
                break;
        case PERF_RECORD_MISC_GUEST_KERNEL:
-                he->stat.period_guest_sys += period;
+                he_stat->period_guest_sys += period;
                break;
        case PERF_RECORD_MISC_GUEST_USER:
-                he->stat.period_guest_us += period;
+                he_stat->period_guest_us += period;
                break;
        default:
                break;
@@ -223,10 +222,10 @@ static void he_stat__add_stat(struct he_stat *dest, struct he_stat *src)
        dest->weight            += src->weight;
 }
-static void hist_entry__decay(struct hist_entry *he)
+static void he_stat__decay(struct he_stat *he_stat)
 {
-        he->stat.period = (he->stat.period * 7) / 8;
+        he_stat->period = (he_stat->period * 7) / 8;
-        he->stat.nr_events = (he->stat.nr_events * 7) / 8;
+        he_stat->nr_events = (he_stat->nr_events * 7) / 8;
        /* XXX need decay for weight too? */
 }
@@ -237,7 +236,7 @@ static bool hists__decay_entry(struct hists *hists, struct hist_entry *he)
        if (prev_period == 0)
                return true;
-        hist_entry__decay(he);
+        he_stat__decay(&he->stat);
        if (!he->filtered)
                hists->stats.total_period -= prev_period - he->stat.period;
@@ -342,15 +341,15 @@ static u8 symbol__parent_filter(const struct symbol *parent)
 }
 static struct hist_entry *add_hist_entry(struct hists *hists,
-                                      struct hist_entry *entry,
+                                         struct hist_entry *entry,
-                                      struct addr_location *al,
+                                         struct addr_location *al)
-                                      u64 period,
-                                      u64 weight)
 {
        struct rb_node **p;
        struct rb_node *parent = NULL;
        struct hist_entry *he;
        int64_t cmp;
+        u64 period = entry->stat.period;
+        u64 weight = entry->stat.weight;
        p = &hists->entries_in->rb_node;
@@ -373,7 +372,7 @@ static struct hist_entry *add_hist_entry(struct hists *hists,
                         * This mem info was allocated from machine__resolve_mem
                         * and will not be used anymore.
                         */
-                        free(entry->mem_info);
+                        zfree(&entry->mem_info);
                        /* If the map of an existing hist_entry has
                         * become out-of-date due to an exec() or
@@ -403,7 +402,7 @@ static struct hist_entry *add_hist_entry(struct hists *hists,
        rb_link_node(&he->rb_node_in, parent, p);
        rb_insert_color(&he->rb_node_in, hists->entries_in);
 out:
-        hist_entry__add_cpumode_period(he, al->cpumode, period);
+        he_stat__add_cpumode_period(&he->stat, al->cpumode, period);
        return he;
 }
@@ -437,7 +436,7 @@ struct hist_entry *__hists__add_entry(struct hists *hists,
                .transaction = transaction,
        };
-        return add_hist_entry(hists, &entry, al, period, weight);
+        return add_hist_entry(hists, &entry, al);
 }
 int64_t
@@ -476,8 +475,8 @@ hist_entry__collapse(struct hist_entry *left, struct hist_entry *right)
 void hist_entry__free(struct hist_entry *he)
 {
-        free(he->branch_info);
+        zfree(&he->branch_info);
-        free(he->mem_info);
+        zfree(&he->mem_info);
        free_srcline(he->srcline);
        free(he);
 }
@@ -807,16 +806,6 @@ void hists__filter_by_symbol(struct hists *hists)
        }
 }
-int hist_entry__inc_addr_samples(struct hist_entry *he, int evidx, u64 ip)
-{
-        return symbol__inc_addr_samples(he->ms.sym, he->ms.map, evidx, ip);
-}
-int hist_entry__annotate(struct hist_entry *he, size_t privsize)
-{
-        return symbol__annotate(he->ms.sym, he->ms.map, privsize);
-}
 void events_stats__inc(struct events_stats *stats, u32 type)
 {
        ++stats->nr_events[0];
diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h
index b621347a1585..a59743fa3ef7 100644
--- a/tools/perf/util/hist.h
+++ b/tools/perf/util/hist.h
@@ -111,9 +111,6 @@ size_t events_stats__fprintf(struct events_stats *stats, FILE *fp);
 size_t hists__fprintf(struct hists *hists, bool show_header, int max_rows,
                      int max_cols, float min_pcnt, FILE *fp);
-int hist_entry__inc_addr_samples(struct hist_entry *he, int evidx, u64 addr);
-int hist_entry__annotate(struct hist_entry *he, size_t privsize);
 void hists__filter_by_dso(struct hists *hists);
 void hists__filter_by_thread(struct hists *hists);
 void hists__filter_by_symbol(struct hists *hists);
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index 84cdb072ac83..ded74590b92f 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -9,6 +9,7 @@
 #include "strlist.h"
 #include "thread.h"
 #include <stdbool.h>
+#include <symbol/kallsyms.h>
 #include "unwind.h"
 int machine__init(struct machine *machine, const char *root_dir, pid_t pid)
@@ -26,6 +27,7 @@ int machine__init(struct machine *machine, const char *root_dir, pid_t pid)
        machine->pid = pid;
        machine->symbol_filter = NULL;
+        machine->id_hdr_size = 0;
        machine->root_dir = strdup(root_dir);
        if (machine->root_dir == NULL)
@@ -101,8 +103,7 @@ void machine__exit(struct machine *machine)
        map_groups__exit(&machine->kmaps);
        dsos__delete(&machine->user_dsos);
        dsos__delete(&machine->kernel_dsos);
-        free(machine->root_dir);
+        zfree(&machine->root_dir);
-        machine->root_dir = NULL;
 }
 void machine__delete(struct machine *machine)
@@ -502,15 +503,11 @@ static u64 machine__get_kernel_start_addr(struct machine *machine)
        char path[PATH_MAX];
        struct process_args args;
-        if (machine__is_host(machine)) {
+        if (machine__is_default_guest(machine))
-                filename = "/proc/kallsyms";
+                filename = (char *)symbol_conf.default_guest_kallsyms;
-        } else {
+        else {
-                if (machine__is_default_guest(machine))
+                sprintf(path, "%s/proc/kallsyms", machine->root_dir);
-                        filename = (char *)symbol_conf.default_guest_kallsyms;
+                filename = path;
-                else {
-                        sprintf(path, "%s/proc/kallsyms", machine->root_dir);
-                        filename = path;
-                }
        }
        if (symbol__restricted_filename(filename, "/proc/kallsyms"))
@@ -565,11 +562,10 @@ void machine__destroy_kernel_maps(struct machine *machine)
                         * on one of them.
                         */
                        if (type == MAP__FUNCTION) {
-                                free((char *)kmap->ref_reloc_sym->name);
+                                zfree((char **)&kmap->ref_reloc_sym->name);
-                                kmap->ref_reloc_sym->name = NULL;
+                                zfree(&kmap->ref_reloc_sym);
-                                free(kmap->ref_reloc_sym);
+                        } else
-                        }
+                                kmap->ref_reloc_sym = NULL;
-                        kmap->ref_reloc_sym = NULL;
                }
                map__delete(machine->vmlinux_maps[type]);
@@ -767,8 +763,7 @@ static int map_groups__set_modules_path_dir(struct map_groups *mg,
                                ret = -1;
                                goto out;
                        }
-                        dso__set_long_name(map->dso, long_name);
+                        dso__set_long_name(map->dso, long_name, true);
-                        map->dso->lname_alloc = 1;
                        dso__kernel_module_get_build_id(map->dso, "");
                }
        }
@@ -939,8 +934,7 @@ static int machine__process_kernel_mmap_event(struct machine *machine,
                if (name == NULL)
                        goto out_problem;
-                map->dso->short_name = name;
+                dso__set_short_name(map->dso, name, true);
-                map->dso->sname_alloc = 1;
                map->end = map->start + event->mmap.len;
        } else if (is_kernel_mmap) {
                const char *symbol_name = (event->mmap.filename +
@@ -1320,8 +1314,6 @@ static int machine__resolve_callchain_sample(struct machine *machine,
                                *root_al = al;
                                callchain_cursor_reset(&callchain_cursor);
                        }
-                        if (!symbol_conf.use_callchain)
-                                break;
                }
                err = callchain_cursor_append(&callchain_cursor,
diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
index ef5bc913ca7a..9b9bd719aa19 100644
--- a/tools/perf/util/map.c
+++ b/tools/perf/util/map.c
@@ -11,6 +11,7 @@
 #include "strlist.h"
 #include "vdso.h"
 #include "build-id.h"
+#include "util.h"
 #include <linux/string.h>
 const char *map_type__name[MAP__NR_TYPES] = {
@@ -252,6 +253,22 @@ size_t map__fprintf_dsoname(struct map *map, FILE *fp)
        return fprintf(fp, "%s", dsoname);
 }
+int map__fprintf_srcline(struct map *map, u64 addr, const char *prefix,
+                         FILE *fp)
+{
+        char *srcline;
+        int ret = 0;
+        if (map && map->dso) {
+                srcline = get_srcline(map->dso,
+                                      map__rip_2objdump(map, addr));
+                if (srcline != SRCLINE_UNKNOWN)
+                        ret = fprintf(fp, "%s%s", prefix, srcline);
+                free_srcline(srcline);
+        }
+        return ret;
+}
 /**
 * map__rip_2objdump - convert symbol start address to objdump address.
 * @map: memory map
diff --git a/tools/perf/util/map.h b/tools/perf/util/map.h
index e4e259c3ba16..18068c6b71c1 100644
--- a/tools/perf/util/map.h
+++ b/tools/perf/util/map.h
@@ -103,6 +103,8 @@ struct map *map__clone(struct map *map);
 int map__overlap(struct map *l, struct map *r);
 size_t map__fprintf(struct map *map, FILE *fp);
 size_t map__fprintf_dsoname(struct map *map, FILE *fp);
+int map__fprintf_srcline(struct map *map, u64 addr, const char *prefix,
+                         FILE *fp);
 int map__load(struct map *map, symbol_filter_t filter);
 struct symbol *map__find_symbol(struct map *map,
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 6de6f89c2a61..a7f1b6a91fdd 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -10,7 +10,7 @@
 #include "symbol.h"
 #include "cache.h"
 #include "header.h"
-#include <lk/debugfs.h>
+#include <api/fs/debugfs.h>
 #include "parse-events-bison.h"
 #define YY_EXTRA_TYPE int
 #include "parse-events-flex.h"
@@ -204,7 +204,7 @@ struct tracepoint_path *tracepoint_id_to_path(u64 config)
                                }
                                path->name = malloc(MAX_EVENT_LENGTH);
                                if (!path->name) {
-                                        free(path->system);
+                                        zfree(&path->system);
                                        free(path);
                                        return NULL;
                                }
@@ -236,8 +236,8 @@ struct tracepoint_path *tracepoint_name_to_path(const char *name)
        path->name = strdup(str+1);
        if (path->system == NULL || path->name == NULL) {
-                free(path->system);
+                zfree(&path->system);
-                free(path->name);
+                zfree(&path->name);
                free(path);
                path = NULL;
        }
@@ -269,9 +269,10 @@ const char *event_type(int type)
-static int __add_event(struct list_head *list, int *idx,
+static struct perf_evsel *
-                       struct perf_event_attr *attr,
+__add_event(struct list_head *list, int *idx,
-                       char *name, struct cpu_map *cpus)
+            struct perf_event_attr *attr,
+            char *name, struct cpu_map *cpus)
 {
        struct perf_evsel *evsel;
@@ -279,19 +280,19 @@ static int __add_event(struct list_head *list, int *idx,
        evsel = perf_evsel__new_idx(attr, (*idx)++);
        if (!evsel)
-                return -ENOMEM;
+                return NULL;
        evsel->cpus = cpus;
        if (name)
                evsel->name = strdup(name);
        list_add_tail(&evsel->node, list);
-        return 0;
+        return evsel;
 }
 static int add_event(struct list_head *list, int *idx,
                     struct perf_event_attr *attr, char *name)
 {
-        return __add_event(list, idx, attr, name, NULL);
+        return __add_event(list, idx, attr, name, NULL) ? 0 : -ENOMEM;
 }
 static int parse_aliases(char *str, const char *names[][PERF_EVSEL__MAX_ALIASES], int size)
@@ -633,6 +634,9 @@ int parse_events_add_pmu(struct list_head *list, int *idx,
 {
        struct perf_event_attr attr;
        struct perf_pmu *pmu;
+        struct perf_evsel *evsel;
+        char *unit;
+        double scale;
        pmu = perf_pmu__find(name);
        if (!pmu)
@@ -640,7 +644,7 @@ int parse_events_add_pmu(struct list_head *list, int *idx,
        memset(&attr, 0, sizeof(attr));
-        if (perf_pmu__check_alias(pmu, head_config))
+        if (perf_pmu__check_alias(pmu, head_config, &unit, &scale))
                return -EINVAL;
        /*
@@ -652,8 +656,14 @@ int parse_events_add_pmu(struct list_head *list, int *idx,
        if (perf_pmu__config(pmu, &attr, head_config))
                return -EINVAL;
-        return __add_event(list, idx, &attr, pmu_event_name(head_config),
+        evsel = __add_event(list, idx, &attr, pmu_event_name(head_config),
-                           pmu->cpus);
+                            pmu->cpus);
+        if (evsel) {
+                evsel->unit = unit;
+                evsel->scale = scale;
+        }
+        return evsel ? 0 : -ENOMEM;
 }
 int parse_events__modifier_group(struct list_head *list,
@@ -810,8 +820,7 @@ int parse_events__modifier_event(struct list_head *list, char *str, bool add)
        if (!add && get_event_modifier(&mod, str, NULL))
                return -EINVAL;
-        list_for_each_entry(evsel, list, node) {
+        __evlist__for_each(list, evsel) {
                if (add && get_event_modifier(&mod, str, evsel))
                        return -EINVAL;
@@ -835,7 +844,7 @@ int parse_events_name(struct list_head *list, char *name)
 {
        struct perf_evsel *evsel;
-        list_for_each_entry(evsel, list, node) {
+        __evlist__for_each(list, evsel) {
                if (!evsel->name)
                        evsel->name = strdup(name);
        }
@@ -907,7 +916,7 @@ int parse_events_terms(struct list_head *terms, const char *str)
        ret = parse_events__scanner(str, &data, PE_START_TERMS);
        if (!ret) {
                list_splice(data.terms, terms);
-                free(data.terms);
+                zfree(&data.terms);
                return 0;
        }
diff --git a/tools/perf/util/parse-options.c b/tools/perf/util/parse-options.c
index 31f404a032a9..d22e3f8017dc 100644
--- a/tools/perf/util/parse-options.c
+++ b/tools/perf/util/parse-options.c
@@ -78,6 +78,8 @@ static int get_value(struct parse_opt_ctx_t *p,
        case OPTION_BOOLEAN:
                *(bool *)opt->value = unset ? false : true;
+                if (opt->set)
+                        *(bool *)opt->set = true;
                return 0;
        case OPTION_INCR:
@@ -224,6 +226,24 @@ static int parse_long_opt(struct parse_opt_ctx_t *p, const char *arg,
                        return 0;
                }
                if (!rest) {
+                        if (!prefixcmp(options->long_name, "no-")) {
+                                /*
+                                 * The long name itself starts with "no-", so
+                                 * accept the option without "no-" so that users
+                                 * do not have to enter "no-no-" to get the
+                                 * negation.
+                                 */
+                                rest = skip_prefix(arg, options->long_name + 3);
+                                if (rest) {
+                                        flags |= OPT_UNSET;
+                                        goto match;
+                                }
+                                /* Abbreviated case */
+                                if (!prefixcmp(options->long_name + 3, arg)) {
+                                        flags |= OPT_UNSET;
+                                        goto is_abbreviated;
+                                }
+                        }
                        /* abbreviated? */
                        if (!strncmp(options->long_name, arg, arg_end - arg)) {
 is_abbreviated:
@@ -259,6 +279,7 @@ is_abbreviated:
                        if (!rest)
                                continue;
                }
+match:
                if (*rest) {
                        if (*rest != '=')
                                continue;
diff --git a/tools/perf/util/parse-options.h b/tools/perf/util/parse-options.h
index b0241e28eaf7..cbf0149cf221 100644
--- a/tools/perf/util/parse-options.h
+++ b/tools/perf/util/parse-options.h
@@ -82,6 +82,9 @@ typedef int parse_opt_cb(const struct option *, const char *arg, int unset);
 *   OPTION_{BIT,SET_UINT,SET_PTR} store the {mask,integer,pointer} to put in
 *   the value when met.
 *   CALLBACKS can use it like they want.
+ *
+ * `set`::
+ *   whether an option was set by the user
 */
 struct option {
        enum parse_opt_type type;
@@ -94,6 +97,7 @@ struct option {
        int flags;
        parse_opt_cb *callback;
        intptr_t defval;
+        bool *set;
 };
 #define check_vtype(v, type) ( BUILD_BUG_ON_ZERO(!__builtin_types_compatible_p(typeof(v), type)) + v )
@@ -103,6 +107,10 @@ struct option {
 #define OPT_GROUP(h)                { .type = OPTION_GROUP, .help = (h) }
 #define OPT_BIT(s, l, v, h, b)      { .type = OPTION_BIT, .short_name = (s), .long_name = (l), .value = check_vtype(v, int *), .help = (h), .defval = (b) }
 #define OPT_BOOLEAN(s, l, v, h)     { .type = OPTION_BOOLEAN, .short_name = (s), .long_name = (l), .value = check_vtype(v, bool *), .help = (h) }
+#define OPT_BOOLEAN_SET(s, l, v, os, h) \
+        { .type = OPTION_BOOLEAN, .short_name = (s), .long_name = (l), \
+        .value = check_vtype(v, bool *), .help = (h), \
+        .set = check_vtype(os, bool *)}
 #define OPT_INCR(s, l, v, h)        { .type = OPTION_INCR, .short_name = (s), .long_name = (l), .value = check_vtype(v, int *), .help = (h) }
 #define OPT_SET_UINT(s, l, v, h, i)  { .type = OPTION_SET_UINT, .short_name = (s), .long_name = (l), .value = check_vtype(v, unsigned int *), .help = (h), .defval = (i) }
 #define OPT_SET_PTR(s, l, v, h, p)  { .type = OPTION_SET_PTR, .short_name = (s), .long_name = (l), .value = (v), .help = (h), .defval = (p) }
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index c232d8dd410b..d9cab4d27192 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -1,19 +1,23 @@
 #include <linux/list.h>
 #include <sys/types.h>
-#include <sys/stat.h>
 #include <unistd.h>
 #include <stdio.h>
 #include <dirent.h>
 #include "fs.h"
+#include <locale.h>
 #include "util.h"
 #include "pmu.h"
 #include "parse-events.h"
 #include "cpumap.h"
+#define UNIT_MAX_LEN    31 /* max length for event unit name */
 struct perf_pmu_alias {
        char *name;
        struct list_head terms;
        struct list_head list;
+        char unit[UNIT_MAX_LEN+1];
+        double scale;
 };
 struct perf_pmu_format {
@@ -94,7 +98,80 @@ static int pmu_format(const char *name, struct list_head *format)
        return 0;
 }
-static int perf_pmu__new_alias(struct list_head *list, char *name, FILE *file)
+static int perf_pmu__parse_scale(struct perf_pmu_alias *alias, char *dir, char *name)
+{
+        struct stat st;
+        ssize_t sret;
+        char scale[128];
+        int fd, ret = -1;
+        char path[PATH_MAX];
+        char *lc;
+        snprintf(path, PATH_MAX, "%s/%s.scale", dir, name);
+        fd = open(path, O_RDONLY);
+        if (fd == -1)
+                return -1;
+        if (fstat(fd, &st) < 0)
+                goto error;
+        sret = read(fd, scale, sizeof(scale)-1);
+        if (sret < 0)
+                goto error;
+        scale[sret] = '\0';
+        /*
+         * save current locale
+         */
+        lc = setlocale(LC_NUMERIC, NULL);
+        /*
+         * force to C locale to ensure kernel
+         * scale string is converted correctly.
+         * kernel uses default C locale.
+         */
+        setlocale(LC_NUMERIC, "C");
+        alias->scale = strtod(scale, NULL);
+        /* restore locale */
+        setlocale(LC_NUMERIC, lc);
+        ret = 0;
+error:
+        close(fd);
+        return ret;
+}
+static int perf_pmu__parse_unit(struct perf_pmu_alias *alias, char *dir, char *name)
+{
+        char path[PATH_MAX];
+        ssize_t sret;
+        int fd;
+        snprintf(path, PATH_MAX, "%s/%s.unit", dir, name);
+        fd = open(path, O_RDONLY);
+        if (fd == -1)
+                return -1;
+                sret = read(fd, alias->unit, UNIT_MAX_LEN);
+        if (sret < 0)
+                goto error;
+        close(fd);
+        alias->unit[sret] = '\0';
+        return 0;
+error:
+        close(fd);
+        alias->unit[0] = '\0';
+        return -1;
+}
+static int perf_pmu__new_alias(struct list_head *list, char *dir, char *name, FILE *file)
 {
        struct perf_pmu_alias *alias;
        char buf[256];
@@ -110,6 +187,9 @@ static int perf_pmu__new_alias(struct list_head *list, char *name, FILE *file)
                return -ENOMEM;
        INIT_LIST_HEAD(&alias->terms);
+        alias->scale = 1.0;
+        alias->unit[0] = '\0';
        ret = parse_events_terms(&alias->terms, buf);
        if (ret) {
                free(alias);
@@ -117,7 +197,14 @@ static int perf_pmu__new_alias(struct list_head *list, char *name, FILE *file)
        }
        alias->name = strdup(name);
+        /*
+         * load unit name and scale if available
+         */
+        perf_pmu__parse_unit(alias, dir, name);
+        perf_pmu__parse_scale(alias, dir, name);
        list_add_tail(&alias->list, list);
        return 0;
 }
@@ -129,6 +216,7 @@ static int pmu_aliases_parse(char *dir, struct list_head *head)
 {
        struct dirent *evt_ent;
        DIR *event_dir;
+        size_t len;
        int ret = 0;
        event_dir = opendir(dir);
@@ -143,13 +231,24 @@ static int pmu_aliases_parse(char *dir, struct list_head *head)
                if (!strcmp(name, ".") || !strcmp(name, ".."))
                        continue;
+                /*
+                 * skip .unit and .scale info files
+                 * parsed in perf_pmu__new_alias()
+                 */
+                len = strlen(name);
+                if (len > 5 && !strcmp(name + len - 5, ".unit"))
+                        continue;
+                if (len > 6 && !strcmp(name + len - 6, ".scale"))
+                        continue;
                snprintf(path, PATH_MAX, "%s/%s", dir, name);
                ret = -EINVAL;
                file = fopen(path, "r");
                if (!file)
                        break;
-                ret = perf_pmu__new_alias(head, name, file);
+                ret = perf_pmu__new_alias(head, dir, name, file);
                fclose(file);
        }
@@ -406,7 +505,7 @@ static __u64 pmu_format_value(unsigned long *format, __u64 value)
 /*
 * Setup one of config[12] attr members based on the
- * user input data - temr parameter.
+ * user input data - term parameter.
 */
 static int pmu_config_term(struct list_head *formats,
                           struct perf_event_attr *attr,
@@ -508,16 +607,42 @@ static struct perf_pmu_alias *pmu_find_alias(struct perf_pmu *pmu,
        return NULL;
 }
+static int check_unit_scale(struct perf_pmu_alias *alias,
+                            char **unit, double *scale)
+{
+        /*
+         * Only one term in event definition can
+         * define unit and scale, fail if there's
+         * more than one.
+         */
+        if ((*unit && alias->unit) ||
+            (*scale && alias->scale))
+                return -EINVAL;
+        if (alias->unit)
+                *unit = alias->unit;
+        if (alias->scale)
+                *scale = alias->scale;
+        return 0;
+}
 /*
 * Find alias in the terms list and replace it with the terms
 * defined for the alias
 */
-int perf_pmu__check_alias(struct perf_pmu *pmu, struct list_head *head_terms)
+int perf_pmu__check_alias(struct perf_pmu *pmu, struct list_head *head_terms,
+                          char **unit, double *scale)
 {
        struct parse_events_term *term, *h;
        struct perf_pmu_alias *alias;
        int ret;
+        *unit   = NULL;
+        *scale  = 0;
        list_for_each_entry_safe(term, h, head_terms, list) {
                alias = pmu_find_alias(pmu, term);
                if (!alias)
@@ -525,6 +650,11 @@ int perf_pmu__check_alias(struct perf_pmu *pmu, struct list_head *head_terms)
                ret = pmu_alias_terms(alias, &term->list);
                if (ret)
                        return ret;
+                ret = check_unit_scale(alias, unit, scale);
+                if (ret)
+                        return ret;
                list_del(&term->list);
                free(term);
        }
@@ -625,7 +755,7 @@ void print_pmu_events(const char *event_glob, bool name_only)
                        continue;
                }
                printf("  %-50s [Kernel PMU event]\n", aliases[j]);
-                free(aliases[j]);
+                zfree(&aliases[j]);
                printed++;
        }
        if (printed)
diff --git a/tools/perf/util/pmu.h b/tools/perf/util/pmu.h
index 1179b26f244a..9183380e2038 100644
--- a/tools/perf/util/pmu.h
+++ b/tools/perf/util/pmu.h
@@ -28,7 +28,8 @@ int perf_pmu__config(struct perf_pmu *pmu, struct perf_event_attr *attr,
 int perf_pmu__config_terms(struct list_head *formats,
                           struct perf_event_attr *attr,
                           struct list_head *head_terms);
-int perf_pmu__check_alias(struct perf_pmu *pmu, struct list_head *head_terms);
+int perf_pmu__check_alias(struct perf_pmu *pmu, struct list_head *head_terms,
+                          char **unit, double *scale);
 struct list_head *perf_pmu__alias(struct perf_pmu *pmu,
                                  struct list_head *head_terms);
 int perf_pmu_wrap(void);
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 9c6989ca2bea..a8a9b6cd93a8 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -40,7 +40,7 @@
 #include "color.h"
 #include "symbol.h"
 #include "thread.h"
-#include <lk/debugfs.h>
+#include <api/fs/debugfs.h>
 #include "trace-event.h"        /* For __maybe_unused */
 #include "probe-event.h"
 #include "probe-finder.h"
@@ -72,6 +72,7 @@ static int e_snprintf(char *str, size_t size, const char *format, ...)
 static char *synthesize_perf_probe_point(struct perf_probe_point *pp);
 static int convert_name_to_addr(struct perf_probe_event *pev,
                                const char *exec);
+static void clear_probe_trace_event(struct probe_trace_event *tev);
 static struct machine machine;
 /* Initialize symbol maps and path of vmlinux/modules */
@@ -154,7 +155,7 @@ static struct dso *kernel_get_module_dso(const char *module)
        vmlinux_name = symbol_conf.vmlinux_name;
        if (vmlinux_name) {
-                if (dso__load_vmlinux(dso, map, vmlinux_name, NULL) <= 0)
+                if (dso__load_vmlinux(dso, map, vmlinux_name, false, NULL) <= 0)
                        return NULL;
        } else {
                if (dso__load_vmlinux_path(dso, map, NULL) <= 0) {
@@ -186,6 +187,37 @@ static int init_user_exec(void)
        return ret;
 }
+static int convert_exec_to_group(const char *exec, char **result)
+{
+        char *ptr1, *ptr2, *exec_copy;
+        char buf[64];
+        int ret;
+        exec_copy = strdup(exec);
+        if (!exec_copy)
+                return -ENOMEM;
+        ptr1 = basename(exec_copy);
+        if (!ptr1) {
+                ret = -EINVAL;
+                goto out;
+        }
+        ptr2 = strpbrk(ptr1, "-._");
+        if (ptr2)
+                *ptr2 = '\0';
+        ret = e_snprintf(buf, 64, "%s_%s", PERFPROBE_GROUP, ptr1);
+        if (ret < 0)
+                goto out;
+        *result = strdup(buf);
+        ret = *result ? 0 : -ENOMEM;
+out:
+        free(exec_copy);
+        return ret;
+}
 static int convert_to_perf_probe_point(struct probe_trace_point *tp,
                                        struct perf_probe_point *pp)
 {
@@ -261,6 +293,68 @@ static int kprobe_convert_to_perf_probe(struct probe_trace_point *tp,
        return 0;
 }
+static int get_text_start_address(const char *exec, unsigned long *address)
+{
+        Elf *elf;
+        GElf_Ehdr ehdr;
+        GElf_Shdr shdr;
+        int fd, ret = -ENOENT;
+        fd = open(exec, O_RDONLY);
+        if (fd < 0)
+                return -errno;
+        elf = elf_begin(fd, PERF_ELF_C_READ_MMAP, NULL);
+        if (elf == NULL)
+                return -EINVAL;
+        if (gelf_getehdr(elf, &ehdr) == NULL)
+                goto out;
+        if (!elf_section_by_name(elf, &ehdr, &shdr, ".text", NULL))
+                goto out;
+        *address = shdr.sh_addr - shdr.sh_offset;
+        ret = 0;
+out:
+        elf_end(elf);
+        return ret;
+}
+static int add_exec_to_probe_trace_events(struct probe_trace_event *tevs,
+                                          int ntevs, const char *exec)
+{
+        int i, ret = 0;
+        unsigned long offset, stext = 0;
+        char buf[32];
+        if (!exec)
+                return 0;
+        ret = get_text_start_address(exec, &stext);
+        if (ret < 0)
+                return ret;
+        for (i = 0; i < ntevs && ret >= 0; i++) {
+                offset = tevs[i].point.address - stext;
+                offset += tevs[i].point.offset;
+                tevs[i].point.offset = 0;
+                zfree(&tevs[i].point.symbol);
+                ret = e_snprintf(buf, 32, "0x%lx", offset);
+                if (ret < 0)
+                        break;
+                tevs[i].point.module = strdup(exec);
+                tevs[i].point.symbol = strdup(buf);
+                if (!tevs[i].point.symbol || !tevs[i].point.module) {
+                        ret = -ENOMEM;
+                        break;
+                }
+                tevs[i].uprobes = true;
+        }
+        return ret;
+}
 static int add_module_to_probe_trace_events(struct probe_trace_event *tevs,
                                            int ntevs, const char *module)
 {
@@ -290,12 +384,18 @@ static int add_module_to_probe_trace_events(struct probe_trace_event *tevs,
                }
        }
-        if (tmp)
+        free(tmp);
-                free(tmp);
        return ret;
 }
+static void clear_probe_trace_events(struct probe_trace_event *tevs, int ntevs)
+{
+        int i;
+        for (i = 0; i < ntevs; i++)
+                clear_probe_trace_event(tevs + i);
+}
 /* Try to find perf_probe_event with debuginfo */
 static int try_to_find_probe_trace_events(struct perf_probe_event *pev,
                                          struct probe_trace_event **tevs,
@@ -305,15 +405,6 @@ static int try_to_find_probe_trace_events(struct perf_probe_event *pev,
        struct debuginfo *dinfo;
        int ntevs, ret = 0;
-        if (pev->uprobes) {
-                if (need_dwarf) {
-                        pr_warning("Debuginfo-analysis is not yet supported"
-                                        " with -x/--exec option.\n");
-                        return -ENOSYS;
-                }
-                return convert_name_to_addr(pev, target);
-        }
        dinfo = open_debuginfo(target);
        if (!dinfo) {
@@ -332,9 +423,18 @@ static int try_to_find_probe_trace_events(struct perf_probe_event *pev,
        if (ntevs > 0) {        /* Succeeded to find trace events */
                pr_debug("find %d probe_trace_events.\n", ntevs);
-                if (target)
+                if (target) {
-                        ret = add_module_to_probe_trace_events(*tevs, ntevs,
+                        if (pev->uprobes)
-                                                               target);
+                                ret = add_exec_to_probe_trace_events(*tevs,
+                                                 ntevs, target);
+                        else
+                                ret = add_module_to_probe_trace_events(*tevs,
+                                                 ntevs, target);
+                }
+                if (ret < 0) {
+                        clear_probe_trace_events(*tevs, ntevs);
+                        zfree(tevs);
+                }
                return ret < 0 ? ret : ntevs;
        }
@@ -401,15 +501,13 @@ static int get_real_path(const char *raw_path, const char *comp_dir,
                case EFAULT:
                        raw_path = strchr(++raw_path, '/');
                        if (!raw_path) {
-                                free(*new_path);
+                                zfree(new_path);
-                                *new_path = NULL;
                                return -ENOENT;
                        }
                        continue;
                default:
-                        free(*new_path);
+                        zfree(new_path);
-                        *new_path = NULL;
                        return -errno;
                }
        }
@@ -580,7 +678,7 @@ static int show_available_vars_at(struct debuginfo *dinfo,
                 */
                fprintf(stdout, "\t@<%s+%lu>\n", vl->point.symbol,
                        vl->point.offset);
-                free(vl->point.symbol);
+                zfree(&vl->point.symbol);
                nvars = 0;
                if (vl->vars) {
                        strlist__for_each(node, vl->vars) {
@@ -647,16 +745,14 @@ static int kprobe_convert_to_perf_probe(struct probe_trace_point *tp,
 static int try_to_find_probe_trace_events(struct perf_probe_event *pev,
                                struct probe_trace_event **tevs __maybe_unused,
-                                int max_tevs __maybe_unused, const char *target)
+                                int max_tevs __maybe_unused,
+                                const char *target __maybe_unused)
 {
        if (perf_probe_event_need_dwarf(pev)) {
                pr_warning("Debuginfo-analysis is not supported.\n");
                return -ENOSYS;
        }
-        if (pev->uprobes)
-                return convert_name_to_addr(pev, target);
        return 0;
 }
@@ -678,6 +774,28 @@ int show_available_vars(struct perf_probe_event *pevs __maybe_unused,
 }
 #endif
+void line_range__clear(struct line_range *lr)
+{
+        struct line_node *ln;
+        free(lr->function);
+        free(lr->file);
+        free(lr->path);
+        free(lr->comp_dir);
+        while (!list_empty(&lr->line_list)) {
+                ln = list_first_entry(&lr->line_list, struct line_node, list);
+                list_del(&ln->list);
+                free(ln);
+        }
+        memset(lr, 0, sizeof(*lr));
+}
+void line_range__init(struct line_range *lr)
+{
+        memset(lr, 0, sizeof(*lr));
+        INIT_LIST_HEAD(&lr->line_list);
+}
 static int parse_line_num(char **ptr, int *val, const char *what)
 {
        const char *start = *ptr;
@@ -1278,8 +1396,7 @@ static char *synthesize_perf_probe_point(struct perf_probe_point *pp)
 error:
        pr_debug("Failed to synthesize perf probe point: %s\n",
                 strerror(-ret));
-        if (buf)
+        free(buf);
-                free(buf);
        return NULL;
 }
@@ -1480,34 +1597,25 @@ void clear_perf_probe_event(struct perf_probe_event *pev)
        struct perf_probe_arg_field *field, *next;
        int i;
-        if (pev->event)
+        free(pev->event);
-                free(pev->event);
+        free(pev->group);
-        if (pev->group)
+        free(pp->file);
-                free(pev->group);
+        free(pp->function);
-        if (pp->file)
+        free(pp->lazy_line);
-                free(pp->file);
-        if (pp->function)
-                free(pp->function);
-        if (pp->lazy_line)
-                free(pp->lazy_line);
        for (i = 0; i < pev->nargs; i++) {
-                if (pev->args[i].name)
+                free(pev->args[i].name);
-                        free(pev->args[i].name);
+                free(pev->args[i].var);
-                if (pev->args[i].var)
+                free(pev->args[i].type);
-                        free(pev->args[i].var);
-                if (pev->args[i].type)
-                        free(pev->args[i].type);
                field = pev->args[i].field;
                while (field) {
                        next = field->next;
-                        if (field->name)
+                        zfree(&field->name);
-                                free(field->name);
                        free(field);
                        field = next;
                }
        }
-        if (pev->args)
+        free(pev->args);
-                free(pev->args);
        memset(pev, 0, sizeof(*pev));
 }
@@ -1516,21 +1624,14 @@ static void clear_probe_trace_event(struct probe_trace_event *tev)
        struct probe_trace_arg_ref *ref, *next;
        int i;
-        if (tev->event)
+        free(tev->event);
-                free(tev->event);
+        free(tev->group);
-        if (tev->group)
+        free(tev->point.symbol);
-                free(tev->group);
+        free(tev->point.module);
-        if (tev->point.symbol)
-                free(tev->point.symbol);
-        if (tev->point.module)
-                free(tev->point.module);
        for (i = 0; i < tev->nargs; i++) {
-                if (tev->args[i].name)
+                free(tev->args[i].name);
-                        free(tev->args[i].name);
+                free(tev->args[i].value);
-                if (tev->args[i].value)
+                free(tev->args[i].type);
-                        free(tev->args[i].value);
-                if (tev->args[i].type)
-                        free(tev->args[i].type);
                ref = tev->args[i].ref;
                while (ref) {
                        next = ref->next;
@@ -1538,8 +1639,7 @@ static void clear_probe_trace_event(struct probe_trace_event *tev)
                        ref = next;
                }
        }
-        if (tev->args)
+        free(tev->args);
-                free(tev->args);
        memset(tev, 0, sizeof(*tev));
 }
@@ -1913,14 +2013,29 @@ static int convert_to_probe_trace_events(struct perf_probe_event *pev,
                                          int max_tevs, const char *target)
 {
        struct symbol *sym;
-        int ret = 0, i;
+        int ret, i;
        struct probe_trace_event *tev;
+        if (pev->uprobes && !pev->group) {
+                /* Replace group name if not given */
+                ret = convert_exec_to_group(target, &pev->group);
+                if (ret != 0) {
+                        pr_warning("Failed to make a group name.\n");
+                        return ret;
+                }
+        }
        /* Convert perf_probe_event with debuginfo */
        ret = try_to_find_probe_trace_events(pev, tevs, max_tevs, target);
        if (ret != 0)
                return ret;     /* Found in debuginfo or got an error */
+        if (pev->uprobes) {
+                ret = convert_name_to_addr(pev, target);
+                if (ret < 0)
+                        return ret;
+        }
        /* Allocate trace event buffer */
        tev = *tevs = zalloc(sizeof(struct probe_trace_event));
        if (tev == NULL)
@@ -2056,7 +2171,7 @@ end:
        for (i = 0; i < npevs; i++) {
                for (j = 0; j < pkgs[i].ntevs; j++)
                        clear_probe_trace_event(&pkgs[i].tevs[j]);
-                free(pkgs[i].tevs);
+                zfree(&pkgs[i].tevs);
        }
        free(pkgs);
@@ -2281,7 +2396,7 @@ static int convert_name_to_addr(struct perf_probe_event *pev, const char *exec)
        struct perf_probe_point *pp = &pev->point;
        struct symbol *sym;
        struct map *map = NULL;
-        char *function = NULL, *name = NULL;
+        char *function = NULL;
        int ret = -EINVAL;
        unsigned long long vaddr = 0;
@@ -2297,12 +2412,7 @@ static int convert_name_to_addr(struct perf_probe_event *pev, const char *exec)
                goto out;
        }
-        name = realpath(exec, NULL);
+        map = dso__new_map(exec);
-        if (!name) {
-                pr_warning("Cannot find realpath for %s.\n", exec);
-                goto out;
-        }
-        map = dso__new_map(name);
        if (!map) {
                pr_warning("Cannot find appropriate DSO for %s.\n", exec);
                goto out;
@@ -2367,7 +2477,5 @@ out:
        }
        if (function)
                free(function);
-        if (name)
-                free(name);
        return ret;
 }
diff --git a/tools/perf/util/probe-event.h b/tools/perf/util/probe-event.h
index f9f3de8b4220..fcaf7273e85a 100644
--- a/tools/perf/util/probe-event.h
+++ b/tools/perf/util/probe-event.h
@@ -12,6 +12,7 @@ struct probe_trace_point {
        char            *symbol;        /* Base symbol */
        char            *module;        /* Module name */
        unsigned long   offset;         /* Offset from symbol */
+        unsigned long   address;        /* Actual address of the trace point */
        bool            retprobe;       /* Return probe flag */
 };
@@ -119,6 +120,12 @@ extern void clear_perf_probe_event(struct perf_probe_event *pev);
 /* Command string to line-range */
 extern int parse_line_range_desc(const char *cmd, struct line_range *lr);
+/* Release line range members */
+extern void line_range__clear(struct line_range *lr);
+/* Initialize line range */
+extern void line_range__init(struct line_range *lr);
 /* Internal use: Return kernel/module path */
 extern const char *kernel_get_module_path(const char *module);
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index ffb657ffd327..061edb162b5b 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -226,10 +226,8 @@ struct debuginfo *debuginfo__new(const char *path)
        if (!dbg)
                return NULL;
-        if (debuginfo__init_offline_dwarf(dbg, path) < 0) {
+        if (debuginfo__init_offline_dwarf(dbg, path) < 0)
-                free(dbg);
+                zfree(&dbg);
-                dbg = NULL;
-        }
        return dbg;
 }
@@ -241,10 +239,8 @@ struct debuginfo *debuginfo__new_online_kernel(unsigned long addr)
        if (!dbg)
                return NULL;
-        if (debuginfo__init_online_kernel_dwarf(dbg, (Dwarf_Addr)addr) < 0) {
+        if (debuginfo__init_online_kernel_dwarf(dbg, (Dwarf_Addr)addr) < 0)
-                free(dbg);
+                zfree(&dbg);
-                dbg = NULL;
-        }
        return dbg;
 }
@@ -729,6 +725,7 @@ static int convert_to_trace_point(Dwarf_Die *sp_die, Dwfl_Module *mod,
                return -ENOENT;
        }
        tp->offset = (unsigned long)(paddr - sym.st_value);
+        tp->address = (unsigned long)paddr;
        tp->symbol = strdup(symbol);
        if (!tp->symbol)
                return -ENOMEM;
@@ -1301,8 +1298,7 @@ int debuginfo__find_trace_events(struct debuginfo *dbg,
        ret = debuginfo__find_probes(dbg, &tf.pf);
        if (ret < 0) {
-                free(*tevs);
+                zfree(tevs);
-                *tevs = NULL;
                return ret;
        }
@@ -1413,13 +1409,10 @@ int debuginfo__find_available_vars_at(struct debuginfo *dbg,
        if (ret < 0) {
                /* Free vlist for error */
                while (af.nvls--) {
-                        if (af.vls[af.nvls].point.symbol)
+                        zfree(&af.vls[af.nvls].point.symbol);
-                                free(af.vls[af.nvls].point.symbol);
+                        strlist__delete(af.vls[af.nvls].vars);
-                        if (af.vls[af.nvls].vars)
-                                strlist__delete(af.vls[af.nvls].vars);
                }
-                free(af.vls);
+                zfree(vls);
-                *vls = NULL;
                return ret;
        }
@@ -1523,10 +1516,7 @@ post:
        if (fname) {
                ppt->file = strdup(fname);
                if (ppt->file == NULL) {
-                        if (ppt->function) {
+                        zfree(&ppt->function);
-                                free(ppt->function);
-                                ppt->function = NULL;
-                        }
                        ret = -ENOMEM;
                        goto end;
                }
@@ -1580,8 +1570,7 @@ static int find_line_range_by_line(Dwarf_Die *sp_die, struct line_finder *lf)
                else
                        ret = 0;        /* Lines are not found */
        else {
-                free(lf->lr->path);
+                zfree(&lf->lr->path);
-                lf->lr->path = NULL;
        }
        return ret;
 }
diff --git a/tools/perf/util/python-ext-sources b/tools/perf/util/python-ext-sources
index 239036fb2b2c..595bfc73d2ed 100644
--- a/tools/perf/util/python-ext-sources
+++ b/tools/perf/util/python-ext-sources
@@ -18,4 +18,5 @@ util/cgroup.c
 util/rblist.c
 util/strlist.c
 util/fs.c
+util/trace-event.c
 ../../lib/rbtree.c
diff --git a/tools/perf/util/python.c b/tools/perf/util/python.c
index 4bf8ace7f511..122669c18ff4 100644
--- a/tools/perf/util/python.c
+++ b/tools/perf/util/python.c
@@ -908,9 +908,10 @@ static PyObject *pyrf_evlist__item(PyObject *obj, Py_ssize_t i)
        if (i >= pevlist->evlist.nr_entries)
                return NULL;
-        list_for_each_entry(pos, &pevlist->evlist.entries, node)
+        evlist__for_each(&pevlist->evlist, pos) {
                if (i-- == 0)
                        break;
+        }
        return Py_BuildValue("O", container_of(pos, struct pyrf_evsel, evsel));
 }
diff --git a/tools/perf/util/record.c b/tools/perf/util/record.c
index c8845b107f60..373762501dad 100644
--- a/tools/perf/util/record.c
+++ b/tools/perf/util/record.c
@@ -74,8 +74,7 @@ bool perf_can_sample_identifier(void)
        return perf_probe_api(perf_probe_sample_identifier);
 }
-void perf_evlist__config(struct perf_evlist *evlist,
+void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts)
-                        struct perf_record_opts *opts)
 {
        struct perf_evsel *evsel;
        bool use_sample_identifier = false;
@@ -90,19 +89,19 @@ void perf_evlist__config(struct perf_evlist *evlist,
        if (evlist->cpus->map[0] < 0)
                opts->no_inherit = true;
-        list_for_each_entry(evsel, &evlist->entries, node)
+        evlist__for_each(evlist, evsel)
                perf_evsel__config(evsel, opts);
        if (evlist->nr_entries > 1) {
                struct perf_evsel *first = perf_evlist__first(evlist);
-                list_for_each_entry(evsel, &evlist->entries, node) {
+                evlist__for_each(evlist, evsel) {
                        if (evsel->attr.sample_type == first->attr.sample_type)
                                continue;
                        use_sample_identifier = perf_can_sample_identifier();
                        break;
                }
-                list_for_each_entry(evsel, &evlist->entries, node)
+                evlist__for_each(evlist, evsel)
                        perf_evsel__set_sample_id(evsel, use_sample_identifier);
        }
@@ -123,7 +122,7 @@ static int get_max_rate(unsigned int *rate)
        return filename__read_int(path, (int *) rate);
 }
-static int perf_record_opts__config_freq(struct perf_record_opts *opts)
+static int record_opts__config_freq(struct record_opts *opts)
 {
        bool user_freq = opts->user_freq != UINT_MAX;
        unsigned int max_rate;
@@ -173,7 +172,44 @@ static int perf_record_opts__config_freq(struct perf_record_opts *opts)
        return 0;
 }
-int perf_record_opts__config(struct perf_record_opts *opts)
+int record_opts__config(struct record_opts *opts)
 {
-        return perf_record_opts__config_freq(opts);
+        return record_opts__config_freq(opts);
+}
+bool perf_evlist__can_select_event(struct perf_evlist *evlist, const char *str)
+{
+        struct perf_evlist *temp_evlist;
+        struct perf_evsel *evsel;
+        int err, fd, cpu;
+        bool ret = false;
+        temp_evlist = perf_evlist__new();
+        if (!temp_evlist)
+                return false;
+        err = parse_events(temp_evlist, str);
+        if (err)
+                goto out_delete;
+        evsel = perf_evlist__last(temp_evlist);
+        if (!evlist || cpu_map__empty(evlist->cpus)) {
+                struct cpu_map *cpus = cpu_map__new(NULL);
+                cpu =  cpus ? cpus->map[0] : 0;
+                cpu_map__delete(cpus);
+        } else {
+                cpu = evlist->cpus->map[0];
+        }
+        fd = sys_perf_event_open(&evsel->attr, -1, cpu, -1, 0);
+        if (fd >= 0) {
+                close(fd);
+                ret = true;
+        }
+out_delete:
+        perf_evlist__delete(temp_evlist);
+        return ret;
 }
diff --git a/tools/perf/util/scripting-engines/trace-event-perl.c b/tools/perf/util/scripting-engines/trace-event-perl.c
index d5e5969f6fea..e108207c5de0 100644
--- a/tools/perf/util/scripting-engines/trace-event-perl.c
+++ b/tools/perf/util/scripting-engines/trace-event-perl.c
@@ -194,8 +194,7 @@ static void define_event_symbols(struct event_format *event,
                zero_flag_atom = 0;
                break;
        case PRINT_FIELD:
-                if (cur_field_name)
+                free(cur_field_name);
-                        free(cur_field_name);
                cur_field_name = strdup(args->field.name);
                break;
        case PRINT_FLAGS:
@@ -257,12 +256,9 @@ static inline struct event_format *find_cache_event(struct perf_evsel *evsel)
        return event;
 }
-static void perl_process_tracepoint(union perf_event *perf_event __maybe_unused,
+static void perl_process_tracepoint(struct perf_sample *sample,
-                                    struct perf_sample *sample,
                                    struct perf_evsel *evsel,
-                                    struct machine *machine __maybe_unused,
+                                    struct thread *thread)
-                                    struct thread *thread,
-                                        struct addr_location *al)
 {
        struct format_field *field;
        static char handler[256];
@@ -349,10 +345,7 @@ static void perl_process_tracepoint(union perf_event *perf_event __maybe_unused,
 static void perl_process_event_generic(union perf_event *event,
                                       struct perf_sample *sample,
-                                       struct perf_evsel *evsel,
+                                       struct perf_evsel *evsel)
-                                       struct machine *machine __maybe_unused,
-                                       struct thread *thread __maybe_unused,
-                                           struct addr_location *al __maybe_unused)
 {
        dSP;
@@ -377,12 +370,11 @@ static void perl_process_event_generic(union perf_event *event,
 static void perl_process_event(union perf_event *event,
                               struct perf_sample *sample,
                               struct perf_evsel *evsel,
-                               struct machine *machine,
                               struct thread *thread,
-                                   struct addr_location *al)
+                               struct addr_location *al __maybe_unused)
 {
-        perl_process_tracepoint(event, sample, evsel, machine, thread, al);
+        perl_process_tracepoint(sample, evsel, thread);
-        perl_process_event_generic(event, sample, evsel, machine, thread, al);
+        perl_process_event_generic(event, sample, evsel);
 }
 static void run_start_sub(void)
diff --git a/tools/perf/util/scripting-engines/trace-event-python.c b/tools/perf/util/scripting-engines/trace-event-python.c
index 53c20e7fd900..cd9774df3750 100644
--- a/tools/perf/util/scripting-engines/trace-event-python.c
+++ b/tools/perf/util/scripting-engines/trace-event-python.c
@@ -161,8 +161,7 @@ static void define_event_symbols(struct event_format *event,
                zero_flag_atom = 0;
                break;
        case PRINT_FIELD:
-                if (cur_field_name)
+                free(cur_field_name);
-                        free(cur_field_name);
                cur_field_name = strdup(args->field.name);
                break;
        case PRINT_FLAGS:
@@ -231,13 +230,10 @@ static inline struct event_format *find_cache_event(struct perf_evsel *evsel)
        return event;
 }
-static void python_process_tracepoint(union perf_event *perf_event
+static void python_process_tracepoint(struct perf_sample *sample,
-                                      __maybe_unused,
+                                      struct perf_evsel *evsel,
-                                 struct perf_sample *sample,
+                                      struct thread *thread,
-                                 struct perf_evsel *evsel,
+                                      struct addr_location *al)
-                                 struct machine *machine __maybe_unused,
-                                 struct thread *thread,
-                                 struct addr_location *al)
 {
        PyObject *handler, *retval, *context, *t, *obj, *dict = NULL;
        static char handler_name[256];
@@ -351,11 +347,8 @@ static void python_process_tracepoint(union perf_event *perf_event
        Py_DECREF(t);
 }
-static void python_process_general_event(union perf_event *perf_event
+static void python_process_general_event(struct perf_sample *sample,
-                                         __maybe_unused,
-                                         struct perf_sample *sample,
                                         struct perf_evsel *evsel,
-                                         struct machine *machine __maybe_unused,
                                         struct thread *thread,
                                         struct addr_location *al)
 {
@@ -411,22 +404,19 @@ exit:
        Py_DECREF(t);
 }
-static void python_process_event(union perf_event *perf_event,
+static void python_process_event(union perf_event *event __maybe_unused,
                                 struct perf_sample *sample,
                                 struct perf_evsel *evsel,
-                                 struct machine *machine,
                                 struct thread *thread,
                                 struct addr_location *al)
 {
        switch (evsel->attr.type) {
        case PERF_TYPE_TRACEPOINT:
-                python_process_tracepoint(perf_event, sample, evsel,
+                python_process_tracepoint(sample, evsel, thread, al);
-                                          machine, thread, al);
                break;
        /* Reserve for future process_hw/sw/raw APIs */
        default:
-                python_process_general_event(perf_event, sample, evsel,
+                python_process_general_event(sample, evsel, thread, al);
-                                             machine, thread, al);
        }
 }
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index f36d24a02445..7acc03e8f3b2 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -132,18 +132,18 @@ static void perf_session__delete_threads(struct perf_session *session)
 static void perf_session_env__delete(struct perf_session_env *env)
 {
-        free(env->hostname);
+        zfree(&env->hostname);
-        free(env->os_release);
+        zfree(&env->os_release);
-        free(env->version);
+        zfree(&env->version);
-        free(env->arch);
+        zfree(&env->arch);
-        free(env->cpu_desc);
+        zfree(&env->cpu_desc);
-        free(env->cpuid);
+        zfree(&env->cpuid);
-        free(env->cmdline);
+        zfree(&env->cmdline);
-        free(env->sibling_cores);
+        zfree(&env->sibling_cores);
-        free(env->sibling_threads);
+        zfree(&env->sibling_threads);
-        free(env->numa_nodes);
+        zfree(&env->numa_nodes);
-        free(env->pmu_mappings);
+        zfree(&env->pmu_mappings);
 }
 void perf_session__delete(struct perf_session *session)
@@ -247,27 +247,6 @@ void perf_tool__fill_defaults(struct perf_tool *tool)
        }
 }
 
-void mem_bswap_32(void *src, int byte_size)
-{
-        u32 *m = src;
-        while (byte_size > 0) {
-                *m = bswap_32(*m);
-                byte_size -= sizeof(u32);
-                ++m;
-        }
-}
-void mem_bswap_64(void *src, int byte_size)
-{
-        u64 *m = src;
-        while (byte_size > 0) {
-                *m = bswap_64(*m);
-                byte_size -= sizeof(u64);
-                ++m;
-        }
-}
 static void swap_sample_id_all(union perf_event *event, void *data)
 {
        void *end = (void *) event + event->header.size;
@@ -851,6 +830,7 @@ static struct machine *
                                               struct perf_sample *sample)
 {
        const u8 cpumode = event->header.misc & PERF_RECORD_MISC_CPUMODE_MASK;
+        struct machine *machine;
        if (perf_guest &&
            ((cpumode == PERF_RECORD_MISC_GUEST_KERNEL) ||
@@ -863,7 +843,11 @@ static struct machine *
                else
                        pid = sample->pid;
-                return perf_session__findnew_machine(session, pid);
+                machine = perf_session__find_machine(session, pid);
+                if (!machine)
+                        machine = perf_session__findnew_machine(session,
+                                                DEFAULT_GUEST_KERNEL_ID);
+                return machine;
        }
        return &session->machines.host;
@@ -1158,7 +1142,7 @@ static int __perf_session__process_pipe_events(struct perf_session *session,
        void *buf = NULL;
        int skip = 0;
        u64 head;
-        int err;
+        ssize_t err;
        void *p;
        perf_tool__fill_defaults(tool);
@@ -1400,7 +1384,7 @@ bool perf_session__has_traces(struct perf_session *session, const char *msg)
 {
        struct perf_evsel *evsel;
-        list_for_each_entry(evsel, &session->evlist->entries, node) {
+        evlist__for_each(session->evlist, evsel) {
                if (evsel->attr.type == PERF_TYPE_TRACEPOINT)
                        return true;
        }
@@ -1458,7 +1442,7 @@ size_t perf_session__fprintf_nr_events(struct perf_session *session, FILE *fp)
        ret += events_stats__fprintf(&session->stats, fp);
-        list_for_each_entry(pos, &session->evlist->entries, node) {
+        evlist__for_each(session->evlist, pos) {
                ret += fprintf(fp, "%s stats:\n", perf_evsel__name(pos));
                ret += events_stats__fprintf(&pos->hists.stats, fp);
        }
@@ -1480,35 +1464,30 @@ struct perf_evsel *perf_session__find_first_evtype(struct perf_session *session,
 {
        struct perf_evsel *pos;
-        list_for_each_entry(pos, &session->evlist->entries, node) {
+        evlist__for_each(session->evlist, pos) {
                if (pos->attr.type == type)
                        return pos;
        }
        return NULL;
 }
-void perf_evsel__print_ip(struct perf_evsel *evsel, union perf_event *event,
+void perf_evsel__print_ip(struct perf_evsel *evsel, struct perf_sample *sample,
-                          struct perf_sample *sample, struct machine *machine,
+                          struct addr_location *al,
                          unsigned int print_opts, unsigned int stack_depth)
 {
-        struct addr_location al;
        struct callchain_cursor_node *node;
        int print_ip = print_opts & PRINT_IP_OPT_IP;
        int print_sym = print_opts & PRINT_IP_OPT_SYM;
        int print_dso = print_opts & PRINT_IP_OPT_DSO;
        int print_symoffset = print_opts & PRINT_IP_OPT_SYMOFFSET;
        int print_oneline = print_opts & PRINT_IP_OPT_ONELINE;
+        int print_srcline = print_opts & PRINT_IP_OPT_SRCLINE;
        char s = print_oneline ? ' ' : '\t';
-        if (perf_event__preprocess_sample(event, machine, &al, sample) < 0) {
-                error("problem processing %d event, skipping it.\n",
-                        event->header.type);
-                return;
-        }
        if (symbol_conf.use_callchain && sample->callchain) {
+                struct addr_location node_al;
-                if (machine__resolve_callchain(machine, evsel, al.thread,
+                if (machine__resolve_callchain(al->machine, evsel, al->thread,
                                               sample, NULL, NULL,
                                               PERF_MAX_STACK_DEPTH) != 0) {
                        if (verbose)
@@ -1517,20 +1496,31 @@ void perf_evsel__print_ip(struct perf_evsel *evsel, union perf_event *event,
                }
                callchain_cursor_commit(&callchain_cursor);
+                if (print_symoffset)
+                        node_al = *al;
                while (stack_depth) {
+                        u64 addr = 0;
                        node = callchain_cursor_current(&callchain_cursor);
                        if (!node)
                                break;
+                        if (node->sym && node->sym->ignore)
+                                goto next;
                        if (print_ip)
                                printf("%c%16" PRIx64, s, node->ip);
+                        if (node->map)
+                                addr = node->map->map_ip(node->map, node->ip);
                        if (print_sym) {
                                printf(" ");
                                if (print_symoffset) {
-                                        al.addr = node->ip;
+                                        node_al.addr = addr;
-                                        al.map  = node->map;
+                                        node_al.map  = node->map;
-                                        symbol__fprintf_symname_offs(node->sym, &al, stdout);
+                                        symbol__fprintf_symname_offs(node->sym, &node_al, stdout);
                                } else
                                        symbol__fprintf_symname(node->sym, stdout);
                        }
@@ -1541,32 +1531,42 @@ void perf_evsel__print_ip(struct perf_evsel *evsel, union perf_event *event,
                                printf(")");
                        }
+                        if (print_srcline)
+                                map__fprintf_srcline(node->map, addr, "\n  ",
+                                                     stdout);
                        if (!print_oneline)
                                printf("\n");
-                        callchain_cursor_advance(&callchain_cursor);
                        stack_depth--;
+next:
+                        callchain_cursor_advance(&callchain_cursor);
                }
        } else {
+                if (al->sym && al->sym->ignore)
+                        return;
                if (print_ip)
                        printf("%16" PRIx64, sample->ip);
                if (print_sym) {
                        printf(" ");
                        if (print_symoffset)
-                                symbol__fprintf_symname_offs(al.sym, &al,
+                                symbol__fprintf_symname_offs(al->sym, al,
                                                             stdout);
                        else
-                                symbol__fprintf_symname(al.sym, stdout);
+                                symbol__fprintf_symname(al->sym, stdout);
                }
                if (print_dso) {
                        printf(" (");
-                        map__fprintf_dsoname(al.map, stdout);
+                        map__fprintf_dsoname(al->map, stdout);
                        printf(")");
                }
+                if (print_srcline)
+                        map__fprintf_srcline(al->map, al->addr, "\n  ", stdout);
        }
 }
diff --git a/tools/perf/util/session.h b/tools/perf/util/session.h
index 50f640958f0f..3140f8ae6148 100644
--- a/tools/perf/util/session.h
+++ b/tools/perf/util/session.h
@@ -1,6 +1,7 @@
 #ifndef __PERF_SESSION_H
 #define __PERF_SESSION_H
+#include "trace-event.h"
 #include "hist.h"
 #include "event.h"
 #include "header.h"
@@ -32,7 +33,7 @@ struct perf_session {
        struct perf_header      header;
        struct machines         machines;
        struct perf_evlist      *evlist;
-        struct pevent           *pevent;
+        struct trace_event      tevent;
        struct events_stats     stats;
        bool                    repipe;
        struct ordered_samples  ordered_samples;
@@ -44,6 +45,7 @@ struct perf_session {
 #define PRINT_IP_OPT_DSO                (1<<2)
 #define PRINT_IP_OPT_SYMOFFSET  (1<<3)
 #define PRINT_IP_OPT_ONELINE    (1<<4)
+#define PRINT_IP_OPT_SRCLINE    (1<<5)
 struct perf_tool;
@@ -72,8 +74,6 @@ int perf_session__resolve_callchain(struct perf_session *session,
 bool perf_session__has_traces(struct perf_session *session, const char *msg);
-void mem_bswap_64(void *src, int byte_size);
-void mem_bswap_32(void *src, int byte_size);
 void perf_event__attr_swap(struct perf_event_attr *attr);
 int perf_session__create_kernel_maps(struct perf_session *session);
@@ -105,8 +105,8 @@ size_t perf_session__fprintf_nr_events(struct perf_session *session, FILE *fp);
 struct perf_evsel *perf_session__find_first_evtype(struct perf_session *session,
                                            unsigned int type);
-void perf_evsel__print_ip(struct perf_evsel *evsel, union perf_event *event,
+void perf_evsel__print_ip(struct perf_evsel *evsel, struct perf_sample *sample,
-                          struct perf_sample *sample, struct machine *machine,
+                          struct addr_location *al,
                          unsigned int print_opts, unsigned int stack_depth);
 int perf_session__cpu_bitmap(struct perf_session *session,
diff --git a/tools/perf/util/setup.py b/tools/perf/util/setup.py
index 58ea5ca6c255..d0aee4b9dfd4 100644
--- a/tools/perf/util/setup.py
+++ b/tools/perf/util/setup.py
@@ -25,7 +25,7 @@ cflags += ['-fno-strict-aliasing', '-Wno-write-strings', '-Wno-unused-parameter'
 build_lib = getenv('PYTHON_EXTBUILD_LIB')
 build_tmp = getenv('PYTHON_EXTBUILD_TMP')
 libtraceevent = getenv('LIBTRACEEVENT')
-liblk = getenv('LIBLK')
+libapikfs = getenv('LIBAPIKFS')
 ext_sources = [f.strip() for f in file('util/python-ext-sources')
                                if len(f.strip()) > 0 and f[0] != '#']
@@ -34,7 +34,7 @@ perf = Extension('perf',
                  sources = ext_sources,
                  include_dirs = ['util/include'],
                  extra_compile_args = cflags,
-                  extra_objects = [libtraceevent, liblk],
+                  extra_objects = [libtraceevent, libapikfs],
                 )
 setup(name='perf',
diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
index 8b0bb1f4494a..635cd8f8b22e 100644
--- a/tools/perf/util/sort.c
+++ b/tools/perf/util/sort.c
@@ -13,6 +13,7 @@ int		have_ignore_callees = 0;
 int             sort__need_collapse = 0;
 int             sort__has_parent = 0;
 int             sort__has_sym = 0;
+int             sort__has_dso = 0;
 enum sort_mode  sort__mode = SORT_MODE__NORMAL;
 enum sort_type  sort__first_dimension;
@@ -161,6 +162,11 @@ struct sort_entry sort_dso = {
 /* --sort symbol */
+static int64_t _sort__addr_cmp(u64 left_ip, u64 right_ip)
+{
+        return (int64_t)(right_ip - left_ip);
+}
 static int64_t _sort__sym_cmp(struct symbol *sym_l, struct symbol *sym_r)
 {
        u64 ip_l, ip_r;
@@ -183,15 +189,17 @@ sort__sym_cmp(struct hist_entry *left, struct hist_entry *right)
        int64_t ret;
        if (!left->ms.sym && !right->ms.sym)
-                return right->level - left->level;
+                return _sort__addr_cmp(left->ip, right->ip);
        /*
         * comparing symbol address alone is not enough since it's a
         * relative address within a dso.
         */
-        ret = sort__dso_cmp(left, right);
+        if (!sort__has_dso) {
-        if (ret != 0)
+                ret = sort__dso_cmp(left, right);
-                return ret;
+                if (ret != 0)
+                        return ret;
+        }
        return _sort__sym_cmp(left->ms.sym, right->ms.sym);
 }
@@ -372,7 +380,7 @@ sort__sym_from_cmp(struct hist_entry *left, struct hist_entry *right)
        struct addr_map_symbol *from_r = &right->branch_info->from;
        if (!from_l->sym && !from_r->sym)
-                return right->level - left->level;
+                return _sort__addr_cmp(from_l->addr, from_r->addr);
        return _sort__sym_cmp(from_l->sym, from_r->sym);
 }
@@ -384,7 +392,7 @@ sort__sym_to_cmp(struct hist_entry *left, struct hist_entry *right)
        struct addr_map_symbol *to_r = &right->branch_info->to;
        if (!to_l->sym && !to_r->sym)
-                return right->level - left->level;
+                return _sort__addr_cmp(to_l->addr, to_r->addr);
        return _sort__sym_cmp(to_l->sym, to_r->sym);
 }
@@ -1056,6 +1064,8 @@ int sort_dimension__add(const char *tok)
                        sort__has_parent = 1;
                } else if (sd->entry == &sort_sym) {
                        sort__has_sym = 1;
+                } else if (sd->entry == &sort_dso) {
+                        sort__has_dso = 1;
                }
                __sort_dimension__add(sd, i);
diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
index d11aefbc4b8d..f3e4bc5fe5d2 100644
--- a/tools/perf/util/srcline.c
+++ b/tools/perf/util/srcline.c
@@ -129,7 +129,7 @@ static struct a2l_data *addr2line_init(const char *path)
 out:
        if (a2l) {
-                free((void *)a2l->input);
+                zfree((char **)&a2l->input);
                free(a2l);
        }
        bfd_close(abfd);
@@ -140,24 +140,30 @@ static void addr2line_cleanup(struct a2l_data *a2l)
 {
        if (a2l->abfd)
                bfd_close(a2l->abfd);
-        free((void *)a2l->input);
+        zfree((char **)&a2l->input);
-        free(a2l->syms);
+        zfree(&a2l->syms);
        free(a2l);
 }
 static int addr2line(const char *dso_name, unsigned long addr,
-                     char **file, unsigned int *line)
+                     char **file, unsigned int *line, struct dso *dso)
 {
        int ret = 0;
-        struct a2l_data *a2l;
+        struct a2l_data *a2l = dso->a2l;
+        if (!a2l) {
+                dso->a2l = addr2line_init(dso_name);
+                a2l = dso->a2l;
+        }
-        a2l = addr2line_init(dso_name);
        if (a2l == NULL) {
                pr_warning("addr2line_init failed for %s\n", dso_name);
                return 0;
        }
        a2l->addr = addr;
+        a2l->found = false;
        bfd_map_over_sections(a2l->abfd, find_address_in_section, a2l);
        if (a2l->found && a2l->filename) {
@@ -168,14 +174,26 @@ static int addr2line(const char *dso_name, unsigned long addr,
                        ret = 1;
        }
-        addr2line_cleanup(a2l);
        return ret;
 }
+void dso__free_a2l(struct dso *dso)
+{
+        struct a2l_data *a2l = dso->a2l;
+        if (!a2l)
+                return;
+        addr2line_cleanup(a2l);
+        dso->a2l = NULL;
+}
 #else /* HAVE_LIBBFD_SUPPORT */
 static int addr2line(const char *dso_name, unsigned long addr,
-                     char **file, unsigned int *line_nr)
+                     char **file, unsigned int *line_nr,
+                     struct dso *dso __maybe_unused)
 {
        FILE *fp;
        char cmd[PATH_MAX];
@@ -219,42 +237,58 @@ out:
        pclose(fp);
        return ret;
 }
+void dso__free_a2l(struct dso *dso __maybe_unused)
+{
+}
 #endif /* HAVE_LIBBFD_SUPPORT */
+/*
+ * Number of addr2line failures (without success) before disabling it for that
+ * dso.
+ */
+#define A2L_FAIL_LIMIT 123
 char *get_srcline(struct dso *dso, unsigned long addr)
 {
        char *file = NULL;
        unsigned line = 0;
        char *srcline;
-        char *dso_name = dso->long_name;
+        const char *dso_name;
-        size_t size;
        if (!dso->has_srcline)
                return SRCLINE_UNKNOWN;
+        if (dso->symsrc_filename)
+                dso_name = dso->symsrc_filename;
+        else
+                dso_name = dso->long_name;
        if (dso_name[0] == '[')
                goto out;
        if (!strncmp(dso_name, "/tmp/perf-", 10))
                goto out;
-        if (!addr2line(dso_name, addr, &file, &line))
+        if (!addr2line(dso_name, addr, &file, &line, dso))
                goto out;
-        /* just calculate actual length */
+        if (asprintf(&srcline, "%s:%u", file, line) < 0) {
-        size = snprintf(NULL, 0, "%s:%u", file, line) + 1;
+                free(file);
+                goto out;
+        }
-        srcline = malloc(size);
+        dso->a2l_fails = 0;
-        if (srcline)
-                snprintf(srcline, size, "%s:%u", file, line);
-        else
-                srcline = SRCLINE_UNKNOWN;
        free(file);
        return srcline;
 out:
-        dso->has_srcline = 0;
+        if (dso->a2l_fails && ++dso->a2l_fails > A2L_FAIL_LIMIT) {
+                dso->has_srcline = 0;
+                dso__free_a2l(dso);
+        }
        return SRCLINE_UNKNOWN;
 }
diff --git a/tools/perf/util/strbuf.c b/tools/perf/util/strbuf.c
index cfa906882e2c..4abe23550c73 100644
--- a/tools/perf/util/strbuf.c
+++ b/tools/perf/util/strbuf.c
@@ -28,7 +28,7 @@ void strbuf_init(struct strbuf *sb, ssize_t hint)
 void strbuf_release(struct strbuf *sb)
 {
        if (sb->alloc) {
-                free(sb->buf);
+                zfree(&sb->buf);
                strbuf_init(sb, 0);
        }
 }
diff --git a/tools/perf/util/strfilter.c b/tools/perf/util/strfilter.c
index 3edd0538161f..79a757a2a15c 100644
--- a/tools/perf/util/strfilter.c
+++ b/tools/perf/util/strfilter.c
@@ -14,7 +14,7 @@ static void strfilter_node__delete(struct strfilter_node *node)
 {
        if (node) {
                if (node->p && !is_operator(*node->p))
-                        free((char *)node->p);
+                        zfree((char **)&node->p);
                strfilter_node__delete(node->l);
                strfilter_node__delete(node->r);
                free(node);
diff --git a/tools/perf/util/string.c b/tools/perf/util/string.c
index f0b0c008c507..2553e5b55b89 100644
--- a/tools/perf/util/string.c
+++ b/tools/perf/util/string.c
@@ -128,7 +128,7 @@ void argv_free(char **argv)
 {
        char **p;
        for (p = argv; *p; p++)
-                free(*p);
+                zfree(p);
        free(argv);
 }
diff --git a/tools/perf/util/strlist.c b/tools/perf/util/strlist.c
index eabdce0a2daa..71f9d102b96f 100644
--- a/tools/perf/util/strlist.c
+++ b/tools/perf/util/strlist.c
@@ -5,6 +5,7 @@
 */
 #include "strlist.h"
+#include "util.h"
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -38,7 +39,7 @@ out_delete:
 static void str_node__delete(struct str_node *snode, bool dupstr)
 {
        if (dupstr)
-                free((void *)snode->s);
+                zfree((char **)&snode->s);
        free(snode);
 }
diff --git a/tools/perf/util/svghelper.c b/tools/perf/util/svghelper.c
index 96c866045d60..43262b83c541 100644
--- a/tools/perf/util/svghelper.c
+++ b/tools/perf/util/svghelper.c
@@ -17,8 +17,12 @@
 #include <stdlib.h>
 #include <unistd.h>
 #include <string.h>
+#include <linux/bitops.h>
+#include "perf.h"
 #include "svghelper.h"
+#include "util.h"
+#include "cpumap.h"
 static u64 first_time, last_time;
 static u64 turbo_frequency, max_freq;
@@ -28,6 +32,8 @@ static u64 turbo_frequency, max_freq;
 #define SLOT_HEIGHT 25.0
 int svg_page_width = 1000;
+u64 svg_highlight;
+const char *svg_highlight_name;
 #define MIN_TEXT_SIZE 0.01
@@ -39,9 +45,14 @@ static double cpu2slot(int cpu)
        return 2 * cpu + 1;
 }
+static int *topology_map;
 static double cpu2y(int cpu)
 {
-        return cpu2slot(cpu) * SLOT_MULT;
+        if (topology_map)
+                return cpu2slot(topology_map[cpu]) * SLOT_MULT;
+        else
+                return cpu2slot(cpu) * SLOT_MULT;
 }
 static double time2pixels(u64 __time)
@@ -95,6 +106,7 @@ void open_svg(const char *filename, int cpus, int rows, u64 start, u64 end)
        total_height = (1 + rows + cpu2slot(cpus)) * SLOT_MULT;
        fprintf(svgfile, "<?xml version=\"1.0\" standalone=\"no\"?> \n");
+        fprintf(svgfile, "<!DOCTYPE svg SYSTEM \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n");
        fprintf(svgfile, "<svg width=\"%i\" height=\"%" PRIu64 "\" version=\"1.1\" xmlns=\"http://www.w3.org/2000/svg\">\n", svg_page_width, total_height);
        fprintf(svgfile, "<defs>\n  <style type=\"text/css\">\n    <![CDATA[\n");
@@ -103,6 +115,7 @@ void open_svg(const char *filename, int cpus, int rows, u64 start, u64 end)
        fprintf(svgfile, "      rect.process  { fill:rgb(180,180,180); fill-opacity:0.9; stroke-width:1;   stroke:rgb(  0,  0,  0); } \n");
        fprintf(svgfile, "      rect.process2 { fill:rgb(180,180,180); fill-opacity:0.9; stroke-width:0;   stroke:rgb(  0,  0,  0); } \n");
        fprintf(svgfile, "      rect.sample   { fill:rgb(  0,  0,255); fill-opacity:0.8; stroke-width:0;   stroke:rgb(  0,  0,  0); } \n");
+        fprintf(svgfile, "      rect.sample_hi{ fill:rgb(255,128,  0); fill-opacity:0.8; stroke-width:0;   stroke:rgb(  0,  0,  0); } \n");
        fprintf(svgfile, "      rect.blocked  { fill:rgb(255,  0,  0); fill-opacity:0.5; stroke-width:0;   stroke:rgb(  0,  0,  0); } \n");
        fprintf(svgfile, "      rect.waiting  { fill:rgb(224,214,  0); fill-opacity:0.8; stroke-width:0;   stroke:rgb(  0,  0,  0); } \n");
        fprintf(svgfile, "      rect.WAITING  { fill:rgb(255,214, 48); fill-opacity:0.6; stroke-width:0;   stroke:rgb(  0,  0,  0); } \n");
@@ -128,14 +141,42 @@ void svg_box(int Yslot, u64 start, u64 end, const char *type)
                time2pixels(start), time2pixels(end)-time2pixels(start), Yslot * SLOT_MULT, SLOT_HEIGHT, type);
 }
-void svg_sample(int Yslot, int cpu, u64 start, u64 end)
+static char *time_to_string(u64 duration);
+void svg_blocked(int Yslot, int cpu, u64 start, u64 end, const char *backtrace)
+{
+        if (!svgfile)
+                return;
+        fprintf(svgfile, "<g>\n");
+        fprintf(svgfile, "<title>#%d blocked %s</title>\n", cpu,
+                time_to_string(end - start));
+        if (backtrace)
+                fprintf(svgfile, "<desc>Blocked on:\n%s</desc>\n", backtrace);
+        svg_box(Yslot, start, end, "blocked");
+        fprintf(svgfile, "</g>\n");
+}
+void svg_running(int Yslot, int cpu, u64 start, u64 end, const char *backtrace)
 {
        double text_size;
+        const char *type;
        if (!svgfile)
                return;
-        fprintf(svgfile, "<rect x=\"%4.8f\" width=\"%4.8f\" y=\"%4.1f\" height=\"%4.1f\" class=\"sample\"/>\n",
+        if (svg_highlight && end - start > svg_highlight)
-                time2pixels(start), time2pixels(end)-time2pixels(start), Yslot * SLOT_MULT, SLOT_HEIGHT);
+                type = "sample_hi";
+        else
+                type = "sample";
+        fprintf(svgfile, "<g>\n");
+        fprintf(svgfile, "<title>#%d running %s</title>\n",
+                cpu, time_to_string(end - start));
+        if (backtrace)
+                fprintf(svgfile, "<desc>Switched because:\n%s</desc>\n", backtrace);
+        fprintf(svgfile, "<rect x=\"%4.8f\" width=\"%4.8f\" y=\"%4.1f\" height=\"%4.1f\" class=\"%s\"/>\n",
+                time2pixels(start), time2pixels(end)-time2pixels(start), Yslot * SLOT_MULT, SLOT_HEIGHT,
+                type);
        text_size = (time2pixels(end)-time2pixels(start));
        if (cpu > 9)
@@ -148,6 +189,7 @@ void svg_sample(int Yslot, int cpu, u64 start, u64 end)
                fprintf(svgfile, "<text x=\"%1.8f\" y=\"%1.8f\" font-size=\"%1.8fpt\">%i</text>\n",
                        time2pixels(start), Yslot *  SLOT_MULT + SLOT_HEIGHT - 1, text_size,  cpu + 1);
+        fprintf(svgfile, "</g>\n");
 }
 static char *time_to_string(u64 duration)
@@ -168,7 +210,7 @@ static char *time_to_string(u64 duration)
        return text;
 }
-void svg_waiting(int Yslot, u64 start, u64 end)
+void svg_waiting(int Yslot, int cpu, u64 start, u64 end, const char *backtrace)
 {
        char *text;
        const char *style;
@@ -192,6 +234,9 @@ void svg_waiting(int Yslot, u64 start, u64 end)
        font_size = round_text_size(font_size);
        fprintf(svgfile, "<g transform=\"translate(%4.8f,%4.8f)\">\n", time2pixels(start), Yslot * SLOT_MULT);
+        fprintf(svgfile, "<title>#%d waiting %s</title>\n", cpu, time_to_string(end - start));
+        if (backtrace)
+                fprintf(svgfile, "<desc>Waiting on:\n%s</desc>\n", backtrace);
        fprintf(svgfile, "<rect x=\"0\" width=\"%4.8f\" y=\"0\" height=\"%4.1f\" class=\"%s\"/>\n",
                time2pixels(end)-time2pixels(start), SLOT_HEIGHT, style);
        if (font_size > MIN_TEXT_SIZE)
@@ -242,28 +287,42 @@ void svg_cpu_box(int cpu, u64 __max_freq, u64 __turbo_freq)
        max_freq = __max_freq;
        turbo_frequency = __turbo_freq;
+        fprintf(svgfile, "<g>\n");
        fprintf(svgfile, "<rect x=\"%4.8f\" width=\"%4.8f\" y=\"%4.1f\" height=\"%4.1f\" class=\"cpu\"/>\n",
                time2pixels(first_time),
                time2pixels(last_time)-time2pixels(first_time),
                cpu2y(cpu), SLOT_MULT+SLOT_HEIGHT);
-        sprintf(cpu_string, "CPU %i", (int)cpu+1);
+        sprintf(cpu_string, "CPU %i", (int)cpu);
        fprintf(svgfile, "<text x=\"%4.8f\" y=\"%4.8f\">%s</text>\n",
                10+time2pixels(first_time), cpu2y(cpu) + SLOT_HEIGHT/2, cpu_string);
        fprintf(svgfile, "<text transform=\"translate(%4.8f,%4.8f)\" font-size=\"1.25pt\">%s</text>\n",
                10+time2pixels(first_time), cpu2y(cpu) + SLOT_MULT + SLOT_HEIGHT - 4, cpu_model());
+        fprintf(svgfile, "</g>\n");
 }
-void svg_process(int cpu, u64 start, u64 end, const char *type, const char *name)
+void svg_process(int cpu, u64 start, u64 end, int pid, const char *name, const char *backtrace)
 {
        double width;
+        const char *type;
        if (!svgfile)
                return;
+        if (svg_highlight && end - start >= svg_highlight)
+                type = "sample_hi";
+        else if (svg_highlight_name && strstr(name, svg_highlight_name))
+                type = "sample_hi";
+        else
+                type = "sample";
        fprintf(svgfile, "<g transform=\"translate(%4.8f,%4.8f)\">\n", time2pixels(start), cpu2y(cpu));
+        fprintf(svgfile, "<title>%d %s running %s</title>\n", pid, name, time_to_string(end - start));
+        if (backtrace)
+                fprintf(svgfile, "<desc>Switched because:\n%s</desc>\n", backtrace);
        fprintf(svgfile, "<rect x=\"0\" width=\"%4.8f\" y=\"0\" height=\"%4.1f\" class=\"%s\"/>\n",
                time2pixels(end)-time2pixels(start), SLOT_MULT+SLOT_HEIGHT, type);
        width = time2pixels(end)-time2pixels(start);
@@ -288,6 +347,8 @@ void svg_cstate(int cpu, u64 start, u64 end, int type)
                return;
+        fprintf(svgfile, "<g>\n");
        if (type > 6)
                type = 6;
        sprintf(style, "c%i", type);
@@ -306,6 +367,8 @@ void svg_cstate(int cpu, u64 start, u64 end, int type)
        if (width > MIN_TEXT_SIZE)
                fprintf(svgfile, "<text x=\"%4.8f\" y=\"%4.8f\" font-size=\"%3.8fpt\">C%i</text>\n",
                        time2pixels(start), cpu2y(cpu)+width, width, type);
+        fprintf(svgfile, "</g>\n");
 }
 static char *HzToHuman(unsigned long hz)
@@ -339,6 +402,8 @@ void svg_pstate(int cpu, u64 start, u64 end, u64 freq)
        if (!svgfile)
                return;
+        fprintf(svgfile, "<g>\n");
        if (max_freq)
                height = freq * 1.0 / max_freq * (SLOT_HEIGHT + SLOT_MULT);
        height = 1 + cpu2y(cpu) + SLOT_MULT + SLOT_HEIGHT - height;
@@ -347,10 +412,11 @@ void svg_pstate(int cpu, u64 start, u64 end, u64 freq)
        fprintf(svgfile, "<text x=\"%4.8f\" y=\"%4.8f\" font-size=\"0.25pt\">%s</text>\n",
                time2pixels(start), height+0.9, HzToHuman(freq));
+        fprintf(svgfile, "</g>\n");
 }
-void svg_partial_wakeline(u64 start, int row1, char *desc1, int row2, char *desc2)
+void svg_partial_wakeline(u64 start, int row1, char *desc1, int row2, char *desc2, const char *backtrace)
 {
        double height;
@@ -358,6 +424,15 @@ void svg_partial_wakeline(u64 start, int row1, char *desc1, int row2, char *desc
                return;
+        fprintf(svgfile, "<g>\n");
+        fprintf(svgfile, "<title>%s wakes up %s</title>\n",
+                desc1 ? desc1 : "?",
+                desc2 ? desc2 : "?");
+        if (backtrace)
+                fprintf(svgfile, "<desc>%s</desc>\n", backtrace);
        if (row1 < row2) {
                if (row1) {
                        fprintf(svgfile, "<line x1=\"%4.8f\" y1=\"%4.2f\" x2=\"%4.8f\" y2=\"%4.2f\" style=\"stroke:rgb(32,255,32);stroke-width:0.009\"/>\n",
@@ -395,9 +470,11 @@ void svg_partial_wakeline(u64 start, int row1, char *desc1, int row2, char *desc
        if (row1)
                fprintf(svgfile, "<circle  cx=\"%4.8f\" cy=\"%4.2f\" r = \"0.01\"  style=\"fill:rgb(32,255,32)\"/>\n",
                        time2pixels(start), height);
+        fprintf(svgfile, "</g>\n");
 }
-void svg_wakeline(u64 start, int row1, int row2)
+void svg_wakeline(u64 start, int row1, int row2, const char *backtrace)
 {
        double height;
@@ -405,6 +482,11 @@ void svg_wakeline(u64 start, int row1, int row2)
                return;
+        fprintf(svgfile, "<g>\n");
+        if (backtrace)
+                fprintf(svgfile, "<desc>%s</desc>\n", backtrace);
        if (row1 < row2)
                fprintf(svgfile, "<line x1=\"%4.8f\" y1=\"%4.2f\" x2=\"%4.8f\" y2=\"%4.2f\" style=\"stroke:rgb(32,255,32);stroke-width:0.009\"/>\n",
                        time2pixels(start), row1 * SLOT_MULT + SLOT_HEIGHT,  time2pixels(start), row2 * SLOT_MULT);
@@ -417,17 +499,28 @@ void svg_wakeline(u64 start, int row1, int row2)
                height += SLOT_HEIGHT;
        fprintf(svgfile, "<circle  cx=\"%4.8f\" cy=\"%4.2f\" r = \"0.01\"  style=\"fill:rgb(32,255,32)\"/>\n",
                        time2pixels(start), height);
+        fprintf(svgfile, "</g>\n");
 }
-void svg_interrupt(u64 start, int row)
+void svg_interrupt(u64 start, int row, const char *backtrace)
 {
        if (!svgfile)
                return;
+        fprintf(svgfile, "<g>\n");
+        fprintf(svgfile, "<title>Wakeup from interrupt</title>\n");
+        if (backtrace)
+                fprintf(svgfile, "<desc>%s</desc>\n", backtrace);
        fprintf(svgfile, "<circle  cx=\"%4.8f\" cy=\"%4.2f\" r = \"0.01\"  style=\"fill:rgb(255,128,128)\"/>\n",
                        time2pixels(start), row * SLOT_MULT);
        fprintf(svgfile, "<circle  cx=\"%4.8f\" cy=\"%4.2f\" r = \"0.01\"  style=\"fill:rgb(255,128,128)\"/>\n",
                        time2pixels(start), row * SLOT_MULT + SLOT_HEIGHT);
+        fprintf(svgfile, "</g>\n");
 }
 void svg_text(int Yslot, u64 start, const char *text)
@@ -455,6 +548,7 @@ void svg_legenda(void)
        if (!svgfile)
                return;
+        fprintf(svgfile, "<g>\n");
        svg_legenda_box(0,      "Running", "sample");
        svg_legenda_box(100,    "Idle","c1");
        svg_legenda_box(200,    "Deeper Idle", "c3");
@@ -462,6 +556,7 @@ void svg_legenda(void)
        svg_legenda_box(550,    "Sleeping", "process2");
        svg_legenda_box(650,    "Waiting for cpu", "waiting");
        svg_legenda_box(800,    "Blocked on IO", "blocked");
+        fprintf(svgfile, "</g>\n");
 }
 void svg_time_grid(void)
@@ -499,3 +594,123 @@ void svg_close(void)
                svgfile = NULL;
        }
 }
+#define cpumask_bits(maskp) ((maskp)->bits)
+typedef struct { DECLARE_BITMAP(bits, MAX_NR_CPUS); } cpumask_t;
+struct topology {
+        cpumask_t *sib_core;
+        int sib_core_nr;
+        cpumask_t *sib_thr;
+        int sib_thr_nr;
+};
+static void scan_thread_topology(int *map, struct topology *t, int cpu, int *pos)
+{
+        int i;
+        int thr;
+        for (i = 0; i < t->sib_thr_nr; i++) {
+                if (!test_bit(cpu, cpumask_bits(&t->sib_thr[i])))
+                        continue;
+                for_each_set_bit(thr,
+                                 cpumask_bits(&t->sib_thr[i]),
+                                 MAX_NR_CPUS)
+                        if (map[thr] == -1)
+                                map[thr] = (*pos)++;
+        }
+}
+static void scan_core_topology(int *map, struct topology *t)
+{
+        int pos = 0;
+        int i;
+        int cpu;
+        for (i = 0; i < t->sib_core_nr; i++)
+                for_each_set_bit(cpu,
+                                 cpumask_bits(&t->sib_core[i]),
+                                 MAX_NR_CPUS)
+                        scan_thread_topology(map, t, cpu, &pos);
+}
+static int str_to_bitmap(char *s, cpumask_t *b)
+{
+        int i;
+        int ret = 0;
+        struct cpu_map *m;
+        int c;
+        m = cpu_map__new(s);
+        if (!m)
+                return -1;
+        for (i = 0; i < m->nr; i++) {
+                c = m->map[i];
+                if (c >= MAX_NR_CPUS) {
+                        ret = -1;
+                        break;
+                }
+                set_bit(c, cpumask_bits(b));
+        }
+        cpu_map__delete(m);
+        return ret;
+}
+int svg_build_topology_map(char *sib_core, int sib_core_nr,
+                           char *sib_thr, int sib_thr_nr)
+{
+        int i;
+        struct topology t;
+        t.sib_core_nr = sib_core_nr;
+        t.sib_thr_nr = sib_thr_nr;
+        t.sib_core = calloc(sib_core_nr, sizeof(cpumask_t));
+        t.sib_thr = calloc(sib_thr_nr, sizeof(cpumask_t));
+        if (!t.sib_core || !t.sib_thr) {
+                fprintf(stderr, "topology: no memory\n");
+                goto exit;
+        }
+        for (i = 0; i < sib_core_nr; i++) {
+                if (str_to_bitmap(sib_core, &t.sib_core[i])) {
+                        fprintf(stderr, "topology: can't parse siblings map\n");
+                        goto exit;
+                }
+                sib_core += strlen(sib_core) + 1;
+        }
+        for (i = 0; i < sib_thr_nr; i++) {
+                if (str_to_bitmap(sib_thr, &t.sib_thr[i])) {
+                        fprintf(stderr, "topology: can't parse siblings map\n");
+                        goto exit;
+                }
+                sib_thr += strlen(sib_thr) + 1;
+        }
+        topology_map = malloc(sizeof(int) * MAX_NR_CPUS);
+        if (!topology_map) {
+                fprintf(stderr, "topology: no memory\n");
+                goto exit;
+        }
+        for (i = 0; i < MAX_NR_CPUS; i++)
+                topology_map[i] = -1;
+        scan_core_topology(topology_map, &t);
+        return 0;
+exit:
+        zfree(&t.sib_core);
+        zfree(&t.sib_thr);
+        return -1;
+}
diff --git a/tools/perf/util/svghelper.h b/tools/perf/util/svghelper.h
index e0781989cc31..f7b4d6e699ea 100644
--- a/tools/perf/util/svghelper.h
+++ b/tools/perf/util/svghelper.h
@@ -5,24 +5,29 @@
 extern void open_svg(const char *filename, int cpus, int rows, u64 start, u64 end);
 extern void svg_box(int Yslot, u64 start, u64 end, const char *type);
-extern void svg_sample(int Yslot, int cpu, u64 start, u64 end);
+extern void svg_blocked(int Yslot, int cpu, u64 start, u64 end, const char *backtrace);
-extern void svg_waiting(int Yslot, u64 start, u64 end);
+extern void svg_running(int Yslot, int cpu, u64 start, u64 end, const char *backtrace);
+extern void svg_waiting(int Yslot, int cpu, u64 start, u64 end, const char *backtrace);
 extern void svg_cpu_box(int cpu, u64 max_frequency, u64 turbo_frequency);
-extern void svg_process(int cpu, u64 start, u64 end, const char *type, const char *name);
+extern void svg_process(int cpu, u64 start, u64 end, int pid, const char *name, const char *backtrace);
 extern void svg_cstate(int cpu, u64 start, u64 end, int type);
 extern void svg_pstate(int cpu, u64 start, u64 end, u64 freq);
 extern void svg_time_grid(void);
 extern void svg_legenda(void);
-extern void svg_wakeline(u64 start, int row1, int row2);
+extern void svg_wakeline(u64 start, int row1, int row2, const char *backtrace);
-extern void svg_partial_wakeline(u64 start, int row1, char *desc1, int row2, char *desc2);
+extern void svg_partial_wakeline(u64 start, int row1, char *desc1, int row2, char *desc2, const char *backtrace);
-extern void svg_interrupt(u64 start, int row);
+extern void svg_interrupt(u64 start, int row, const char *backtrace);
 extern void svg_text(int Yslot, u64 start, const char *text);
 extern void svg_close(void);
+extern int svg_build_topology_map(char *sib_core, int sib_core_nr,
+                                  char *sib_thr, int sib_thr_nr);
 extern int svg_page_width;
+extern u64 svg_highlight;
+extern const char *svg_highlight_name;
 #endif /* __PERF_SVGHELPER_H */
diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index eed0b96302af..759456728703 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -6,6 +6,7 @@
 #include <inttypes.h>
 #include "symbol.h"
+#include <symbol/kallsyms.h>
 #include "debug.h"
 #ifndef HAVE_ELF_GETPHDRNUM_SUPPORT
@@ -135,9 +136,8 @@ static size_t elf_addr_to_index(Elf *elf, GElf_Addr addr)
        return -1;
 }
-static Elf_Scn *elf_section_by_name(Elf *elf, GElf_Ehdr *ep,
+Elf_Scn *elf_section_by_name(Elf *elf, GElf_Ehdr *ep,
-                                    GElf_Shdr *shp, const char *name,
+                             GElf_Shdr *shp, const char *name, size_t *idx)
-                                    size_t *idx)
 {
        Elf_Scn *sec = NULL;
        size_t cnt = 1;
@@ -553,7 +553,7 @@ bool symsrc__has_symtab(struct symsrc *ss)
 void symsrc__destroy(struct symsrc *ss)
 {
-        free(ss->name);
+        zfree(&ss->name);
        elf_end(ss->elf);
        close(ss->fd);
 }
diff --git a/tools/perf/util/symbol-minimal.c b/tools/perf/util/symbol-minimal.c
index 2d2dd0532b5a..bd15f490d04f 100644
--- a/tools/perf/util/symbol-minimal.c
+++ b/tools/perf/util/symbol-minimal.c
@@ -1,4 +1,5 @@
 #include "symbol.h"
+#include "util.h"
 #include <stdio.h>
 #include <fcntl.h>
@@ -253,6 +254,7 @@ int symsrc__init(struct symsrc *ss, struct dso *dso __maybe_unused,
        if (!ss->name)
                goto out_close;
+        ss->fd = fd;
        ss->type = type;
        return 0;
@@ -274,7 +276,7 @@ bool symsrc__has_symtab(struct symsrc *ss __maybe_unused)
 void symsrc__destroy(struct symsrc *ss)
 {
-        free(ss->name);
+        zfree(&ss->name);
        close(ss->fd);
 }
diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index c0c36965fff0..39ce9adbaaf0 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -18,12 +18,9 @@
 #include <elf.h>
 #include <limits.h>
+#include <symbol/kallsyms.h>
 #include <sys/utsname.h>
-#ifndef KSYM_NAME_LEN
-#define KSYM_NAME_LEN 256
-#endif
 static int dso__load_kernel_sym(struct dso *dso, struct map *map,
                                symbol_filter_t filter);
 static int dso__load_guest_kernel_sym(struct dso *dso, struct map *map,
@@ -446,62 +443,6 @@ size_t dso__fprintf_symbols_by_name(struct dso *dso,
        return ret;
 }
-int kallsyms__parse(const char *filename, void *arg,
-                    int (*process_symbol)(void *arg, const char *name,
-                                          char type, u64 start))
-{
-        char *line = NULL;
-        size_t n;
-        int err = -1;
-        FILE *file = fopen(filename, "r");
-        if (file == NULL)
-                goto out_failure;
-        err = 0;
-        while (!feof(file)) {
-                u64 start;
-                int line_len, len;
-                char symbol_type;
-                char *symbol_name;
-                line_len = getline(&line, &n, file);
-                if (line_len < 0 || !line)
-                        break;
-                line[--line_len] = '\0'; /* \n */
-                len = hex2u64(line, &start);
-                len++;
-                if (len + 2 >= line_len)
-                        continue;
-                symbol_type = line[len];
-                len += 2;
-                symbol_name = line + len;
-                len = line_len - len;
-                if (len >= KSYM_NAME_LEN) {
-                        err = -1;
-                        break;
-                }
-                err = process_symbol(arg, symbol_name,
-                                     symbol_type, start);
-                if (err)
-                        break;
-        }
-        free(line);
-        fclose(file);
-        return err;
-out_failure:
-        return -1;
-}
 int modules__parse(const char *filename, void *arg,
                   int (*process_module)(void *arg, const char *name,
                                         u64 start))
@@ -565,12 +506,34 @@ struct process_kallsyms_args {
        struct dso *dso;
 };
-static u8 kallsyms2elf_type(char type)
+bool symbol__is_idle(struct symbol *sym)
 {
-        if (type == 'W')
+        const char * const idle_symbols[] = {
-                return STB_WEAK;
+                "cpu_idle",
+                "intel_idle",
+                "default_idle",
+                "native_safe_halt",
+                "enter_idle",
+                "exit_idle",
+                "mwait_idle",
+                "mwait_idle_with_hints",
+                "poll_idle",
+                "ppc64_runlatch_off",
+                "pseries_dedicated_idle_sleep",
+                NULL
+        };
+        int i;
+        if (!sym)
+                return false;
+        for (i = 0; idle_symbols[i]; i++) {
+                if (!strcmp(idle_symbols[i], sym->name))
+                        return true;
+        }
-        return isupper(type) ? STB_GLOBAL : STB_LOCAL;
+        return false;
 }
 static int map__process_kallsym_symbol(void *arg, const char *name,
@@ -833,7 +796,7 @@ static void delete_modules(struct rb_root *modules)
                mi = rb_entry(next, struct module_info, rb_node);
                next = rb_next(&mi->rb_node);
                rb_erase(&mi->rb_node, modules);
-                free(mi->name);
+                zfree(&mi->name);
                free(mi);
        }
 }
@@ -1126,10 +1089,10 @@ static int dso__load_kcore(struct dso *dso, struct map *map,
         * dso__data_read_addr().
         */
        if (dso->kernel == DSO_TYPE_GUEST_KERNEL)
-                dso->data_type = DSO_BINARY_TYPE__GUEST_KCORE;
+                dso->binary_type = DSO_BINARY_TYPE__GUEST_KCORE;
        else
-                dso->data_type = DSO_BINARY_TYPE__KCORE;
+                dso->binary_type = DSO_BINARY_TYPE__KCORE;
-        dso__set_long_name(dso, strdup(kcore_filename));
+        dso__set_long_name(dso, strdup(kcore_filename), true);
        close(fd);
@@ -1295,8 +1258,8 @@ int dso__load(struct dso *dso, struct map *map, symbol_filter_t filter)
                enum dso_binary_type symtab_type = binary_type_symtab[i];
-                if (dso__binary_type_file(dso, symtab_type,
+                if (dso__read_binary_type_filename(dso, symtab_type,
-                                          root_dir, name, PATH_MAX))
+                                                   root_dir, name, PATH_MAX))
                        continue;
                /* Name is now the name of the next image to try */
@@ -1306,6 +1269,8 @@ int dso__load(struct dso *dso, struct map *map, symbol_filter_t filter)
                if (!syms_ss && symsrc__has_symtab(ss)) {
                        syms_ss = ss;
                        next_slot = true;
+                        if (!dso->symsrc_filename)
+                                dso->symsrc_filename = strdup(name);
                }
                if (!runtime_ss && symsrc__possibly_runtime(ss)) {
@@ -1376,7 +1341,8 @@ struct map *map_groups__find_by_name(struct map_groups *mg,
 }
 int dso__load_vmlinux(struct dso *dso, struct map *map,
-                      const char *vmlinux, symbol_filter_t filter)
+                      const char *vmlinux, bool vmlinux_allocated,
+                      symbol_filter_t filter)
 {
        int err = -1;
        struct symsrc ss;
@@ -1402,10 +1368,10 @@ int dso__load_vmlinux(struct dso *dso, struct map *map,
        if (err > 0) {
                if (dso->kernel == DSO_TYPE_GUEST_KERNEL)
-                        dso->data_type = DSO_BINARY_TYPE__GUEST_VMLINUX;
+                        dso->binary_type = DSO_BINARY_TYPE__GUEST_VMLINUX;
                else
-                        dso->data_type = DSO_BINARY_TYPE__VMLINUX;
+                        dso->binary_type = DSO_BINARY_TYPE__VMLINUX;
-                dso__set_long_name(dso, (char *)vmlinux);
+                dso__set_long_name(dso, vmlinux, vmlinux_allocated);
                dso__set_loaded(dso, map->type);
                pr_debug("Using %s for symbols\n", symfs_vmlinux);
        }
@@ -1424,21 +1390,16 @@ int dso__load_vmlinux_path(struct dso *dso, struct map *map,
        filename = dso__build_id_filename(dso, NULL, 0);
        if (filename != NULL) {
-                err = dso__load_vmlinux(dso, map, filename, filter);
+                err = dso__load_vmlinux(dso, map, filename, true, filter);
-                if (err > 0) {
+                if (err > 0)
-                        dso->lname_alloc = 1;
                        goto out;
-                }
                free(filename);
        }
        for (i = 0; i < vmlinux_path__nr_entries; ++i) {
-                err = dso__load_vmlinux(dso, map, vmlinux_path[i], filter);
+                err = dso__load_vmlinux(dso, map, vmlinux_path[i], false, filter);
-                if (err > 0) {
+                if (err > 0)
-                        dso__set_long_name(dso, strdup(vmlinux_path[i]));
-                        dso->lname_alloc = 1;
                        break;
-                }
        }
 out:
        return err;
@@ -1496,14 +1457,15 @@ static char *dso__find_kallsyms(struct dso *dso, struct map *map)
        build_id__sprintf(dso->build_id, sizeof(dso->build_id), sbuild_id);
+        scnprintf(path, sizeof(path), "%s/[kernel.kcore]/%s", buildid_dir,
+                  sbuild_id);
        /* Use /proc/kallsyms if possible */
        if (is_host) {
                DIR *d;
                int fd;
                /* If no cached kcore go with /proc/kallsyms */
-                scnprintf(path, sizeof(path), "%s/[kernel.kcore]/%s",
-                          buildid_dir, sbuild_id);
                d = opendir(path);
                if (!d)
                        goto proc_kallsyms;
@@ -1528,6 +1490,10 @@ static char *dso__find_kallsyms(struct dso *dso, struct map *map)
                goto proc_kallsyms;
        }
+        /* Find kallsyms in build-id cache with kcore */
+        if (!find_matching_kcore(map, path, sizeof(path)))
+                return strdup(path);
        scnprintf(path, sizeof(path), "%s/[kernel.kallsyms]/%s",
                  buildid_dir, sbuild_id);
@@ -1570,15 +1536,8 @@ static int dso__load_kernel_sym(struct dso *dso, struct map *map,
        }
        if (!symbol_conf.ignore_vmlinux && symbol_conf.vmlinux_name != NULL) {
-                err = dso__load_vmlinux(dso, map,
+                return dso__load_vmlinux(dso, map, symbol_conf.vmlinux_name,
-                                        symbol_conf.vmlinux_name, filter);
+                                         false, filter);
-                if (err > 0) {
-                        dso__set_long_name(dso,
-                                           strdup(symbol_conf.vmlinux_name));
-                        dso->lname_alloc = 1;
-                        return err;
-                }
-                return err;
        }
        if (!symbol_conf.ignore_vmlinux && vmlinux_path != NULL) {
@@ -1604,7 +1563,7 @@ do_kallsyms:
        free(kallsyms_allocated_filename);
        if (err > 0 && !dso__is_kcore(dso)) {
-                dso__set_long_name(dso, strdup("[kernel.kallsyms]"));
+                dso__set_long_name(dso, "[kernel.kallsyms]", false);
                map__fixup_start(map);
                map__fixup_end(map);
        }
@@ -1634,7 +1593,8 @@ static int dso__load_guest_kernel_sym(struct dso *dso, struct map *map,
                 */
                if (symbol_conf.default_guest_vmlinux_name != NULL) {
                        err = dso__load_vmlinux(dso, map,
-                                symbol_conf.default_guest_vmlinux_name, filter);
+                                                symbol_conf.default_guest_vmlinux_name,
+                                                false, filter);
                        return err;
                }
@@ -1651,7 +1611,7 @@ static int dso__load_guest_kernel_sym(struct dso *dso, struct map *map,
                pr_debug("Using %s for symbols\n", kallsyms_filename);
        if (err > 0 && !dso__is_kcore(dso)) {
                machine__mmap_name(machine, path, sizeof(path));
-                dso__set_long_name(dso, strdup(path));
+                dso__set_long_name(dso, strdup(path), true);
                map__fixup_start(map);
                map__fixup_end(map);
        }
@@ -1661,13 +1621,10 @@ static int dso__load_guest_kernel_sym(struct dso *dso, struct map *map,
 static void vmlinux_path__exit(void)
 {
-        while (--vmlinux_path__nr_entries >= 0) {
+        while (--vmlinux_path__nr_entries >= 0)
-                free(vmlinux_path[vmlinux_path__nr_entries]);
+                zfree(&vmlinux_path[vmlinux_path__nr_entries]);
-                vmlinux_path[vmlinux_path__nr_entries] = NULL;
-        }
-        free(vmlinux_path);
+        zfree(&vmlinux_path);
-        vmlinux_path = NULL;
 }
 static int vmlinux_path__init(void)
@@ -1719,7 +1676,7 @@ out_fail:
        return -1;
 }
-static int setup_list(struct strlist **list, const char *list_str,
+int setup_list(struct strlist **list, const char *list_str,
                      const char *list_name)
 {
        if (list_str == NULL)
diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h
index 07de8fea2f48..fffe2888a1c7 100644
--- a/tools/perf/util/symbol.h
+++ b/tools/perf/util/symbol.h
@@ -52,6 +52,11 @@ static inline char *bfd_demangle(void __maybe_unused *v,
 # define PERF_ELF_C_READ_MMAP ELF_C_READ
 #endif
+#ifdef HAVE_LIBELF_SUPPORT
+extern Elf_Scn *elf_section_by_name(Elf *elf, GElf_Ehdr *ep,
+                                GElf_Shdr *shp, const char *name, size_t *idx);
+#endif
 #ifndef DMGL_PARAMS
 #define DMGL_PARAMS      (1 << 0)       /* Include function args */
 #define DMGL_ANSI        (1 << 1)       /* Include const, volatile, etc */
@@ -164,6 +169,7 @@ struct mem_info {
 };
 struct addr_location {
+        struct machine *machine;
        struct thread *thread;
        struct map    *map;
        struct symbol *sym;
@@ -206,7 +212,8 @@ bool symsrc__possibly_runtime(struct symsrc *ss);
 int dso__load(struct dso *dso, struct map *map, symbol_filter_t filter);
 int dso__load_vmlinux(struct dso *dso, struct map *map,
-                      const char *vmlinux, symbol_filter_t filter);
+                      const char *vmlinux, bool vmlinux_allocated,
+                      symbol_filter_t filter);
 int dso__load_vmlinux_path(struct dso *dso, struct map *map,
                           symbol_filter_t filter);
 int dso__load_kallsyms(struct dso *dso, const char *filename, struct map *map,
@@ -220,9 +227,6 @@ struct symbol *dso__first_symbol(struct dso *dso, enum map_type type);
 int filename__read_build_id(const char *filename, void *bf, size_t size);
 int sysfs__read_build_id(const char *filename, void *bf, size_t size);
-int kallsyms__parse(const char *filename, void *arg,
-                    int (*process_symbol)(void *arg, const char *name,
-                                          char type, u64 start));
 int modules__parse(const char *filename, void *arg,
                   int (*process_module)(void *arg, const char *name,
                                         u64 start));
@@ -240,6 +244,7 @@ size_t symbol__fprintf(struct symbol *sym, FILE *fp);
 bool symbol_type__is_a(char symbol_type, enum map_type map_type);
 bool symbol__restricted_filename(const char *filename,
                                 const char *restricted_filename);
+bool symbol__is_idle(struct symbol *sym);
 int dso__load_sym(struct dso *dso, struct map *map, struct symsrc *syms_ss,
                  struct symsrc *runtime_ss, symbol_filter_t filter,
@@ -273,4 +278,7 @@ void kcore_extract__delete(struct kcore_extract *kce);
 int kcore_copy(const char *from_dir, const char *to_dir);
 int compare_proc_modules(const char *from, const char *to);
+int setup_list(struct strlist **list, const char *list_str,
+               const char *list_name);
 #endif /* __PERF_SYMBOL */
diff --git a/tools/perf/util/target.c b/tools/perf/util/target.c
index 3c778a07b7cc..e74c5963dc7a 100644
--- a/tools/perf/util/target.c
+++ b/tools/perf/util/target.c
@@ -55,6 +55,13 @@ enum target_errno target__validate(struct target *target)
                        ret = TARGET_ERRNO__UID_OVERRIDE_SYSTEM;
        }
+        /* THREAD and SYSTEM/CPU are mutually exclusive */
+        if (target->per_thread && (target->system_wide || target->cpu_list)) {
+                target->per_thread = false;
+                if (ret == TARGET_ERRNO__SUCCESS)
+                        ret = TARGET_ERRNO__SYSTEM_OVERRIDE_THREAD;
+        }
        return ret;
 }
@@ -100,6 +107,7 @@ static const char *target__error_str[] = {
        "UID switch overriding CPU",
        "PID/TID switch overriding SYSTEM",
        "UID switch overriding SYSTEM",
+        "SYSTEM/CPU switch overriding PER-THREAD",
        "Invalid User: %s",
        "Problems obtaining information for user %s",
 };
@@ -131,7 +139,8 @@ int target__strerror(struct target *target, int errnum,
        msg = target__error_str[idx];
        switch (errnum) {
-        case TARGET_ERRNO__PID_OVERRIDE_CPU ... TARGET_ERRNO__UID_OVERRIDE_SYSTEM:
+        case TARGET_ERRNO__PID_OVERRIDE_CPU ...
+             TARGET_ERRNO__SYSTEM_OVERRIDE_THREAD:
                snprintf(buf, buflen, "%s", msg);
                break;
diff --git a/tools/perf/util/target.h b/tools/perf/util/target.h
index 2d0c50690892..7381b1ca4041 100644
--- a/tools/perf/util/target.h
+++ b/tools/perf/util/target.h
@@ -12,7 +12,8 @@ struct target {
        uid_t        uid;
        bool         system_wide;
        bool         uses_mmap;
-        bool         force_per_cpu;
+        bool         default_per_cpu;
+        bool         per_thread;
 };
 enum target_errno {
@@ -33,6 +34,7 @@ enum target_errno {
        TARGET_ERRNO__UID_OVERRIDE_CPU,
        TARGET_ERRNO__PID_OVERRIDE_SYSTEM,
        TARGET_ERRNO__UID_OVERRIDE_SYSTEM,
+        TARGET_ERRNO__SYSTEM_OVERRIDE_THREAD,
        /* for target__parse_uid() */
        TARGET_ERRNO__INVALID_UID,
@@ -61,4 +63,17 @@ static inline bool target__none(struct target *target)
        return !target__has_task(target) && !target__has_cpu(target);
 }
+static inline bool target__uses_dummy_map(struct target *target)
+{
+        bool use_dummy = false;
+        if (target->default_per_cpu)
+                use_dummy = target->per_thread ? true : false;
+        else if (target__has_task(target) ||
+                 (!target__has_cpu(target) && !target->uses_mmap))
+                use_dummy = true;
+        return use_dummy;
+}
 #endif /* _PERF_TARGET_H */
diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
index 49eaf1d7d89d..0358882c8910 100644
--- a/tools/perf/util/thread.c
+++ b/tools/perf/util/thread.c
@@ -66,10 +66,13 @@ struct comm *thread__comm(const struct thread *thread)
 int thread__set_comm(struct thread *thread, const char *str, u64 timestamp)
 {
        struct comm *new, *curr = thread__comm(thread);
+        int err;
        /* Override latest entry if it had no specific time coverage */
        if (!curr->start) {
-                comm__override(curr, str, timestamp);
+                err = comm__override(curr, str, timestamp);
+                if (err)
+                        return err;
        } else {
                new = comm__new(str, timestamp);
                if (!new)
@@ -126,7 +129,7 @@ int thread__fork(struct thread *thread, struct thread *parent, u64 timestamp)
                if (!comm)
                        return -ENOMEM;
                err = thread__set_comm(thread, comm, timestamp);
-                if (!err)
+                if (err)
                        return err;
                thread->comm_set = true;
        }
diff --git a/tools/perf/util/thread.h b/tools/perf/util/thread.h
index 897c1b2a750a..5b856bf942e1 100644
--- a/tools/perf/util/thread.h
+++ b/tools/perf/util/thread.h
@@ -6,6 +6,7 @@
 #include <unistd.h>
 #include <sys/types.h>
 #include "symbol.h"
+#include <strlist.h>
 struct thread {
        union {
@@ -66,4 +67,15 @@ static inline void thread__set_priv(struct thread *thread, void *p)
 {
        thread->priv = p;
 }
+static inline bool thread__is_filtered(struct thread *thread)
+{
+        if (symbol_conf.comm_list &&
+            !strlist__has_entry(symbol_conf.comm_list, thread__comm_str(thread))) {
+                return true;
+        }
+        return false;
+}
 #endif  /* __PERF_THREAD_H */
diff --git a/tools/perf/util/thread_map.c b/tools/perf/util/thread_map.c
index 9b5f856cc280..5d3215912105 100644
--- a/tools/perf/util/thread_map.c
+++ b/tools/perf/util/thread_map.c
@@ -9,6 +9,7 @@
 #include "strlist.h"
 #include <string.h>
 #include "thread_map.h"
+#include "util.h"
 /* Skip "." and ".." directories */
 static int filter(const struct dirent *dir)
@@ -40,7 +41,7 @@ struct thread_map *thread_map__new_by_pid(pid_t pid)
        }
        for (i=0; i<items; i++)
-                free(namelist[i]);
+                zfree(&namelist[i]);
        free(namelist);
        return threads;
@@ -117,7 +118,7 @@ struct thread_map *thread_map__new_by_uid(uid_t uid)
                        threads->map[threads->nr + i] = atoi(namelist[i]->d_name);
                for (i = 0; i < items; i++)
-                        free(namelist[i]);
+                        zfree(&namelist[i]);
                free(namelist);
                threads->nr += items;
@@ -134,12 +135,11 @@ out_free_threads:
 out_free_namelist:
        for (i = 0; i < items; i++)
-                free(namelist[i]);
+                zfree(&namelist[i]);
        free(namelist);
 out_free_closedir:
-        free(threads);
+        zfree(&threads);
-        threads = NULL;
        goto out_closedir;
 }
@@ -194,7 +194,7 @@ static struct thread_map *thread_map__new_by_pid_str(const char *pid_str)
                for (i = 0; i < items; i++) {
                        threads->map[j++] = atoi(namelist[i]->d_name);
-                        free(namelist[i]);
+                        zfree(&namelist[i]);
                }
                threads->nr = total_tasks;
                free(namelist);
@@ -206,12 +206,11 @@ out:
 out_free_namelist:
        for (i = 0; i < items; i++)
-                free(namelist[i]);
+                zfree(&namelist[i]);
        free(namelist);
 out_free_threads:
-        free(threads);
+        zfree(&threads);
-        threads = NULL;
        goto out;
 }
@@ -262,8 +261,7 @@ out:
        return threads;
 out_free_threads:
-        free(threads);
+        zfree(&threads);
-        threads = NULL;
        goto out;
 }
diff --git a/tools/perf/util/top.c b/tools/perf/util/top.c
index ce793c7dd23c..8e517def925b 100644
--- a/tools/perf/util/top.c
+++ b/tools/perf/util/top.c
@@ -26,7 +26,7 @@ size_t perf_top__header_snprintf(struct perf_top *top, char *bf, size_t size)
        float samples_per_sec;
        float ksamples_per_sec;
        float esamples_percent;
-        struct perf_record_opts *opts = &top->record_opts;
+        struct record_opts *opts = &top->record_opts;
        struct target *target = &opts->target;
        size_t ret = 0;
diff --git a/tools/perf/util/top.h b/tools/perf/util/top.h
index 88cfeaff600b..dab14d0ad3d0 100644
--- a/tools/perf/util/top.h
+++ b/tools/perf/util/top.h
@@ -14,7 +14,7 @@ struct perf_session;
 struct perf_top {
        struct perf_tool   tool;
        struct perf_evlist *evlist;
-        struct perf_record_opts record_opts;
+        struct record_opts record_opts;
        /*
         * Symbols will be added here in perf_event__process_sample and will
         * get out after decayed.
diff --git a/tools/perf/util/trace-event-info.c b/tools/perf/util/trace-event-info.c
index f3c9e551bd35..7e6fcfe8b438 100644
--- a/tools/perf/util/trace-event-info.c
+++ b/tools/perf/util/trace-event-info.c
@@ -38,7 +38,7 @@
 #include "../perf.h"
 #include "trace-event.h"
-#include <lk/debugfs.h>
+#include <api/fs/debugfs.h>
 #include "evsel.h"
 #define VERSION "0.5"
@@ -397,8 +397,8 @@ put_tracepoints_path(struct tracepoint_path *tps)
                struct tracepoint_path *t = tps;
                tps = tps->next;
-                free(t->name);
+                zfree(&t->name);
-                free(t->system);
+                zfree(&t->system);
                free(t);
        }
 }
@@ -562,10 +562,8 @@ out:
                output_fd = fd;
        }
-        if (err) {
+        if (err)
-                free(tdata);
+                zfree(&tdata);
-                tdata = NULL;
-        }
        put_tracepoints_path(tps);
        return tdata;
diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
index 6681f71f2f95..e0d6d07f6848 100644
--- a/tools/perf/util/trace-event-parse.c
+++ b/tools/perf/util/trace-event-parse.c
@@ -28,19 +28,6 @@
 #include "util.h"
 #include "trace-event.h"
-struct pevent *read_trace_init(int file_bigendian, int host_bigendian)
-{
-        struct pevent *pevent = pevent_alloc();
-        if (pevent != NULL) {
-                pevent_set_flag(pevent, PEVENT_NSEC_OUTPUT);
-                pevent_set_file_bigendian(pevent, file_bigendian);
-                pevent_set_host_bigendian(pevent, host_bigendian);
-        }
-        return pevent;
-}
 static int get_common_field(struct scripting_context *context,
                            int *offset, int *size, const char *type)
 {
diff --git a/tools/perf/util/trace-event-read.c b/tools/perf/util/trace-event-read.c
index f2112270c663..e113e180c48f 100644
--- a/tools/perf/util/trace-event-read.c
+++ b/tools/perf/util/trace-event-read.c
@@ -343,7 +343,7 @@ static int read_event_files(struct pevent *pevent)
        return 0;
 }
-ssize_t trace_report(int fd, struct pevent **ppevent, bool __repipe)
+ssize_t trace_report(int fd, struct trace_event *tevent, bool __repipe)
 {
        char buf[BUFSIZ];
        char test[] = { 23, 8, 68 };
@@ -356,11 +356,9 @@ ssize_t trace_report(int fd, struct pevent **ppevent, bool __repipe)
        int host_bigendian;
        int file_long_size;
        int file_page_size;
-        struct pevent *pevent;
+        struct pevent *pevent = NULL;
        int err;
-        *ppevent = NULL;
        repipe = __repipe;
        input_fd = fd;
@@ -390,12 +388,17 @@ ssize_t trace_report(int fd, struct pevent **ppevent, bool __repipe)
        file_bigendian = buf[0];
        host_bigendian = bigendian();
-        pevent = read_trace_init(file_bigendian, host_bigendian);
+        if (trace_event__init(tevent)) {
-        if (pevent == NULL) {
+                pr_debug("trace_event__init failed");
-                pr_debug("read_trace_init failed");
                goto out;
        }
+        pevent = tevent->pevent;
+        pevent_set_flag(pevent, PEVENT_NSEC_OUTPUT);
+        pevent_set_file_bigendian(pevent, file_bigendian);
+        pevent_set_host_bigendian(pevent, host_bigendian);
        if (do_read(buf, 1) < 0)
                goto out;
        file_long_size = buf[0];
@@ -432,11 +435,10 @@ ssize_t trace_report(int fd, struct pevent **ppevent, bool __repipe)
                pevent_print_printk(pevent);
        }
-        *ppevent = pevent;
        pevent = NULL;
 out:
        if (pevent)
-                pevent_free(pevent);
+                trace_event__cleanup(tevent);
        return size;
 }
diff --git a/tools/perf/util/trace-event-scripting.c b/tools/perf/util/trace-event-scripting.c
index 95199e4eea97..57aaccc1692e 100644
--- a/tools/perf/util/trace-event-scripting.c
+++ b/tools/perf/util/trace-event-scripting.c
@@ -38,9 +38,8 @@ static int stop_script_unsupported(void)
 static void process_event_unsupported(union perf_event *event __maybe_unused,
                                      struct perf_sample *sample __maybe_unused,
                                      struct perf_evsel *evsel __maybe_unused,
-                                      struct machine *machine __maybe_unused,
                                      struct thread *thread __maybe_unused,
-                                          struct addr_location *al __maybe_unused)
+                                      struct addr_location *al __maybe_unused)
 {
 }
diff --git a/tools/perf/util/trace-event.c b/tools/perf/util/trace-event.c
new file mode 100644
index 000000000000..6322d37164c5
--- /dev/null
+++ b/tools/perf/util/trace-event.c
@@ -0,0 +1,82 @@
+#include <stdio.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <sys/types.h>
+#include <sys/stat.h>
+#include <fcntl.h>
+#include <linux/kernel.h>
+#include <traceevent/event-parse.h>
+#include "trace-event.h"
+#include "util.h"
+/*
+ * global trace_event object used by trace_event__tp_format
+ *
+ * TODO There's no cleanup call for this. Add some sort of
+ * __exit function support and call trace_event__cleanup
+ * there.
+ */
+static struct trace_event tevent;
+int trace_event__init(struct trace_event *t)
+{
+        struct pevent *pevent = pevent_alloc();
+        if (pevent) {
+                t->plugin_list = traceevent_load_plugins(pevent);
+                t->pevent  = pevent;
+        }
+        return pevent ? 0 : -1;
+}
+void trace_event__cleanup(struct trace_event *t)
+{
+        traceevent_unload_plugins(t->plugin_list, t->pevent);
+        pevent_free(t->pevent);
+}
+static struct event_format*
+tp_format(const char *sys, const char *name)
+{
+        struct pevent *pevent = tevent.pevent;
+        struct event_format *event = NULL;
+        char path[PATH_MAX];
+        size_t size;
+        char *data;
+        scnprintf(path, PATH_MAX, "%s/%s/%s/format",
+                  tracing_events_path, sys, name);
+        if (filename__read_str(path, &data, &size))
+                return NULL;
+        pevent_parse_format(pevent, &event, data, size, sys);
+        free(data);
+        return event;
+}
+struct event_format*
+trace_event__tp_format(const char *sys, const char *name)
+{
+        static bool initialized;
+        if (!initialized) {
+                int be = traceevent_host_bigendian();
+                struct pevent *pevent;
+                if (trace_event__init(&tevent))
+                        return NULL;
+                pevent = tevent.pevent;
+                pevent_set_flag(pevent, PEVENT_NSEC_OUTPUT);
+                pevent_set_file_bigendian(pevent, be);
+                pevent_set_host_bigendian(pevent, be);
+                initialized = true;
+        }
+        return tp_format(sys, name);
+}
diff --git a/tools/perf/util/trace-event.h b/tools/perf/util/trace-event.h
index 04df63114109..7b6d68688327 100644
--- a/tools/perf/util/trace-event.h
+++ b/tools/perf/util/trace-event.h
@@ -3,17 +3,26 @@
 #include <traceevent/event-parse.h>
 #include "parse-events.h"
-#include "session.h"
 struct machine;
 struct perf_sample;
 union perf_event;
 struct perf_tool;
 struct thread;
+struct plugin_list;
+struct trace_event {
+        struct pevent           *pevent;
+        struct plugin_list      *plugin_list;
+};
+int trace_event__init(struct trace_event *t);
+void trace_event__cleanup(struct trace_event *t);
+struct event_format*
+trace_event__tp_format(const char *sys, const char *name);
 int bigendian(void);
-struct pevent *read_trace_init(int file_bigendian, int host_bigendian);
 void event_format__print(struct event_format *event,
                         int cpu, void *data, int size);
@@ -27,7 +36,7 @@ raw_field_value(struct event_format *event, const char *name, void *data);
 void parse_proc_kallsyms(struct pevent *pevent, char *file, unsigned int size);
 void parse_ftrace_printk(struct pevent *pevent, char *file, unsigned int size);
-ssize_t trace_report(int fd, struct pevent **pevent, bool repipe);
+ssize_t trace_report(int fd, struct trace_event *tevent, bool repipe);
 struct event_format *trace_find_next_event(struct pevent *pevent,
                                           struct event_format *event);
@@ -59,7 +68,6 @@ struct scripting_ops {
        void (*process_event) (union perf_event *event,
                               struct perf_sample *sample,
                               struct perf_evsel *evsel,
-                               struct machine *machine,
                               struct thread *thread,
                                   struct addr_location *al);
        int (*generate_script) (struct pevent *pevent, const char *outfile);
diff --git a/tools/perf/util/unwind.c b/tools/perf/util/unwind.c
index 0efd5393de85..742f23bf35ff 100644
--- a/tools/perf/util/unwind.c
+++ b/tools/perf/util/unwind.c
@@ -28,6 +28,7 @@
 #include "session.h"
 #include "perf_regs.h"
 #include "unwind.h"
+#include "symbol.h"
 #include "util.h"
 extern int
@@ -158,23 +159,6 @@ static int __dw_read_encoded_value(u8 **p, u8 *end, u64 *val,
        __v;                                                    \
        })
-static Elf_Scn *elf_section_by_name(Elf *elf, GElf_Ehdr *ep,
-                                    GElf_Shdr *shp, const char *name)
-{
-        Elf_Scn *sec = NULL;
-        while ((sec = elf_nextscn(elf, sec)) != NULL) {
-                char *str;
-                gelf_getshdr(sec, shp);
-                str = elf_strptr(elf, ep->e_shstrndx, shp->sh_name);
-                if (!strcmp(name, str))
-                        break;
-        }
-        return sec;
-}
 static u64 elf_section_offset(int fd, const char *name)
 {
        Elf *elf;
@@ -190,7 +174,7 @@ static u64 elf_section_offset(int fd, const char *name)
                if (gelf_getehdr(elf, &ehdr) == NULL)
                        break;
-                if (!elf_section_by_name(elf, &ehdr, &shdr, name))
+                if (!elf_section_by_name(elf, &ehdr, &shdr, name, NULL))
                        break;
                offset = shdr.sh_offset;
@@ -340,10 +324,10 @@ find_proc_info(unw_addr_space_t as, unw_word_t ip, unw_proc_info_t *pi,
        /* Check the .debug_frame section for unwinding info */
        if (!read_unwind_spec_debug_frame(map->dso, ui->machine, &segbase)) {
                memset(&di, 0, sizeof(di));
-                dwarf_find_debug_frame(0, &di, ip, 0, map->dso->name,
+                if (dwarf_find_debug_frame(0, &di, ip, 0, map->dso->name,
-                                       map->start, map->end);
+                                           map->start, map->end))
-                return dwarf_search_unwind_table(as, ip, &di, pi,
+                        return dwarf_search_unwind_table(as, ip, &di, pi,
-                                                 need_unwind_info, arg);
+                                                         need_unwind_info, arg);
        }
 #endif
diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c
index 28a0a89c1f73..42ad667bb317 100644
--- a/tools/perf/util/util.c
+++ b/tools/perf/util/util.c
@@ -1,11 +1,17 @@
 #include "../perf.h"
 #include "util.h"
+#include "fs.h"
 #include <sys/mman.h>
 #ifdef HAVE_BACKTRACE_SUPPORT
 #include <execinfo.h>
 #endif
 #include <stdio.h>
 #include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+#include <limits.h>
+#include <byteswap.h>
+#include <linux/kernel.h>
 /*
 * XXX We need to find a better place for these things...
@@ -151,21 +157,40 @@ unsigned long convert_unit(unsigned long value, char *unit)
        return value;
 }
-int readn(int fd, void *buf, size_t n)
+static ssize_t ion(bool is_read, int fd, void *buf, size_t n)
 {
        void *buf_start = buf;
+        size_t left = n;
-        while (n) {
+        while (left) {
-                int ret = read(fd, buf, n);
+                ssize_t ret = is_read ? read(fd, buf, left) :
+                                        write(fd, buf, left);
                if (ret <= 0)
                        return ret;
-                n -= ret;
+                left -= ret;
-                buf += ret;
+                buf  += ret;
        }
-        return buf - buf_start;
+        BUG_ON((size_t)(buf - buf_start) != n);
+        return n;
+}
+/*
+ * Read exactly 'n' bytes or return an error.
+ */
+ssize_t readn(int fd, void *buf, size_t n)
+{
+        return ion(true, fd, buf, n);
+}
+/*
+ * Write exactly 'n' bytes or return an error.
+ */
+ssize_t writen(int fd, void *buf, size_t n)
+{
+        return ion(false, fd, buf, n);
 }
 size_t hex_width(u64 v)
@@ -413,3 +438,102 @@ int filename__read_int(const char *filename, int *value)
        close(fd);
        return err;
 }
+int filename__read_str(const char *filename, char **buf, size_t *sizep)
+{
+        size_t size = 0, alloc_size = 0;
+        void *bf = NULL, *nbf;
+        int fd, n, err = 0;
+        fd = open(filename, O_RDONLY);
+        if (fd < 0)
+                return -errno;
+        do {
+                if (size == alloc_size) {
+                        alloc_size += BUFSIZ;
+                        nbf = realloc(bf, alloc_size);
+                        if (!nbf) {
+                                err = -ENOMEM;
+                                break;
+                        }
+                        bf = nbf;
+                }
+                n = read(fd, bf + size, alloc_size - size);
+                if (n < 0) {
+                        if (size) {
+                                pr_warning("read failed %d: %s\n",
+                                           errno, strerror(errno));
+                                err = 0;
+                        } else
+                                err = -errno;
+                        break;
+                }
+                size += n;
+        } while (n > 0);
+        if (!err) {
+                *sizep = size;
+                *buf   = bf;
+        } else
+                free(bf);
+        close(fd);
+        return err;
+}
+const char *get_filename_for_perf_kvm(void)
+{
+        const char *filename;
+        if (perf_host && !perf_guest)
+                filename = strdup("perf.data.host");
+        else if (!perf_host && perf_guest)
+                filename = strdup("perf.data.guest");
+        else
+                filename = strdup("perf.data.kvm");
+        return filename;
+}
+int perf_event_paranoid(void)
+{
+        char path[PATH_MAX];
+        const char *procfs = procfs__mountpoint();
+        int value;
+        if (!procfs)
+                return INT_MAX;
+        scnprintf(path, PATH_MAX, "%s/sys/kernel/perf_event_paranoid", procfs);
+        if (filename__read_int(path, &value))
+                return INT_MAX;
+        return value;
+}
+void mem_bswap_32(void *src, int byte_size)
+{
+        u32 *m = src;
+        while (byte_size > 0) {
+                *m = bswap_32(*m);
+                byte_size -= sizeof(u32);
+                ++m;
+        }
+}
+void mem_bswap_64(void *src, int byte_size)
+{
+        u64 *m = src;
+        while (byte_size > 0) {
+                *m = bswap_64(*m);
+                byte_size -= sizeof(u64);
+                ++m;
+        }
+}
diff --git a/tools/perf/util/util.h b/tools/perf/util/util.h
index c8f362daba87..6995d66f225c 100644
--- a/tools/perf/util/util.h
+++ b/tools/perf/util/util.h
@@ -71,8 +71,9 @@
 #include <linux/magic.h>
 #include "types.h"
 #include <sys/ttydefaults.h>
-#include <lk/debugfs.h>
+#include <api/fs/debugfs.h>
 #include <termios.h>
+#include <linux/bitops.h>
 extern const char *graph_line;
 extern const char *graph_dotted_line;
@@ -185,6 +186,8 @@ static inline void *zalloc(size_t size)
        return calloc(1, size);
 }
+#define zfree(ptr) ({ free(*ptr); *ptr = NULL; })
 static inline int has_extension(const char *filename, const char *ext)
 {
        size_t len = strlen(filename);
@@ -253,7 +256,8 @@ bool strlazymatch(const char *str, const char *pat);
 int strtailcmp(const char *s1, const char *s2);
 char *strxfrchar(char *s, char from, char to);
 unsigned long convert_unit(unsigned long value, char *unit);
-int readn(int fd, void *buf, size_t size);
+ssize_t readn(int fd, void *buf, size_t n);
+ssize_t writen(int fd, void *buf, size_t n);
 struct perf_event_attr;
@@ -280,6 +284,17 @@ static inline unsigned next_pow2(unsigned x)
        return 1ULL << (32 - __builtin_clz(x - 1));
 }
+static inline unsigned long next_pow2_l(unsigned long x)
+{
+#if BITS_PER_LONG == 64
+        if (x <= (1UL << 31))
+                return next_pow2(x);
+        return (unsigned long)next_pow2(x >> 32) << 32;
+#else
+        return next_pow2(x);
+#endif
+}
 size_t hex_width(u64 v);
 int hex2u64(const char *ptr, u64 *val);
@@ -307,4 +322,11 @@ char *get_srcline(struct dso *dso, unsigned long addr);
 void free_srcline(char *srcline);
 int filename__read_int(const char *filename, int *value);
+int filename__read_str(const char *filename, char **buf, size_t *sizep);
+int perf_event_paranoid(void);
+void mem_bswap_64(void *src, int byte_size);
+void mem_bswap_32(void *src, int byte_size);
+const char *get_filename_for_perf_kvm(void);
 #endif /* GIT_COMPAT_UTIL_H */
diff --git a/tools/perf/util/values.c b/tools/perf/util/values.c
index 697c8b4e59cc..0fb3c1fcd3e6 100644
--- a/tools/perf/util/values.c
+++ b/tools/perf/util/values.c
@@ -31,14 +31,14 @@ void perf_read_values_destroy(struct perf_read_values *values)
                return;
        for (i = 0; i < values->threads; i++)
-                free(values->value[i]);
+                zfree(&values->value[i]);
-        free(values->value);
+        zfree(&values->value);
-        free(values->pid);
+        zfree(&values->pid);
-        free(values->tid);
+        zfree(&values->tid);
-        free(values->counterrawid);
+        zfree(&values->counterrawid);
        for (i = 0; i < values->counters; i++)
-                free(values->countername[i]);
+                zfree(&values->countername[i]);
-        free(values->countername);
+        zfree(&values->countername);
 }
 static void perf_read_values__enlarge_threads(struct perf_read_values *values)
diff --git a/tools/perf/util/vdso.c b/tools/perf/util/vdso.c
index 39159822d58f..0ddb3b8a89ec 100644
--- a/tools/perf/util/vdso.c
+++ b/tools/perf/util/vdso.c
@@ -103,7 +103,7 @@ struct dso *vdso__dso_findnew(struct list_head *head)
                dso = dso__new(VDSO__MAP_NAME);
                if (dso != NULL) {
                        dsos__add(head, dso);
-                        dso__set_long_name(dso, file);
+                        dso__set_long_name(dso, file, false);
                }
        }
diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include
index ee76544deecb..8abbef164b4e 100644
--- a/tools/scripts/Makefile.include
+++ b/tools/scripts/Makefile.include
@@ -61,6 +61,7 @@ QUIET_SUBDIR1  =
 ifneq ($(findstring $(MAKEFLAGS),s),s)
  ifneq ($(V),1)
        QUIET_CC       = @echo '  CC       '$@;
+        QUIET_CC_FPIC  = @echo '  CC FPIC  '$@;
        QUIET_AR       = @echo '  AR       '$@;
        QUIET_LINK     = @echo '  LINK     '$@;
        QUIET_MKDIR    = @echo '  MKDIR    '$@;
@@ -76,5 +77,8 @@ ifneq ($(findstring $(MAKEFLAGS),s),s)
                +@echo         '  DESCEND  '$(1); \
                mkdir -p $(OUTPUT)$(1) && \
                $(MAKE) $(COMMAND_O) subdir=$(if $(subdir),$(subdir)/$(1),$(1)) $(PRINT_DIR) -C $(1) $(2)
+        QUIET_CLEAN    = @printf '  CLEAN    %s\n' $1;
+        QUIET_INSTALL  = @printf '  INSTALL  %s\n' $1;
  endif
 endif
diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl
index 999eab1bc64f..40631569a0fd 100755
--- a/tools/testing/ktest/ktest.pl
+++ b/tools/testing/ktest/ktest.pl
@@ -18,6 +18,7 @@ $| = 1;
 my %opt;
 my %repeat_tests;
 my %repeats;
+my %evals;
 #default opts
 my %default = (
@@ -25,6 +26,7 @@ my %default = (
    "TEST_TYPE"                 => "build",
    "BUILD_TYPE"                => "randconfig",
    "MAKE_CMD"                  => "make",
+    "CLOSE_CONSOLE_SIGNAL"      => "INT",
    "TIMEOUT"                   => 120,
    "TMP_DIR"                   => "/tmp/ktest/\${MACHINE}",
    "SLEEP_TIME"                => 60,  # sleep time between tests
@@ -39,6 +41,7 @@ my %default = (
    "CLEAR_LOG"                 => 0,
    "BISECT_MANUAL"             => 0,
    "BISECT_SKIP"               => 1,
+    "BISECT_TRIES"              => 1,
    "MIN_CONFIG_TYPE"           => "boot",
    "SUCCESS_LINE"              => "login:",
    "DETECT_TRIPLE_FAULT"       => 1,
@@ -137,6 +140,7 @@ my $bisect_bad_commit = "";
 my $reverse_bisect;
 my $bisect_manual;
 my $bisect_skip;
+my $bisect_tries;
 my $config_bisect_good;
 my $bisect_ret_good;
 my $bisect_ret_bad;
@@ -163,6 +167,7 @@ my $timeout;
 my $booted_timeout;
 my $detect_triplefault;
 my $console;
+my $close_console_signal;
 my $reboot_success_line;
 my $success_line;
 my $stop_after_success;
@@ -273,6 +278,7 @@ my %option_map = (
    "IGNORE_ERRORS"             => \$ignore_errors,
    "BISECT_MANUAL"             => \$bisect_manual,
    "BISECT_SKIP"               => \$bisect_skip,
+    "BISECT_TRIES"              => \$bisect_tries,
    "CONFIG_BISECT_GOOD"        => \$config_bisect_good,
    "BISECT_RET_GOOD"           => \$bisect_ret_good,
    "BISECT_RET_BAD"            => \$bisect_ret_bad,
@@ -285,6 +291,7 @@ my %option_map = (
    "TIMEOUT"                   => \$timeout,
    "BOOTED_TIMEOUT"            => \$booted_timeout,
    "CONSOLE"                   => \$console,
+    "CLOSE_CONSOLE_SIGNAL"      => \$close_console_signal,
    "DETECT_TRIPLE_FAULT"       => \$detect_triplefault,
    "SUCCESS_LINE"              => \$success_line,
    "REBOOT_SUCCESS_LINE"       => \$reboot_success_line,
@@ -445,6 +452,27 @@ $config_help{"REBOOT_SCRIPT"} = << "EOF"
 EOF
    ;
+sub _logit {
+    if (defined($opt{"LOG_FILE"})) {
+        open(OUT, ">> $opt{LOG_FILE}") or die "Can't write to $opt{LOG_FILE}";
+        print OUT @_;
+        close(OUT);
+    }
+}
+sub logit {
+    if (defined($opt{"LOG_FILE"})) {
+        _logit @_;
+    } else {
+        print @_;
+    }
+}
+sub doprint {
+    print @_;
+    _logit @_;
+}
 sub read_prompt {
    my ($cancel, $prompt) = @_;
@@ -662,6 +690,22 @@ sub set_value {
    }
 }
+sub set_eval {
+    my ($lvalue, $rvalue, $name) = @_;
+    my $prvalue = process_variables($rvalue);
+    my $arr;
+    if (defined($evals{$lvalue})) {
+        $arr = $evals{$lvalue};
+    } else {
+        $arr = [];
+        $evals{$lvalue} = $arr;
+    }
+    push @{$arr}, $rvalue;
+}
 sub set_variable {
    my ($lvalue, $rvalue) = @_;
@@ -947,6 +991,20 @@ sub __read_config {
                $test_case = 1;
            }
+        } elsif (/^\s*([A-Z_\[\]\d]+)\s*=~\s*(.*?)\s*$/) {
+            next if ($skip);
+            my $lvalue = $1;
+            my $rvalue = $2;
+            if ($default || $lvalue =~ /\[\d+\]$/) {
+                set_eval($lvalue, $rvalue, $name);
+            } else {
+                my $val = "$lvalue\[$test_num\]";
+                set_eval($val, $rvalue, $name);
+            }
        } elsif (/^\s*([A-Z_\[\]\d]+)\s*=\s*(.*?)\s*$/) {
            next if ($skip);
@@ -1126,6 +1184,10 @@ sub __eval_option {
        } elsif (defined($opt{$var})) {
            $o = $opt{$var};
            $retval = "$retval$o";
+        } elsif ($var eq "KERNEL_VERSION" && defined($make)) {
+            # special option KERNEL_VERSION uses kernel version
+            get_version();
+            $retval = "$retval$version";
        } else {
            $retval = "$retval\$\{$var\}";
        }
@@ -1140,6 +1202,33 @@ sub __eval_option {
    return $retval;
 }
+sub process_evals {
+    my ($name, $option, $i) = @_;
+    my $option_name = "$name\[$i\]";
+    my $ev;
+    my $old_option = $option;
+    if (defined($evals{$option_name})) {
+        $ev = $evals{$option_name};
+    } elsif (defined($evals{$name})) {
+        $ev = $evals{$name};
+    } else {
+        return $option;
+    }
+    for my $e (@{$ev}) {
+        eval "\$option =~ $e";
+    }
+    if ($option ne $old_option) {
+        doprint("$name changed from '$old_option' to '$option'\n");
+    }
+    return $option;
+}
 sub eval_option {
    my ($name, $option, $i) = @_;
@@ -1160,28 +1249,9 @@ sub eval_option {
        $option = __eval_option($name, $option, $i);
    }
-    return $option;
+    $option = process_evals($name, $option, $i);
-}
-sub _logit {
+    return $option;
-    if (defined($opt{"LOG_FILE"})) {
-        open(OUT, ">> $opt{LOG_FILE}") or die "Can't write to $opt{LOG_FILE}";
-        print OUT @_;
-        close(OUT);
-    }
-}
-sub logit {
-    if (defined($opt{"LOG_FILE"})) {
-        _logit @_;
-    } else {
-        print @_;
-    }
-}
-sub doprint {
-    print @_;
-    _logit @_;
 }
 sub run_command;
@@ -1296,7 +1366,7 @@ sub close_console {
    my ($fp, $pid) = @_;
    doprint "kill child process $pid\n";
-    kill 2, $pid;
+    kill $close_console_signal, $pid;
    print "closing!\n";
    close($fp);
@@ -2517,12 +2587,29 @@ sub run_bisect {
        $buildtype = "useconfig:$minconfig";
    }
-    my $ret = run_bisect_test $type, $buildtype;
+    # If the user sets bisect_tries to less than 1, then no tries
+    # is a success.
+    my $ret = 1;
-    if ($bisect_manual) {
+    # Still let the user manually decide that though.
+    if ($bisect_tries < 1 && $bisect_manual) {
        $ret = answer_bisect;
    }
+    for (my $i = 0; $i < $bisect_tries; $i++) {
+        if ($bisect_tries > 1) {
+            my $t = $i + 1;
+            doprint("Running bisect trial $t of $bisect_tries:\n");
+        }
+        $ret = run_bisect_test $type, $buildtype;
+        if ($bisect_manual) {
+            $ret = answer_bisect;
+        }
+        last if (!$ret);
+    }
    # Are we looking for where it worked, not failed?
    if ($reverse_bisect && $ret >= 0) {
        $ret = !$ret;
@@ -3916,6 +4003,18 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
    my $makecmd = set_test_option("MAKE_CMD", $i);
+    $outputdir = set_test_option("OUTPUT_DIR", $i);
+    $builddir = set_test_option("BUILD_DIR", $i);
+    chdir $builddir || die "can't change directory to $builddir";
+    if (!-d $outputdir) {
+        mkpath($outputdir) or
+            die "can't create $outputdir";
+    }
+    $make = "$makecmd O=$outputdir";
    # Load all the options into their mapped variable names
    foreach my $opt (keys %option_map) {
        ${$option_map{$opt}} = set_test_option($opt, $i);
@@ -3940,13 +4039,9 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
        $start_minconfig = $minconfig;
    }
-    chdir $builddir || die "can't change directory to $builddir";
+    if (!-d $tmpdir) {
+        mkpath($tmpdir) or
-    foreach my $dir ($tmpdir, $outputdir) {
+            die "can't create $tmpdir";
-        if (!-d $dir) {
-            mkpath($dir) or
-                die "can't create $dir";
-        }
    }
    $ENV{"SSH_USER"} = $ssh_user;
@@ -3955,7 +4050,6 @@ for (my $i = 1; $i <= $opt{"NUM_TESTS"}; $i++) {
    $buildlog = "$tmpdir/buildlog-$machine";
    $testlog = "$tmpdir/testlog-$machine";
    $dmesg = "$tmpdir/dmesg-$machine";
-    $make = "$makecmd O=$outputdir";
    $output_config = "$outputdir/.config";
    if (!$buildonly) {
diff --git a/tools/testing/ktest/sample.conf b/tools/testing/ktest/sample.conf
index 0a290fb4cd5e..172eec4517fb 100644
--- a/tools/testing/ktest/sample.conf
+++ b/tools/testing/ktest/sample.conf
@@ -328,6 +328,13 @@
 # For a virtual machine with guest name "Guest".
 #CONSOLE =  virsh console Guest
+# Signal to send to kill console.
+# ktest.pl will create a child process to monitor the console.
+# When the console is finished, ktest will kill the child process
+# with this signal.
+# (default INT)
+#CLOSE_CONSOLE_SIGNAL = HUP
 # Required version ending to differentiate the test
 # from other linux builds on the system.
 #LOCALVERSION = -test
@@ -1021,6 +1028,20 @@
 #   BISECT_BAD with BISECT_CHECK = good or
 #   BISECT_CHECK = bad, respectively.
 #
+# BISECT_TRIES = 5 (optional, default 1)
+#
+#   For those cases that it takes several tries to hit a bug,
+#   the BISECT_TRIES is useful. It is the number of times the
+#   test is ran before it says the kernel is good. The first failure
+#   will stop trying and mark the current SHA1 as bad.
+#
+#   Note, as with all race bugs, there's no guarantee that if
+#   it succeeds, it is really a good bisect. But it helps in case
+#   the bug is some what reliable.
+#
+#   You can set BISECT_TRIES to zero, and all tests will be considered
+#   good, unless you also set BISECT_MANUAL.
+#
 # BISECT_RET_GOOD = 0 (optional, default undefined)
 #
 #   In case the specificed test returns something other than just
diff --git a/tools/testing/selftests/rcutorture/.gitignore b/tools/testing/selftests/rcutorture/.gitignore
new file mode 100644
index 000000000000..05838f6f2ebe
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/.gitignore
@@ -0,0 +1,6 @@
+initrd
+linux-2.6
+b[0-9]*
+rcu-test-image
+res
+*.swp
diff --git a/tools/testing/selftests/rcutorture/bin/config2frag.sh b/tools/testing/selftests/rcutorture/bin/config2frag.sh
new file mode 100644
index 000000000000..9f9ffcd427d3
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/bin/config2frag.sh
@@ -0,0 +1,25 @@
+#!/bin/sh
+# Usage: sh config2frag.sh < .config > configfrag
+#
+# Converts the "# CONFIG_XXX is not set" to "CONFIG_XXX=n" so that the
+# resulting file becomes a legitimate Kconfig fragment.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2013
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+LANG=C sed -e 's/^# CONFIG_\([a-zA-Z0-9_]*\) is not set$/CONFIG_\1=n/'
diff --git a/tools/testing/selftests/rcutorture/bin/configNR_CPUS.sh b/tools/testing/selftests/rcutorture/bin/configNR_CPUS.sh
new file mode 100755
index 000000000000..43540f1828cc
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/bin/configNR_CPUS.sh
@@ -0,0 +1,45 @@
+#!/bin/bash
+#
+# Extract the number of CPUs expected from the specified Kconfig-file
+# fragment by checking CONFIG_SMP and CONFIG_NR_CPUS.  If the specified
+# file gives no clue, base the number on the number of idle CPUs on
+# the system.
+#
+# Usage: configNR_CPUS.sh config-frag
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2013
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+cf=$1
+if test ! -r $cf
+then
+        echo Unreadable config fragment $cf 1>&2
+        exit -1
+fi
+if grep -q '^CONFIG_SMP=n$' $cf
+then
+        echo 1
+        exit 0
+fi
+if grep -q '^CONFIG_NR_CPUS=' $cf
+then
+        grep '^CONFIG_NR_CPUS=' $cf | 
+                sed -e 's/^CONFIG_NR_CPUS=\([0-9]*\).*$/\1/'
+        exit 0
+fi
+cpus2use.sh
diff --git a/tools/testing/selftests/rcutorture/bin/configcheck.sh b/tools/testing/selftests/rcutorture/bin/configcheck.sh
new file mode 100755
index 000000000000..d686537dd55c
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/bin/configcheck.sh
@@ -0,0 +1,54 @@
+#!/bin/sh
+# Usage: sh configcheck.sh .config .config-template
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2011
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+T=/tmp/abat-chk-config.sh.$$
+trap 'rm -rf $T' 0
+mkdir $T
+cat $1 > $T/.config
+cat $2 | sed -e 's/\(.*\)=n/# \1 is not set/' -e 's/^#CHECK#//' |
+awk     '
+BEGIN   {
+                print "if grep -q \"" $0 "\" < '"$T/.config"'";
+                print "then";
+                print "\t:";
+                print "else";
+                if ($1 == "#") {
+                        print "\tif grep -q \"" $2 "\" < '"$T/.config"'";
+                        print "\tthen";
+                        print "\t\tif test \"$firsttime\" = \"\""
+                        print "\t\tthen"
+                        print "\t\t\tfirsttime=1"
+                        print "\t\tfi"
+                        print "\t\techo \":" $2 ": improperly set\"";
+                        print "\telse";
+                        print "\t\t:";
+                        print "\tfi";
+                } else {
+                        print "\tif test \"$firsttime\" = \"\""
+                        print "\tthen"
+                        print "\t\tfirsttime=1"
+                        print "\tfi"
+                        print "\techo \":" $0 ": improperly set\"";
+                }
+                print "fi";
+        }' | sh
diff --git a/tools/testing/selftests/rcutorture/bin/configinit.sh b/tools/testing/selftests/rcutorture/bin/configinit.sh
new file mode 100755
index 000000000000..a1be6e62add1
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/bin/configinit.sh
@@ -0,0 +1,74 @@
+#!/bin/sh
+#
+# sh configinit.sh config-spec-file [ build output dir ]
+#
+# Create a .config file from the spec file.  Run from the kernel source tree.
+# Exits with 0 if all went well, with 1 if all went well but the config
+# did not match, and some other number for other failures.
+#
+# The first argument is the .config specification file, which contains
+# desired settings, for example, "CONFIG_NO_HZ=y".  For best results,
+# this should be a full pathname.
+#
+# The second argument is a optional path to a build output directory,
+# for example, "O=/tmp/foo".  If this argument is omitted, the .config
+# file will be generated directly in the current directory.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2013
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+T=/tmp/configinit.sh.$$
+trap 'rm -rf $T' 0
+mkdir $T
+# Capture config spec file.
+c=$1
+buildloc=$2
+builddir=
+if test -n $buildloc
+then
+        if echo $buildloc | grep -q '^O='
+        then
+                builddir=`echo $buildloc | sed -e 's/^O=//'`
+                if test ! -d $builddir
+                then
+                        mkdir $builddir
+                fi
+        else
+                echo Bad build directory: \"$builddir\"
+                exit 2
+        fi
+fi
+sed -e 's/^\(CONFIG[0-9A-Z_]*\)=.*$/grep -v "^# \1" |/' < $c > $T/u.sh
+sed -e 's/^\(CONFIG[0-9A-Z_]*=\).*$/grep -v \1 |/' < $c >> $T/u.sh
+grep '^grep' < $T/u.sh > $T/upd.sh
+echo "cat - $c" >> $T/upd.sh
+make mrproper
+make $buildloc distclean > $builddir/Make.distclean 2>&1
+make $buildloc defconfig > $builddir/Make.defconfig.out 2>&1
+mv $builddir/.config $builddir/.config.sav
+sh $T/upd.sh < $builddir/.config.sav > $builddir/.config
+cp $builddir/.config $builddir/.config.new
+yes '' | make $buildloc oldconfig > $builddir/Make.modconfig.out 2>&1
+# verify new config matches specification.
+configcheck.sh $builddir/.config $c
+exit 0
diff --git a/tools/testing/selftests/rcutorture/bin/cpus2use.sh b/tools/testing/selftests/rcutorture/bin/cpus2use.sh
new file mode 100755
index 000000000000..abe14b7f36e9
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/bin/cpus2use.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+#
+# Get an estimate of how CPU-hoggy to be.
+#
+# Usage: cpus2use.sh
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2013
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+ncpus=`grep '^processor' /proc/cpuinfo | wc -l`
+idlecpus=`mpstat | tail -1 | \
+        awk -v ncpus=$ncpus '{ print ncpus * ($7 + $12) / 100 }'`
+awk -v ncpus=$ncpus -v idlecpus=$idlecpus < /dev/null '
+BEGIN {
+        cpus2use = idlecpus;
+        if (cpus2use < 1)
+                cpus2use = 1;
+        if (cpus2use < ncpus / 10)
+                cpus2use = ncpus / 10;
+        if (cpus2use == int(cpus2use))
+                cpus2use = int(cpus2use)
+        else
+                cpus2use = int(cpus2use) + 1
+        print cpus2use;
+}'
diff --git a/tools/testing/selftests/rcutorture/bin/functions.sh b/tools/testing/selftests/rcutorture/bin/functions.sh
new file mode 100644
index 000000000000..587561d7c035
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/bin/functions.sh
@@ -0,0 +1,198 @@
+#!/bin/bash
+#
+# Shell functions for the rest of the scripts.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2013
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+# bootparam_hotplug_cpu bootparam-string
+#
+# Returns 1 if the specified boot-parameter string tells rcutorture to
+# test CPU-hotplug operations.
+bootparam_hotplug_cpu () {
+        echo "$1" | grep -q "rcutorture\.onoff_"
+}
+# checkarg --argname argtype $# arg mustmatch cannotmatch
+#
+# Checks the specified argument "arg" against the mustmatch and cannotmatch
+# patterns.
+checkarg () {
+        if test $3 -le 1
+        then
+                echo $1 needs argument $2 matching \"$5\"
+                usage
+        fi
+        if echo "$4" | grep -q -e "$5"
+        then
+                :
+        else
+                echo $1 $2 \"$4\" must match \"$5\"
+                usage
+        fi
+        if echo "$4" | grep -q -e "$6"
+        then
+                echo $1 $2 \"$4\" must not match \"$6\"
+                usage
+        fi
+}
+# configfrag_boot_params bootparam-string config-fragment-file
+#
+# Adds boot parameters from the .boot file, if any.
+configfrag_boot_params () {
+        if test -r "$2.boot"
+        then
+                echo $1 `grep -v '^#' "$2.boot" | tr '\012' ' '`
+        else
+                echo $1
+        fi
+}
+# configfrag_hotplug_cpu config-fragment-file
+#
+# Returns 1 if the config fragment specifies hotplug CPU.
+configfrag_hotplug_cpu () {
+        if test ! -r "$1"
+        then
+                echo Unreadable config fragment "$1" 1>&2
+                exit -1
+        fi
+        grep -q '^CONFIG_HOTPLUG_CPU=y$' "$1"
+}
+# identify_qemu builddir
+#
+# Returns our best guess as to which qemu command is appropriate for
+# the kernel at hand.  Override with the RCU_QEMU_CMD environment variable.
+identify_qemu () {
+        local u="`file "$1"`"
+        if test -n "$RCU_QEMU_CMD"
+        then
+                echo $RCU_QEMU_CMD
+        elif echo $u | grep -q x86-64
+        then
+                echo qemu-system-x86_64
+        elif echo $u | grep -q "Intel 80386"
+        then
+                echo qemu-system-i386
+        elif uname -a | grep -q ppc64
+        then
+                echo qemu-system-ppc64
+        else
+                echo Cannot figure out what qemu command to use! 1>&2
+                # Usually this will be one of /usr/bin/qemu-system-*
+                # Use RCU_QEMU_CMD environment variable or appropriate
+                # argument to top-level script.
+                exit 1
+        fi
+}
+# identify_qemu_append qemu-cmd
+#
+# Output arguments for the qemu "-append" string based on CPU type
+# and the RCU_QEMU_INTERACTIVE environment variable.
+identify_qemu_append () {
+        case "$1" in
+        qemu-system-x86_64|qemu-system-i386)
+                echo noapic selinux=0 initcall_debug debug
+                ;;
+        esac
+        if test -n "$RCU_QEMU_INTERACTIVE"
+        then
+                echo root=/dev/sda
+        else
+                echo console=ttyS0
+        fi
+}
+# identify_qemu_args qemu-cmd serial-file
+#
+# Output arguments for qemu arguments based on the RCU_QEMU_MAC
+# and RCU_QEMU_INTERACTIVE environment variables.
+identify_qemu_args () {
+        case "$1" in
+        qemu-system-x86_64|qemu-system-i386)
+                ;;
+        qemu-system-ppc64)
+                echo -enable-kvm -M pseries -cpu POWER7 -nodefaults
+                echo -device spapr-vscsi
+                if test -n "$RCU_QEMU_INTERACTIVE" -a -n "$RCU_QEMU_MAC"
+                then
+                        echo -device spapr-vlan,netdev=net0,mac=$RCU_QEMU_MAC
+                        echo -netdev bridge,br=br0,id=net0
+                elif test -n "$RCU_QEMU_INTERACTIVE"
+                then
+                        echo -net nic -net user
+                fi
+                ;;
+        esac
+        if test -n "$RCU_QEMU_INTERACTIVE"
+        then
+                echo -monitor stdio -serial pty -S
+        else
+                echo -serial file:$2
+        fi
+}
+# identify_qemu_vcpus
+#
+# Returns the number of virtual CPUs available to the aggregate of the
+# guest OSes.
+identify_qemu_vcpus () {
+        lscpu | grep '^CPU(s):' | sed -e 's/CPU(s)://'
+}
+# print_bug
+#
+# Prints "BUG: " in red followed by remaining arguments
+print_bug () {
+        printf '\033[031mBUG: \033[m'
+        echo $*
+}
+# print_warning
+#
+# Prints "WARNING: " in yellow followed by remaining arguments
+print_warning () {
+        printf '\033[033mWARNING: \033[m'
+        echo $*
+}
+# specify_qemu_cpus qemu-cmd qemu-args #cpus
+#
+# Appends a string containing "-smp XXX" to qemu-args, unless the incoming
+# qemu-args already contains "-smp".
+specify_qemu_cpus () {
+        local nt;
+        if echo $2 | grep -q -e -smp
+        then
+                echo $2
+        else
+                case "$1" in
+                qemu-system-x86_64|qemu-system-i386)
+                        echo $2 -smp $3
+                        ;;
+                qemu-system-ppc64)
+                        nt="`lscpu | grep '^NUMA node0' | sed -e 's/^[^,]*,\([0-9]*\),.*$/\1/'`"
+                        echo $2 -smp cores=`expr \( $3 + $nt - 1 \) / $nt`,threads=$nt
+                        ;;
+                esac
+        fi
+}
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-build.sh b/tools/testing/selftests/rcutorture/bin/kvm-build.sh
new file mode 100755
index 000000000000..197901ec10bf
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/bin/kvm-build.sh
@@ -0,0 +1,71 @@
+#!/bin/bash
+#
+# Build a kvm-ready Linux kernel from the tree in the current directory.
+#
+# Usage: sh kvm-build.sh config-template build-dir more-configs
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2011
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+config_template=${1}
+if test -z "$config_template" -o ! -f "$config_template" -o ! -r "$config_template"
+then
+        echo "kvm-build.sh :$config_template: Not a readable file"
+        exit 1
+fi
+builddir=${2}
+if test -z "$builddir" -o ! -d "$builddir" -o ! -w "$builddir"
+then
+        echo "kvm-build.sh :$builddir: Not a writable directory, cannot build into it"
+        exit 1
+fi
+moreconfigs=${3}
+if test -z "$moreconfigs" -o ! -r "$moreconfigs"
+then
+        echo "kvm-build.sh :$moreconfigs: Not a readable file"
+        exit 1
+fi
+T=/tmp/test-linux.sh.$$
+trap 'rm -rf $T' 0
+mkdir $T
+cat ${config_template} | grep -v CONFIG_RCU_TORTURE_TEST > $T/config
+cat << ___EOF___ >> $T/config
+CONFIG_INITRAMFS_SOURCE="$RCU_INITRD"
+CONFIG_VIRTIO_PCI=y
+CONFIG_VIRTIO_CONSOLE=y
+___EOF___
+cat $moreconfigs >> $T/config
+configinit.sh $T/config O=$builddir
+retval=$?
+if test $retval -gt 1
+then
+        exit 2
+fi
+ncpus=`cpus2use.sh`
+make O=$builddir -j$ncpus $RCU_KMAKE_ARG > $builddir/Make.out 2>&1
+retval=$?
+if test $retval -ne 0 || grep "rcu[^/]*": < $builddir/Make.out | egrep -q "Stop|Error|error:|warning:" || egrep -q "Stop|Error|error:" < $builddir/Make.out
+then
+        echo Kernel build error
+        egrep "Stop|Error|error:|warning:" < $builddir/Make.out
+        echo Run aborted.
+        exit 3
+fi
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-recheck.sh b/tools/testing/selftests/rcutorture/bin/kvm-recheck.sh
new file mode 100755
index 000000000000..baef09f3469b
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/bin/kvm-recheck.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+#
+# Given the results directories for previous KVM runs of rcutorture,
+# check the build and console output for errors.  Given a directory
+# containing results directories, this recursively checks them all.
+#
+# Usage: sh kvm-recheck.sh resdir ...
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2011
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+PATH=`pwd`/tools/testing/selftests/rcutorture/bin:$PATH; export PATH
+for rd in "$@"
+do
+        dirs=`find $rd -name Make.defconfig.out -print | sort | sed -e 's,/[^/]*$,,' | sort -u`
+        for i in $dirs
+        do
+                configfile=`echo $i | sed -e 's/^.*\///'`
+                echo $configfile
+                configcheck.sh $i/.config $i/ConfigFragment
+                parse-build.sh $i/Make.out $configfile
+                parse-rcutorture.sh $i/console.log $configfile
+                parse-console.sh $i/console.log $configfile
+                if test -r $i/Warnings
+                then
+                        cat $i/Warnings
+                fi
+        done
+done
diff --git a/tools/testing/selftests/rcutorture/bin/kvm-test-1-rcu.sh b/tools/testing/selftests/rcutorture/bin/kvm-test-1-rcu.sh
new file mode 100755
index 000000000000..151b23788935
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/bin/kvm-test-1-rcu.sh
@@ -0,0 +1,192 @@
+#!/bin/bash
+#
+# Run a kvm-based test of the specified tree on the specified configs.
+# Fully automated run and error checking, no graphics console.
+#
+# Execute this in the source tree.  Do not run it as a background task
+# because qemu does not seem to like that much.
+#
+# Usage: sh kvm-test-1-rcu.sh config builddir resdir minutes qemu-args bootargs
+#
+# qemu-args defaults to "" -- you will want "-nographic" if running headless.
+# bootargs defaults to  "root=/dev/sda noapic selinux=0 console=ttyS0"
+#                       "initcall_debug debug rcutorture.stat_interval=15"
+#                       "rcutorture.shutdown_secs=$((minutes * 60))"
+#                       "rcutorture.rcutorture_runnable=1"
+#
+# Anything you specify for either qemu-args or bootargs is appended to
+# the default values.  The "-smp" value is deduced from the contents of
+# the config fragment.
+#
+# More sophisticated argument parsing is clearly needed.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2011
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+grace=120
+T=/tmp/kvm-test-1-rcu.sh.$$
+trap 'rm -rf $T' 0
+. $KVM/bin/functions.sh
+. $KVPATH/ver_functions.sh
+config_template=${1}
+title=`echo $config_template | sed -e 's/^.*\///'`
+builddir=${2}
+if test -z "$builddir" -o ! -d "$builddir" -o ! -w "$builddir"
+then
+        echo "kvm-test-1-rcu.sh :$builddir: Not a writable directory, cannot build into it"
+        exit 1
+fi
+resdir=${3}
+if test -z "$resdir" -o ! -d "$resdir" -o ! -w "$resdir"
+then
+        echo "kvm-test-1-rcu.sh :$resdir: Not a writable directory, cannot build into it"
+        exit 1
+fi
+cp $config_template $resdir/ConfigFragment
+echo ' ---' `date`: Starting build
+echo ' ---' Kconfig fragment at: $config_template >> $resdir/log
+cat << '___EOF___' >> $T
+CONFIG_RCU_TORTURE_TEST=y
+___EOF___
+# Optimizations below this point
+# CONFIG_USB=n
+# CONFIG_SECURITY=n
+# CONFIG_NFS_FS=n
+# CONFIG_SOUND=n
+# CONFIG_INPUT_JOYSTICK=n
+# CONFIG_INPUT_TABLET=n
+# CONFIG_INPUT_TOUCHSCREEN=n
+# CONFIG_INPUT_MISC=n
+# CONFIG_INPUT_MOUSE=n
+# # CONFIG_NET=n # disables console access, so accept the slower build.
+# CONFIG_SCSI=n
+# CONFIG_ATA=n
+# CONFIG_FAT_FS=n
+# CONFIG_MSDOS_FS=n
+# CONFIG_VFAT_FS=n
+# CONFIG_ISO9660_FS=n
+# CONFIG_QUOTA=n
+# CONFIG_HID=n
+# CONFIG_CRYPTO=n
+# CONFIG_PCCARD=n
+# CONFIG_PCMCIA=n
+# CONFIG_CARDBUS=n
+# CONFIG_YENTA=n
+if kvm-build.sh $config_template $builddir $T
+then
+        cp $builddir/Make*.out $resdir
+        cp $builddir/.config $resdir
+        cp $builddir/arch/x86/boot/bzImage $resdir
+        parse-build.sh $resdir/Make.out $title
+else
+        cp $builddir/Make*.out $resdir
+        echo Build failed, not running KVM, see $resdir.
+        exit 1
+fi
+minutes=$4
+seconds=$(($minutes * 60))
+qemu_args=$5
+boot_args=$6
+cd $KVM
+kstarttime=`awk 'BEGIN { print systime() }' < /dev/null`
+echo ' ---' `date`: Starting kernel
+# Determine the appropriate flavor of qemu command.
+QEMU="`identify_qemu $builddir/vmlinux.o`"
+# Generate -smp qemu argument.
+cpu_count=`configNR_CPUS.sh $config_template`
+vcpus=`identify_qemu_vcpus`
+if test $cpu_count -gt $vcpus
+then
+        echo CPU count limited from $cpu_count to $vcpus
+        touch $resdir/Warnings
+        echo CPU count limited from $cpu_count to $vcpus >> $resdir/Warnings
+        cpu_count=$vcpus
+fi
+qemu_args="`specify_qemu_cpus "$QEMU" "$qemu_args" "$cpu_count"`"
+# Generate architecture-specific and interaction-specific qemu arguments
+qemu_args="$qemu_args `identify_qemu_args "$QEMU" "$builddir/console.log"`"
+# Generate qemu -append arguments
+qemu_append="`identify_qemu_append "$QEMU"`"
+# Pull in Kconfig-fragment boot parameters
+boot_args="`configfrag_boot_params "$boot_args" "$config_template"`"
+# Generate CPU-hotplug boot parameters
+boot_args="`rcutorture_param_onoff "$boot_args" $builddir/.config`"
+# Generate rcu_barrier() boot parameter
+boot_args="`rcutorture_param_n_barrier_cbs "$boot_args"`"
+# Pull in standard rcutorture boot arguments
+boot_args="$boot_args rcutorture.stat_interval=15 rcutorture.shutdown_secs=$seconds rcutorture.rcutorture_runnable=1"
+echo $QEMU $qemu_args -m 512 -kernel $builddir/arch/x86/boot/bzImage -append \"$qemu_append $boot_args\" > $resdir/qemu-cmd
+if test -n "$RCU_BUILDONLY"
+then
+        echo Build-only run specified, boot/test omitted.
+        exit 0
+fi
+$QEMU $qemu_args -m 512 -kernel $builddir/arch/x86/boot/bzImage -append "$qemu_append $boot_args" &
+qemu_pid=$!
+commandcompleted=0
+echo Monitoring qemu job at pid $qemu_pid
+for ((i=0;i<$seconds;i++))
+do
+        if kill -0 $qemu_pid > /dev/null 2>&1
+        then
+                sleep 1
+        else
+                commandcompleted=1
+                kruntime=`awk 'BEGIN { print systime() - '"$kstarttime"' }' < /dev/null`
+                if test $kruntime -lt $seconds
+                then
+                        echo Completed in $kruntime vs. $seconds >> $resdir/Warnings 2>&1
+                else
+                        echo ' ---' `date`: Kernel done
+                fi
+                break
+        fi
+done
+if test $commandcompleted -eq 0
+then
+        echo Grace period for qemu job at pid $qemu_pid
+        for ((i=0;i<=$grace;i++))
+        do
+                if kill -0 $qemu_pid > /dev/null 2>&1
+                then
+                        sleep 1
+                else
+                        break
+                fi
+                if test $i -eq $grace
+                then
+                        kruntime=`awk 'BEGIN { print systime() - '"$kstarttime"' }'`
+                        echo "!!! Hang at $kruntime vs. $seconds seconds" >> $resdir/Warnings 2>&1
+                        kill -KILL $qemu_pid
+                fi
+        done
+fi
+cp $builddir/console.log $resdir
+parse-rcutorture.sh $resdir/console.log $title
+parse-console.sh $resdir/console.log $title
diff --git a/tools/testing/selftests/rcutorture/bin/kvm.sh b/tools/testing/selftests/rcutorture/bin/kvm.sh
new file mode 100644
index 000000000000..1b7923bf6a70
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/bin/kvm.sh
@@ -0,0 +1,210 @@
+#!/bin/bash
+#
+# Run a series of 14 tests under KVM.  These are not particularly
+# well-selected or well-tuned, but are the current set.  Run from the
+# top level of the source tree.
+#
+# Edit the definitions below to set the locations of the various directories,
+# as well as the test duration.
+#
+# Usage: sh kvm.sh [ options ]
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2011
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+scriptname=$0
+args="$*"
+dur=30
+KVM="`pwd`/tools/testing/selftests/rcutorture"; export KVM
+PATH=${KVM}/bin:$PATH; export PATH
+builddir="${KVM}/b1"
+RCU_INITRD="$KVM/initrd"; export RCU_INITRD
+RCU_KMAKE_ARG=""; export RCU_KMAKE_ARG
+resdir=""
+configs=""
+ds=`date +%Y.%m.%d-%H:%M:%S`
+kversion=""
+. functions.sh
+usage () {
+        echo "Usage: $scriptname optional arguments:"
+        echo "       --bootargs kernel-boot-arguments"
+        echo "       --builddir absolute-pathname"
+        echo "       --buildonly"
+        echo "       --configs \"config-file list\""
+        echo "       --datestamp string"
+        echo "       --duration minutes"
+        echo "       --interactive"
+        echo "       --kmake-arg kernel-make-arguments"
+        echo "       --kversion vN.NN"
+        echo "       --mac nn:nn:nn:nn:nn:nn"
+        echo "       --no-initrd"
+        echo "       --qemu-args qemu-system-..."
+        echo "       --qemu-cmd qemu-system-..."
+        echo "       --results absolute-pathname"
+        echo "       --relbuilddir relative-pathname"
+        exit 1
+}
+while test $# -gt 0
+do
+        case "$1" in
+        --bootargs)
+                checkarg --bootargs "(list of kernel boot arguments)" "$#" "$2" '.*' '^--'
+                RCU_BOOTARGS="$2"
+                shift
+                ;;
+        --builddir)
+                checkarg --builddir "(absolute pathname)" "$#" "$2" '^/' '^error'
+                builddir=$2
+                gotbuilddir=1
+                shift
+                ;;
+        --buildonly)
+                RCU_BUILDONLY=1; export RCU_BUILDONLY
+                ;;
+        --configs)
+                checkarg --configs "(list of config files)" "$#" "$2" '^[^/]*$' '^--'
+                configs="$2"
+                shift
+                ;;
+        --datestamp)
+                checkarg --datestamp "(relative pathname)" "$#" "$2" '^[^/]*$' '^--'
+                ds=$2
+                shift
+                ;;
+        --duration)
+                checkarg --duration "(minutes)" $# "$2" '^[0-9]*$' '^error'
+                dur=$2
+                shift
+                ;;
+        --interactive)
+                RCU_QEMU_INTERACTIVE=1; export RCU_QEMU_INTERACTIVE
+                ;;
+        --kmake-arg)
+                checkarg --kmake-arg "(kernel make arguments)" $# "$2" '.*' '^error$'
+                RCU_KMAKE_ARG="$2"; export RCU_KMAKE_ARG
+                shift
+                ;;
+        --kversion)
+                checkarg --kversion "(kernel version)" $# "$2" '^v[0-9.]*$' '^error'
+                kversion=$2
+                shift
+                ;;
+        --mac)
+                checkarg --mac "(MAC address)" $# "$2" '^\([0-9a-fA-F]\{2\}:\)\{5\}[0-9a-fA-F]\{2\}$' error
+                RCU_QEMU_MAC=$2; export RCU_QEMU_MAC
+                shift
+                ;;
+        --no-initrd)
+                RCU_INITRD=""; export RCU_INITRD
+                ;;
+        --qemu-args)
+                checkarg --qemu-args "-qemu args" $# "$2" '^-' '^error'
+                RCU_QEMU_ARG="$2"
+                shift
+                ;;
+        --qemu-cmd)
+                checkarg --qemu-cmd "(qemu-system-...)" $# "$2" 'qemu-system-' '^--'
+                RCU_QEMU_CMD="$2"; export RCU_QEMU_CMD
+                shift
+                ;;
+        --relbuilddir)
+                checkarg --relbuilddir "(relative pathname)" "$#" "$2" '^[^/]*$' '^--'
+                relbuilddir=$2
+                gotrelbuilddir=1
+                builddir=${KVM}/${relbuilddir}
+                shift
+                ;;
+        --results)
+                checkarg --results "(absolute pathname)" "$#" "$2" '^/' '^error'
+                resdir=$2
+                shift
+                ;;
+        *)
+                echo Unknown argument $1
+                usage
+                ;;
+        esac
+        shift
+done
+CONFIGFRAG=${KVM}/configs; export CONFIGFRAG
+KVPATH=${CONFIGFRAG}/$kversion; export KVPATH
+if test -z "$configs"
+then
+        configs="`cat $CONFIGFRAG/$kversion/CFLIST`"
+fi
+if test -z "$resdir"
+then
+        resdir=$KVM/res
+        if ! test -e $resdir
+        then
+                mkdir $resdir || :
+        fi
+else
+        if ! test -e $resdir
+        then
+                mkdir -p "$resdir" || :
+        fi
+fi
+mkdir $resdir/$ds
+touch $resdir/$ds/log
+echo $scriptname $args >> $resdir/$ds/log
+pwd > $resdir/$ds/testid.txt
+if test -d .git
+then
+        git status >> $resdir/$ds/testid.txt
+        git rev-parse HEAD >> $resdir/$ds/testid.txt
+fi
+builddir=$KVM/b1
+if ! test -e $builddir
+then
+        mkdir $builddir || :
+fi
+for CF in $configs
+do
+        # Running TREE01 multiple times creates TREE01, TREE01.2, TREE01.3, ...
+        rd=$resdir/$ds/$CF
+        if test -d "${rd}"
+        then
+                n="`ls -d "${rd}"* | grep '\.[0-9]\+$' |
+                        sed -e 's/^.*\.\([0-9]\+\)/\1/' |
+                        sort -k1n | tail -1`"
+                if test -z "$n"
+                then
+                        rd="${rd}.2"
+                else
+                        n="`expr $n + 1`"
+                        rd="${rd}.${n}"
+                fi
+        fi
+        mkdir "${rd}"
+        echo Results directory: $rd
+        kvm-test-1-rcu.sh $CONFIGFRAG/$kversion/$CF $builddir $rd $dur "-nographic $RCU_QEMU_ARG" "rcutorture.test_no_idle_hz=1 rcutorture.verbose=1 $RCU_BOOTARGS"
+done
+# Tracing: trace_event=rcu:rcu_grace_period,rcu:rcu_future_grace_period,rcu:rcu_grace_period_init,rcu:rcu_nocb_wake,rcu:rcu_preempt_task,rcu:rcu_unlock_preempted_task,rcu:rcu_quiescent_state_report,rcu:rcu_fqs,rcu:rcu_callback,rcu:rcu_kfree_callback,rcu:rcu_batch_start,rcu:rcu_invoke_callback,rcu:rcu_invoke_kfree_callback,rcu:rcu_batch_end,rcu:rcu_torture_read,rcu:rcu_barrier
+echo " --- `date` Test summary:"
+kvm-recheck.sh $resdir/$ds
diff --git a/tools/testing/selftests/rcutorture/bin/parse-build.sh b/tools/testing/selftests/rcutorture/bin/parse-build.sh
new file mode 100755
index 000000000000..543230951c38
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/bin/parse-build.sh
@@ -0,0 +1,57 @@
+#!/bin/sh
+#
+# Check the build output from an rcutorture run for goodness.
+# The "file" is a pathname on the local system, and "title" is
+# a text string for error-message purposes.
+#
+# The file must contain kernel build output.
+#
+# Usage:
+#       sh parse-build.sh file title
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2011
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+T=$1
+title=$2
+. functions.sh
+if grep -q CC < $T
+then
+        :
+else
+        print_bug $title no build
+        exit 1
+fi
+if grep -q "error:" < $T
+then
+        print_bug $title build errors:
+        grep "error:" < $T
+        exit 2
+fi
+exit 0
+if egrep -q "rcu[^/]*\.c.*warning:|rcu.*\.h.*warning:" < $T
+then
+        print_warning $title build errors:
+        egrep "rcu[^/]*\.c.*warning:|rcu.*\.h.*warning:" < $T
+        exit 2
+fi
+exit 0
diff --git a/tools/testing/selftests/rcutorture/bin/parse-console.sh b/tools/testing/selftests/rcutorture/bin/parse-console.sh
new file mode 100755
index 000000000000..4185d4cab32e
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/bin/parse-console.sh
@@ -0,0 +1,41 @@
+#!/bin/sh
+#
+# Check the console output from an rcutorture run for oopses.
+# The "file" is a pathname on the local system, and "title" is
+# a text string for error-message purposes.
+#
+# Usage:
+#       sh parse-console.sh file title
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2011
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+T=/tmp/abat-chk-badness.sh.$$
+trap 'rm -f $T' 0
+file="$1"
+title="$2"
+. functions.sh
+egrep 'Badness|WARNING:|Warn|BUG|===========|Call Trace:|Oops:' < $file | grep -v 'ODEBUG: ' | grep -v 'Warning: unable to open an initial console' > $T
+if test -s $T
+then
+        print_warning Assertion failure in $file $title
+        cat $T
+fi
diff --git a/tools/testing/selftests/rcutorture/bin/parse-rcutorture.sh b/tools/testing/selftests/rcutorture/bin/parse-rcutorture.sh
new file mode 100755
index 000000000000..dd0a275d9796
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/bin/parse-rcutorture.sh
@@ -0,0 +1,106 @@
+#!/bin/sh
+#
+# Check the console output from an rcutorture run for goodness.
+# The "file" is a pathname on the local system, and "title" is
+# a text string for error-message purposes.
+#
+# The file must contain rcutorture output, but can be interspersed
+# with other dmesg text.
+#
+# Usage:
+#       sh parse-rcutorture.sh file title
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2011
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+T=/tmp/parse-rcutorture.sh.$$
+file="$1"
+title="$2"
+trap 'rm -f $T.seq' 0
+. functions.sh
+# check for presence of rcutorture.txt file
+if test -f "$file" -a -r "$file"
+then
+        :
+else
+        echo $title unreadable rcutorture.txt file: $file
+        exit 1
+fi
+# check for abject failure
+if grep -q FAILURE $file || grep -q -e '-torture.*!!!' $file
+then
+        nerrs=`grep --binary-files=text '!!!' $file | tail -1 | awk '{for (i=NF-8;i<=NF;i++) sum+=$i; } END {print sum}'`
+        print_bug $title FAILURE, $nerrs instances
+        echo "   " $url
+        exit
+fi
+grep --binary-files=text 'torture:.*ver:' $file | grep --binary-files=text -v '(null)' | sed -e 's/^(initramfs)[^]]*] //' -e 's/^\[[^]]*] //' |
+awk '
+BEGIN   {
+        ver = 0;
+        badseq = 0;
+        }
+        {
+        if (!badseq && ($5 + 0 != $5 || $5 <= ver)) {
+                badseqno1 = ver;
+                badseqno2 = $5;
+                badseqnr = NR;
+                badseq = 1;
+        }
+        ver = $5
+        }
+END     {
+        if (badseq) {
+                if (badseqno1 == badseqno2 && badseqno2 == ver)
+                        print "RCU GP HANG at " ver " rcutorture stat " badseqnr;
+                else
+                        print "BAD SEQ " badseqno1 ":" badseqno2 " last:" ver " RCU version " badseqnr;
+        }
+        }' > $T.seq
+if grep -q SUCCESS $file
+then
+        if test -s $T.seq
+        then
+                print_warning $title $title `cat $T.seq`
+                echo "   " $file
+                exit 2
+        fi
+else
+        if grep -q RCU_HOTPLUG $file
+        then
+                print_warning HOTPLUG FAILURES $title `cat $T.seq`
+                echo "   " $file
+                exit 3
+        fi
+        echo $title no success message, `grep --binary-files=text 'ver:' $file | wc -l` successful RCU version messages
+        if test -s $T.seq
+        then
+                print_warning $title `cat $T.seq`
+        fi
+        exit 2
+fi
diff --git a/tools/testing/selftests/rcutorture/configs/CFLIST b/tools/testing/selftests/rcutorture/configs/CFLIST
new file mode 100644
index 000000000000..cd3d29cb0a47
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/CFLIST
@@ -0,0 +1,13 @@
+TREE01
+TREE02
+TREE03
+TREE04
+TREE05
+TREE06
+TREE07
+TREE08
+TREE09
+SRCU-N
+SRCU-P
+TINY01
+TINY02
diff --git a/tools/testing/selftests/rcutorture/configs/SRCU-N b/tools/testing/selftests/rcutorture/configs/SRCU-N
new file mode 100644
index 000000000000..10a0e27f4c75
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/SRCU-N
@@ -0,0 +1,8 @@
+CONFIG_RCU_TRACE=n
+CONFIG_SMP=y
+CONFIG_NR_CPUS=8
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/SRCU-N.boot b/tools/testing/selftests/rcutorture/configs/SRCU-N.boot
new file mode 100644
index 000000000000..238bfe3bd0cc
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/SRCU-N.boot
@@ -0,0 +1 @@
+rcutorture.torture_type=srcu
diff --git a/tools/testing/selftests/rcutorture/configs/SRCU-P b/tools/testing/selftests/rcutorture/configs/SRCU-P
new file mode 100644
index 000000000000..6650e00c6d91
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/SRCU-P
@@ -0,0 +1,8 @@
+CONFIG_RCU_TRACE=n
+CONFIG_SMP=y
+CONFIG_NR_CPUS=8
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/SRCU-P.boot b/tools/testing/selftests/rcutorture/configs/SRCU-P.boot
new file mode 100644
index 000000000000..238bfe3bd0cc
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/SRCU-P.boot
@@ -0,0 +1 @@
+rcutorture.torture_type=srcu
diff --git a/tools/testing/selftests/rcutorture/configs/TINY01 b/tools/testing/selftests/rcutorture/configs/TINY01
new file mode 100644
index 000000000000..0c2823f21712
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TINY01
@@ -0,0 +1,13 @@
+CONFIG_SMP=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TINY_RCU=y
+CONFIG_HZ_PERIODIC=n
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NO_HZ_FULL=n
+CONFIG_RCU_TRACE=n
+CONFIG_DEBUG_LOCK_ALLOC=n
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=n
+CONFIG_PREEMPT_COUNT=n
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/TINY02 b/tools/testing/selftests/rcutorture/configs/TINY02
new file mode 100644
index 000000000000..e5072d7528b6
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TINY02
@@ -0,0 +1,13 @@
+CONFIG_SMP=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TINY_RCU=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_NO_HZ_IDLE=n
+CONFIG_NO_HZ_FULL=n
+CONFIG_RCU_TRACE=y
+CONFIG_DEBUG_LOCK_ALLOC=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=n
+CONFIG_PREEMPT_COUNT=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/TREE01 b/tools/testing/selftests/rcutorture/configs/TREE01
new file mode 100644
index 000000000000..141119a00044
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TREE01
@@ -0,0 +1,23 @@
+CONFIG_SMP=y
+CONFIG_NR_CPUS=8
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_HZ_PERIODIC=n
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NO_HZ_FULL=n
+CONFIG_RCU_FAST_NO_HZ=y
+CONFIG_RCU_TRACE=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_RCU_FANOUT=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_RCU_NOCB_CPU=y
+CONFIG_RCU_NOCB_CPU_ZERO=y
+CONFIG_DEBUG_LOCK_ALLOC=n
+CONFIG_PROVE_RCU_DELAY=n
+CONFIG_RCU_CPU_STALL_INFO=n
+CONFIG_RCU_CPU_STALL_VERBOSE=n
+CONFIG_RCU_BOOST=n
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=n
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/TREE01.boot b/tools/testing/selftests/rcutorture/configs/TREE01.boot
new file mode 100644
index 000000000000..0fc8a3428938
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TREE01.boot
@@ -0,0 +1 @@
+rcutorture.torture_type=rcu_bh
diff --git a/tools/testing/selftests/rcutorture/configs/TREE02 b/tools/testing/selftests/rcutorture/configs/TREE02
new file mode 100644
index 000000000000..2d4d09608528
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TREE02
@@ -0,0 +1,26 @@
+CONFIG_SMP=y
+CONFIG_NR_CPUS=8
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_HZ_PERIODIC=n
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NO_HZ_FULL=n
+CONFIG_RCU_FAST_NO_HZ=n 
+CONFIG_RCU_TRACE=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_RCU_FANOUT=3
+CONFIG_RCU_FANOUT_LEAF=3
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_RCU_NOCB_CPU=n
+CONFIG_DEBUG_LOCK_ALLOC=y
+CONFIG_PROVE_LOCKING=n
+CONFIG_PROVE_RCU_DELAY=n
+CONFIG_RCU_CPU_STALL_INFO=n
+CONFIG_RCU_CPU_STALL_VERBOSE=y
+CONFIG_RCU_BOOST=n
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=n
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/TREE03 b/tools/testing/selftests/rcutorture/configs/TREE03
new file mode 100644
index 000000000000..a47de5be8a04
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TREE03
@@ -0,0 +1,23 @@
+CONFIG_SMP=y
+CONFIG_NR_CPUS=8
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_HZ_PERIODIC=y
+CONFIG_NO_HZ_IDLE=n
+CONFIG_NO_HZ_FULL=n
+CONFIG_RCU_TRACE=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_RCU_FANOUT=4
+CONFIG_RCU_FANOUT_LEAF=4
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_RCU_NOCB_CPU=n
+CONFIG_DEBUG_LOCK_ALLOC=n
+CONFIG_PROVE_RCU_DELAY=n
+CONFIG_RCU_CPU_STALL_INFO=n
+CONFIG_RCU_CPU_STALL_VERBOSE=n
+CONFIG_RCU_BOOST=y
+CONFIG_RCU_BOOST_PRIO=2
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=n
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/TREE04 b/tools/testing/selftests/rcutorture/configs/TREE04
new file mode 100644
index 000000000000..8d839b86a1d5
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TREE04
@@ -0,0 +1,25 @@
+CONFIG_SMP=y
+CONFIG_NR_CPUS=8
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_HZ_PERIODIC=n
+CONFIG_NO_HZ_IDLE=n
+CONFIG_NO_HZ_FULL=y
+CONFIG_NO_HZ_FULL_ALL=y
+CONFIG_RCU_FAST_NO_HZ=y
+CONFIG_RCU_TRACE=y
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_RCU_FANOUT=2
+CONFIG_RCU_FANOUT_LEAF=2
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_RCU_NOCB_CPU=n
+CONFIG_DEBUG_LOCK_ALLOC=n
+CONFIG_PROVE_RCU_DELAY=n
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_RCU_CPU_STALL_VERBOSE=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=n
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/TREE04.boot b/tools/testing/selftests/rcutorture/configs/TREE04.boot
new file mode 100644
index 000000000000..0fc8a3428938
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TREE04.boot
@@ -0,0 +1 @@
+rcutorture.torture_type=rcu_bh
diff --git a/tools/testing/selftests/rcutorture/configs/TREE05 b/tools/testing/selftests/rcutorture/configs/TREE05
new file mode 100644
index 000000000000..b5ba72ea25cb
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TREE05
@@ -0,0 +1,25 @@
+CONFIG_SMP=y
+CONFIG_NR_CPUS=8
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_HZ_PERIODIC=n
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NO_HZ_FULL=n
+CONFIG_RCU_FAST_NO_HZ=n
+CONFIG_RCU_TRACE=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_RCU_FANOUT=6
+CONFIG_RCU_FANOUT_LEAF=6
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_RCU_NOCB_CPU=y
+CONFIG_RCU_NOCB_CPU_NONE=y
+CONFIG_DEBUG_LOCK_ALLOC=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_PROVE_RCU_DELAY=y
+CONFIG_RCU_CPU_STALL_INFO=n
+CONFIG_RCU_CPU_STALL_VERBOSE=n
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=n
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/TREE05.boot b/tools/testing/selftests/rcutorture/configs/TREE05.boot
new file mode 100644
index 000000000000..3b42b8b033cd
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TREE05.boot
@@ -0,0 +1 @@
+rcutorture.torture_type=sched
diff --git a/tools/testing/selftests/rcutorture/configs/TREE06 b/tools/testing/selftests/rcutorture/configs/TREE06
new file mode 100644
index 000000000000..7c95ab48d29f
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TREE06
@@ -0,0 +1,26 @@
+CONFIG_SMP=y
+CONFIG_NR_CPUS=8
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_HZ_PERIODIC=n
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NO_HZ_FULL=n
+CONFIG_RCU_FAST_NO_HZ=n
+CONFIG_RCU_TRACE=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_RCU_FANOUT=6
+CONFIG_RCU_FANOUT_LEAF=6
+CONFIG_RCU_FANOUT_EXACT=y
+CONFIG_RCU_NOCB_CPU=n
+CONFIG_DEBUG_LOCK_ALLOC=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_PROVE_RCU_DELAY=n
+CONFIG_RCU_CPU_STALL_INFO=n
+CONFIG_RCU_CPU_STALL_VERBOSE=n
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/TREE07 b/tools/testing/selftests/rcutorture/configs/TREE07
new file mode 100644
index 000000000000..1467404bdec1
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TREE07
@@ -0,0 +1,24 @@
+CONFIG_SMP=y
+CONFIG_NR_CPUS=16
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_HZ_PERIODIC=n
+CONFIG_NO_HZ_IDLE=n
+CONFIG_NO_HZ_FULL=y
+CONFIG_NO_HZ_FULL_ALL=y
+CONFIG_NO_HZ_FULL_SYSIDLE=y
+CONFIG_RCU_FAST_NO_HZ=n
+CONFIG_RCU_TRACE=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_RCU_FANOUT=2
+CONFIG_RCU_FANOUT_LEAF=2
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_RCU_NOCB_CPU=n
+CONFIG_DEBUG_LOCK_ALLOC=n
+CONFIG_PROVE_RCU_DELAY=n
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_RCU_CPU_STALL_VERBOSE=n
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=n
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/TREE08 b/tools/testing/selftests/rcutorture/configs/TREE08
new file mode 100644
index 000000000000..7d097a61ac2a
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TREE08
@@ -0,0 +1,26 @@
+CONFIG_SMP=y
+CONFIG_NR_CPUS=16
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_HZ_PERIODIC=n
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NO_HZ_FULL=n
+CONFIG_RCU_FAST_NO_HZ=n
+CONFIG_RCU_TRACE=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_RCU_FANOUT=3
+CONFIG_RCU_FANOUT_EXACT=y
+CONFIG_RCU_FANOUT_LEAF=2
+CONFIG_RCU_NOCB_CPU=y
+CONFIG_RCU_NOCB_CPU_ALL=y
+CONFIG_DEBUG_LOCK_ALLOC=n
+CONFIG_PROVE_RCU_DELAY=n
+CONFIG_RCU_CPU_STALL_INFO=n
+CONFIG_RCU_CPU_STALL_VERBOSE=n
+CONFIG_RCU_BOOST=n
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=n
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/TREE08-T b/tools/testing/selftests/rcutorture/configs/TREE08-T
new file mode 100644
index 000000000000..442c4e450ab3
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TREE08-T
@@ -0,0 +1,26 @@
+CONFIG_SMP=y
+CONFIG_NR_CPUS=16
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_HZ_PERIODIC=n
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NO_HZ_FULL=n
+CONFIG_RCU_FAST_NO_HZ=n
+CONFIG_RCU_TRACE=y
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_RCU_FANOUT=3
+CONFIG_RCU_FANOUT_EXACT=y
+CONFIG_RCU_FANOUT_LEAF=2
+CONFIG_RCU_NOCB_CPU=y
+CONFIG_RCU_NOCB_CPU_ALL=y
+CONFIG_DEBUG_LOCK_ALLOC=n
+CONFIG_PROVE_RCU_DELAY=n
+CONFIG_RCU_CPU_STALL_INFO=n
+CONFIG_RCU_CPU_STALL_VERBOSE=n
+CONFIG_RCU_BOOST=n
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=n
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/TREE09 b/tools/testing/selftests/rcutorture/configs/TREE09
new file mode 100644
index 000000000000..0d1ec0d3dfee
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/TREE09
@@ -0,0 +1,21 @@
+CONFIG_SMP=n
+CONFIG_NR_CPUS=1
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_HZ_PERIODIC=n
+CONFIG_NO_HZ_IDLE=y
+CONFIG_NO_HZ_FULL=n
+CONFIG_RCU_TRACE=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_RCU_NOCB_CPU=n
+CONFIG_DEBUG_LOCK_ALLOC=n
+CONFIG_PROVE_RCU_DELAY=n
+CONFIG_RCU_CPU_STALL_INFO=n
+CONFIG_RCU_CPU_STALL_VERBOSE=n
+CONFIG_RCU_BOOST=n
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=n
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/CFLIST b/tools/testing/selftests/rcutorture/configs/v0.0/CFLIST
new file mode 100644
index 000000000000..18223947bbcb
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/CFLIST
@@ -0,0 +1,14 @@
+P1-S-T-NH-SD-SMP-HP
+P2-2-t-nh-sd-SMP-hp
+P3-3-T-nh-SD-SMP-hp
+P4-A-t-NH-sd-SMP-HP
+P5-U-T-NH-sd-SMP-hp
+N1-S-T-NH-SD-SMP-HP
+N2-2-t-nh-sd-SMP-hp
+N3-3-T-nh-SD-SMP-hp
+N4-A-t-NH-sd-SMP-HP
+N5-U-T-NH-sd-SMP-hp
+PT1-nh
+PT2-NH
+NT1-nh
+NT3-NH
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/N1-S-T-NH-SD-SMP-HP b/tools/testing/selftests/rcutorture/configs/v0.0/N1-S-T-NH-SD-SMP-HP
new file mode 100644
index 000000000000..d3ef873eb6e7
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/N1-S-T-NH-SD-SMP-HP
@@ -0,0 +1,18 @@
+CONFIG_RCU_TRACE=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=8
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/N2-2-t-nh-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v0.0/N2-2-t-nh-sd-SMP-hp
new file mode 100644
index 000000000000..02e418572b1b
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/N2-2-t-nh-sd-SMP-hp
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=4
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/N3-3-T-nh-SD-SMP-hp b/tools/testing/selftests/rcutorture/configs/v0.0/N3-3-T-nh-SD-SMP-hp
new file mode 100644
index 000000000000..b3100f69c8cf
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/N3-3-T-nh-SD-SMP-hp
@@ -0,0 +1,22 @@
+CONFIG_RCU_TRACE=y
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=2
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/N4-A-t-NH-sd-SMP-HP b/tools/testing/selftests/rcutorture/configs/v0.0/N4-A-t-NH-sd-SMP-HP
new file mode 100644
index 000000000000..c56b44530725
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/N4-A-t-NH-sd-SMP-HP
@@ -0,0 +1,18 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/N5-U-T-NH-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v0.0/N5-U-T-NH-sd-SMP-hp
new file mode 100644
index 000000000000..90d924fea9e9
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/N5-U-T-NH-sd-SMP-hp
@@ -0,0 +1,22 @@
+CONFIG_RCU_TRACE=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=y
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/NT1-nh b/tools/testing/selftests/rcutorture/configs/v0.0/NT1-nh
new file mode 100644
index 000000000000..023f312a931c
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/NT1-nh
@@ -0,0 +1,23 @@
+#CHECK#CONFIG_TINY_RCU=y
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=n
+#
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/NT3-NH b/tools/testing/selftests/rcutorture/configs/v0.0/NT3-NH
new file mode 100644
index 000000000000..6fd0235dae73
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/NT3-NH
@@ -0,0 +1,20 @@
+#CHECK#CONFIG_TINY_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=y
+#
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/P1-S-T-NH-SD-SMP-HP b/tools/testing/selftests/rcutorture/configs/v0.0/P1-S-T-NH-SD-SMP-HP
new file mode 100644
index 000000000000..f72402d7c13d
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/P1-S-T-NH-SD-SMP-HP
@@ -0,0 +1,19 @@
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=8
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/P2-2-t-nh-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v0.0/P2-2-t-nh-sd-SMP-hp
new file mode 100644
index 000000000000..0f3b667d2a9f
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/P2-2-t-nh-sd-SMP-hp
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=4
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/P3-3-T-nh-SD-SMP-hp b/tools/testing/selftests/rcutorture/configs/v0.0/P3-3-T-nh-SD-SMP-hp
new file mode 100644
index 000000000000..b035e141bf2a
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/P3-3-T-nh-SD-SMP-hp
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=y
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=2
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/P4-A-t-NH-sd-SMP-HP b/tools/testing/selftests/rcutorture/configs/v0.0/P4-A-t-NH-sd-SMP-HP
new file mode 100644
index 000000000000..3ccf6a9447f5
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/P4-A-t-NH-sd-SMP-HP
@@ -0,0 +1,22 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_RT_MUTEXES=y
+CONFIG_RCU_BOOST=y
+CONFIG_RCU_BOOST_PRIO=2
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/P5-U-T-NH-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v0.0/P5-U-T-NH-sd-SMP-hp
new file mode 100644
index 000000000000..ef624ce73d8e
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/P5-U-T-NH-sd-SMP-hp
@@ -0,0 +1,28 @@
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=y
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_PROVE_RCU_DELAY=y
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
+CONFIG_RT_MUTEXES=y
+CONFIG_RCU_BOOST=y
+CONFIG_RCU_BOOST_PRIO=2
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/PT1-nh b/tools/testing/selftests/rcutorture/configs/v0.0/PT1-nh
new file mode 100644
index 000000000000..e3361c3894a1
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/PT1-nh
@@ -0,0 +1,23 @@
+CONFIG_TINY_PREEMPT_RCU=y
+CONFIG_RCU_BOOST=y
+CONFIG_RCU_BOOST_PRIO=2
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=n
+#
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/PT2-NH b/tools/testing/selftests/rcutorture/configs/v0.0/PT2-NH
new file mode 100644
index 000000000000..64abfc3b4d94
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/PT2-NH
@@ -0,0 +1,22 @@
+CONFIG_TINY_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=y
+#
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v0.0/ver_functions.sh b/tools/testing/selftests/rcutorture/configs/v0.0/ver_functions.sh
new file mode 100644
index 000000000000..e8052539af54
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v0.0/ver_functions.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+#
+# Kernel-version-dependent shell functions for the rest of the scripts.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2013
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+# rcutorture_param_n_barrier_cbs bootparam-string
+#
+# Adds n_barrier_cbs rcutorture module parameter to kernels having it.
+rcutorture_param_n_barrier_cbs () {
+        echo $1
+}
+# rcutorture_param_onoff bootparam-string config-file
+#
+# Adds onoff rcutorture module parameters to kernels having it.
+rcutorture_param_onoff () {
+        echo $1
+}
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/CFLIST b/tools/testing/selftests/rcutorture/configs/v3.12/CFLIST
new file mode 100644
index 000000000000..da4cbc668f2a
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/CFLIST
@@ -0,0 +1,17 @@
+sysidleY.2013.06.19a
+sysidleN.2013.06.19a
+P1-S-T-NH-SD-SMP-HP
+P2-2-t-nh-sd-SMP-hp
+P3-3-T-nh-SD-SMP-hp
+P4-A-t-NH-sd-SMP-HP
+P5-U-T-NH-sd-SMP-hp
+P6---t-nh-SD-smp-hp
+N1-S-T-NH-SD-SMP-HP
+N2-2-t-nh-sd-SMP-hp
+N3-3-T-nh-SD-SMP-hp
+N4-A-t-NH-sd-SMP-HP
+N5-U-T-NH-sd-SMP-hp
+PT1-nh
+PT2-NH
+NT1-nh
+NT3-NH
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/N1-S-T-NH-SD-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.12/N1-S-T-NH-SD-SMP-HP
new file mode 100644
index 000000000000..d81e11d280aa
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/N1-S-T-NH-SD-SMP-HP
@@ -0,0 +1,19 @@
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_FAST_NO_HZ=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=8
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/N2-2-t-nh-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.12/N2-2-t-nh-sd-SMP-hp
new file mode 100644
index 000000000000..02e418572b1b
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/N2-2-t-nh-sd-SMP-hp
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=4
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/N3-3-T-nh-SD-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.12/N3-3-T-nh-SD-SMP-hp
new file mode 100644
index 000000000000..b3100f69c8cf
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/N3-3-T-nh-SD-SMP-hp
@@ -0,0 +1,22 @@
+CONFIG_RCU_TRACE=y
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=2
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/N4-A-t-NH-sd-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.12/N4-A-t-NH-sd-SMP-HP
new file mode 100644
index 000000000000..c56b44530725
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/N4-A-t-NH-sd-SMP-HP
@@ -0,0 +1,18 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/N5-U-T-NH-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.12/N5-U-T-NH-sd-SMP-hp
new file mode 100644
index 000000000000..90d924fea9e9
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/N5-U-T-NH-sd-SMP-hp
@@ -0,0 +1,22 @@
+CONFIG_RCU_TRACE=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=y
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/N6---t-nh-SD-smp-hp b/tools/testing/selftests/rcutorture/configs/v3.12/N6---t-nh-SD-smp-hp
new file mode 100644
index 000000000000..0ccc36d72738
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/N6---t-nh-SD-smp-hp
@@ -0,0 +1,19 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_NR_CPUS=1
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/N7-4-T-NH-SD-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.12/N7-4-T-NH-SD-SMP-HP
new file mode 100644
index 000000000000..3f640cf84973
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/N7-4-T-NH-SD-SMP-HP
@@ -0,0 +1,26 @@
+CONFIG_RCU_TRACE=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=2
+CONFIG_NR_CPUS=16
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_RCU_NOCB_CPU=y
+CONFIG_RCU_NOCB_CPU_NONE=y
+CONFIG_RCU_NOCB_CPU_ZERO=n
+CONFIG_RCU_NOCB_CPU_ALL=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/N8-2-T-NH-SD-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.12/N8-2-T-NH-SD-SMP-HP
new file mode 100644
index 000000000000..285da2dd8ac3
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/N8-2-T-NH-SD-SMP-HP
@@ -0,0 +1,22 @@
+CONFIG_RCU_TRACE=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=14
+CONFIG_NR_CPUS=16
+CONFIG_RCU_FANOUT_EXACT=y
+CONFIG_HOTPLUG_CPU=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/NT1-nh b/tools/testing/selftests/rcutorture/configs/v3.12/NT1-nh
new file mode 100644
index 000000000000..023f312a931c
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/NT1-nh
@@ -0,0 +1,23 @@
+#CHECK#CONFIG_TINY_RCU=y
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=n
+#
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/NT3-NH b/tools/testing/selftests/rcutorture/configs/v3.12/NT3-NH
new file mode 100644
index 000000000000..6fd0235dae73
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/NT3-NH
@@ -0,0 +1,20 @@
+#CHECK#CONFIG_TINY_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=y
+#
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/P1-S-T-NH-SD-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.12/P1-S-T-NH-SD-SMP-HP
new file mode 100644
index 000000000000..9647c44cf4b7
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/P1-S-T-NH-SD-SMP-HP
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_RCU_FAST_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=8
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/P2-2-t-nh-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.12/P2-2-t-nh-sd-SMP-hp
new file mode 100644
index 000000000000..0f3b667d2a9f
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/P2-2-t-nh-sd-SMP-hp
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=4
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/P3-3-T-nh-SD-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.12/P3-3-T-nh-SD-SMP-hp
new file mode 100644
index 000000000000..b035e141bf2a
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/P3-3-T-nh-SD-SMP-hp
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=y
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=2
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/P4-A-t-NH-sd-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.12/P4-A-t-NH-sd-SMP-HP
new file mode 100644
index 000000000000..3ccf6a9447f5
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/P4-A-t-NH-sd-SMP-HP
@@ -0,0 +1,22 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_RT_MUTEXES=y
+CONFIG_RCU_BOOST=y
+CONFIG_RCU_BOOST_PRIO=2
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/P5-U-T-NH-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.12/P5-U-T-NH-sd-SMP-hp
new file mode 100644
index 000000000000..ef624ce73d8e
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/P5-U-T-NH-sd-SMP-hp
@@ -0,0 +1,28 @@
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=y
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_PROVE_RCU_DELAY=y
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
+CONFIG_RT_MUTEXES=y
+CONFIG_RCU_BOOST=y
+CONFIG_RCU_BOOST_PRIO=2
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/P6---t-nh-SD-smp-hp b/tools/testing/selftests/rcutorture/configs/v3.12/P6---t-nh-SD-smp-hp
new file mode 100644
index 000000000000..f4c9175828bf
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/P6---t-nh-SD-smp-hp
@@ -0,0 +1,18 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=n
+CONFIG_SMP=n
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/P7-4-T-NH-SD-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.12/P7-4-T-NH-SD-SMP-HP
new file mode 100644
index 000000000000..77a8c5b75763
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/P7-4-T-NH-SD-SMP-HP
@@ -0,0 +1,30 @@
+CONFIG_RCU_TRACE=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=2
+CONFIG_NR_CPUS=16
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_RCU_NOCB_CPU=y
+CONFIG_RCU_NOCB_CPU_NONE=n
+CONFIG_RCU_NOCB_CPU_ZERO=n
+CONFIG_RCU_NOCB_CPU_ALL=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_SLUB=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/P7-4-T-NH-SD-SMP-HP-all b/tools/testing/selftests/rcutorture/configs/v3.12/P7-4-T-NH-SD-SMP-HP-all
new file mode 100644
index 000000000000..0eecebc6e95f
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/P7-4-T-NH-SD-SMP-HP-all
@@ -0,0 +1,30 @@
+CONFIG_RCU_TRACE=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=2
+CONFIG_NR_CPUS=16
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_RCU_NOCB_CPU=y
+CONFIG_RCU_NOCB_CPU_NONE=y
+CONFIG_RCU_NOCB_CPU_ZERO=n
+CONFIG_RCU_NOCB_CPU_ALL=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_SLUB=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/P7-4-T-NH-SD-SMP-HP-none b/tools/testing/selftests/rcutorture/configs/v3.12/P7-4-T-NH-SD-SMP-HP-none
new file mode 100644
index 000000000000..0eecebc6e95f
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/P7-4-T-NH-SD-SMP-HP-none
@@ -0,0 +1,30 @@
+CONFIG_RCU_TRACE=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=2
+CONFIG_NR_CPUS=16
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_RCU_NOCB_CPU=y
+CONFIG_RCU_NOCB_CPU_NONE=y
+CONFIG_RCU_NOCB_CPU_ZERO=n
+CONFIG_RCU_NOCB_CPU_ALL=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_SLUB=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/P7-4-T-NH-SD-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.12/P7-4-T-NH-SD-SMP-hp
new file mode 100644
index 000000000000..588bc70420cd
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/P7-4-T-NH-SD-SMP-hp
@@ -0,0 +1,30 @@
+CONFIG_RCU_TRACE=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=2
+CONFIG_NR_CPUS=16
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_RCU_NOCB_CPU=y
+CONFIG_RCU_NOCB_CPU_NONE=n
+CONFIG_RCU_NOCB_CPU_ZERO=y
+CONFIG_RCU_NOCB_CPU_ALL=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_SLUB=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/PT1-nh b/tools/testing/selftests/rcutorture/configs/v3.12/PT1-nh
new file mode 100644
index 000000000000..e3361c3894a1
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/PT1-nh
@@ -0,0 +1,23 @@
+CONFIG_TINY_PREEMPT_RCU=y
+CONFIG_RCU_BOOST=y
+CONFIG_RCU_BOOST_PRIO=2
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=n
+#
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.12/PT2-NH b/tools/testing/selftests/rcutorture/configs/v3.12/PT2-NH
new file mode 100644
index 000000000000..64abfc3b4d94
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.12/PT2-NH
@@ -0,0 +1,22 @@
+CONFIG_TINY_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=y
+#
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/CFLIST b/tools/testing/selftests/rcutorture/configs/v3.3/CFLIST
new file mode 100644
index 000000000000..18223947bbcb
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/CFLIST
@@ -0,0 +1,14 @@
+P1-S-T-NH-SD-SMP-HP
+P2-2-t-nh-sd-SMP-hp
+P3-3-T-nh-SD-SMP-hp
+P4-A-t-NH-sd-SMP-HP
+P5-U-T-NH-sd-SMP-hp
+N1-S-T-NH-SD-SMP-HP
+N2-2-t-nh-sd-SMP-hp
+N3-3-T-nh-SD-SMP-hp
+N4-A-t-NH-sd-SMP-HP
+N5-U-T-NH-sd-SMP-hp
+PT1-nh
+PT2-NH
+NT1-nh
+NT3-NH
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/N1-S-T-NH-SD-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.3/N1-S-T-NH-SD-SMP-HP
new file mode 100644
index 000000000000..d81e11d280aa
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/N1-S-T-NH-SD-SMP-HP
@@ -0,0 +1,19 @@
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_FAST_NO_HZ=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=8
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/N2-2-t-nh-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.3/N2-2-t-nh-sd-SMP-hp
new file mode 100644
index 000000000000..02e418572b1b
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/N2-2-t-nh-sd-SMP-hp
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=4
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/N3-3-T-nh-SD-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.3/N3-3-T-nh-SD-SMP-hp
new file mode 100644
index 000000000000..b3100f69c8cf
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/N3-3-T-nh-SD-SMP-hp
@@ -0,0 +1,22 @@
+CONFIG_RCU_TRACE=y
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=2
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/N4-A-t-NH-sd-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.3/N4-A-t-NH-sd-SMP-HP
new file mode 100644
index 000000000000..c56b44530725
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/N4-A-t-NH-sd-SMP-HP
@@ -0,0 +1,18 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/N5-U-T-NH-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.3/N5-U-T-NH-sd-SMP-hp
new file mode 100644
index 000000000000..90d924fea9e9
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/N5-U-T-NH-sd-SMP-hp
@@ -0,0 +1,22 @@
+CONFIG_RCU_TRACE=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=y
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/NT1-nh b/tools/testing/selftests/rcutorture/configs/v3.3/NT1-nh
new file mode 100644
index 000000000000..023f312a931c
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/NT1-nh
@@ -0,0 +1,23 @@
+#CHECK#CONFIG_TINY_RCU=y
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=n
+#
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/NT3-NH b/tools/testing/selftests/rcutorture/configs/v3.3/NT3-NH
new file mode 100644
index 000000000000..6fd0235dae73
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/NT3-NH
@@ -0,0 +1,20 @@
+#CHECK#CONFIG_TINY_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=y
+#
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/P1-S-T-NH-SD-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.3/P1-S-T-NH-SD-SMP-HP
new file mode 100644
index 000000000000..9647c44cf4b7
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/P1-S-T-NH-SD-SMP-HP
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_RCU_FAST_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=8
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/P2-2-t-nh-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.3/P2-2-t-nh-sd-SMP-hp
new file mode 100644
index 000000000000..0f3b667d2a9f
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/P2-2-t-nh-sd-SMP-hp
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=4
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/P3-3-T-nh-SD-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.3/P3-3-T-nh-SD-SMP-hp
new file mode 100644
index 000000000000..b035e141bf2a
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/P3-3-T-nh-SD-SMP-hp
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=y
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=2
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/P4-A-t-NH-sd-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.3/P4-A-t-NH-sd-SMP-HP
new file mode 100644
index 000000000000..3ccf6a9447f5
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/P4-A-t-NH-sd-SMP-HP
@@ -0,0 +1,22 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_RT_MUTEXES=y
+CONFIG_RCU_BOOST=y
+CONFIG_RCU_BOOST_PRIO=2
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/P5-U-T-NH-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.3/P5-U-T-NH-sd-SMP-hp
new file mode 100644
index 000000000000..ef624ce73d8e
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/P5-U-T-NH-sd-SMP-hp
@@ -0,0 +1,28 @@
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=y
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_PROVE_RCU_DELAY=y
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
+CONFIG_RT_MUTEXES=y
+CONFIG_RCU_BOOST=y
+CONFIG_RCU_BOOST_PRIO=2
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/PT1-nh b/tools/testing/selftests/rcutorture/configs/v3.3/PT1-nh
new file mode 100644
index 000000000000..e3361c3894a1
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/PT1-nh
@@ -0,0 +1,23 @@
+CONFIG_TINY_PREEMPT_RCU=y
+CONFIG_RCU_BOOST=y
+CONFIG_RCU_BOOST_PRIO=2
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=n
+#
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/PT2-NH b/tools/testing/selftests/rcutorture/configs/v3.3/PT2-NH
new file mode 100644
index 000000000000..64abfc3b4d94
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/PT2-NH
@@ -0,0 +1,22 @@
+CONFIG_TINY_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=y
+#
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.3/ver_functions.sh b/tools/testing/selftests/rcutorture/configs/v3.3/ver_functions.sh
new file mode 100644
index 000000000000..c37432f3572c
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.3/ver_functions.sh
@@ -0,0 +1,41 @@
+#!/bin/bash
+#
+# Kernel-version-dependent shell functions for the rest of the scripts.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2013
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+# rcutorture_param_n_barrier_cbs bootparam-string
+#
+# Adds n_barrier_cbs rcutorture module parameter to kernels having it.
+rcutorture_param_n_barrier_cbs () {
+        echo $1
+}
+# rcutorture_param_onoff bootparam-string config-file
+#
+# Adds onoff rcutorture module parameters to kernels having it.
+rcutorture_param_onoff () {
+        if ! bootparam_hotplug_cpu "$1" && configfrag_hotplug_cpu "$2"
+        then
+                echo CPU-hotplug kernel, adding rcutorture onoff.
+                echo $1 rcutorture.onoff_interval=3 rcutorture.onoff_holdoff=30
+        else
+                echo $1
+        fi
+}
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/CFLIST b/tools/testing/selftests/rcutorture/configs/v3.5/CFLIST
new file mode 100644
index 000000000000..18223947bbcb
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/CFLIST
@@ -0,0 +1,14 @@
+P1-S-T-NH-SD-SMP-HP
+P2-2-t-nh-sd-SMP-hp
+P3-3-T-nh-SD-SMP-hp
+P4-A-t-NH-sd-SMP-HP
+P5-U-T-NH-sd-SMP-hp
+N1-S-T-NH-SD-SMP-HP
+N2-2-t-nh-sd-SMP-hp
+N3-3-T-nh-SD-SMP-hp
+N4-A-t-NH-sd-SMP-HP
+N5-U-T-NH-sd-SMP-hp
+PT1-nh
+PT2-NH
+NT1-nh
+NT3-NH
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/N1-S-T-NH-SD-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.5/N1-S-T-NH-SD-SMP-HP
new file mode 100644
index 000000000000..d81e11d280aa
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/N1-S-T-NH-SD-SMP-HP
@@ -0,0 +1,19 @@
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_FAST_NO_HZ=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=8
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/N2-2-t-nh-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.5/N2-2-t-nh-sd-SMP-hp
new file mode 100644
index 000000000000..02e418572b1b
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/N2-2-t-nh-sd-SMP-hp
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=4
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/N3-3-T-nh-SD-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.5/N3-3-T-nh-SD-SMP-hp
new file mode 100644
index 000000000000..b3100f69c8cf
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/N3-3-T-nh-SD-SMP-hp
@@ -0,0 +1,22 @@
+CONFIG_RCU_TRACE=y
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=2
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/N4-A-t-NH-sd-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.5/N4-A-t-NH-sd-SMP-HP
new file mode 100644
index 000000000000..c56b44530725
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/N4-A-t-NH-sd-SMP-HP
@@ -0,0 +1,18 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/N5-U-T-NH-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.5/N5-U-T-NH-sd-SMP-hp
new file mode 100644
index 000000000000..90d924fea9e9
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/N5-U-T-NH-sd-SMP-hp
@@ -0,0 +1,22 @@
+CONFIG_RCU_TRACE=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=y
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+#CHECK#CONFIG_TREE_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/NT1-nh b/tools/testing/selftests/rcutorture/configs/v3.5/NT1-nh
new file mode 100644
index 000000000000..023f312a931c
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/NT1-nh
@@ -0,0 +1,23 @@
+#CHECK#CONFIG_TINY_RCU=y
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=n
+#
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/NT3-NH b/tools/testing/selftests/rcutorture/configs/v3.5/NT3-NH
new file mode 100644
index 000000000000..6fd0235dae73
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/NT3-NH
@@ -0,0 +1,20 @@
+#CHECK#CONFIG_TINY_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=y
+#
+CONFIG_PREEMPT_NONE=y
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=n
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/P1-S-T-NH-SD-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.5/P1-S-T-NH-SD-SMP-HP
new file mode 100644
index 000000000000..9647c44cf4b7
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/P1-S-T-NH-SD-SMP-HP
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_RCU_FAST_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=8
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/P2-2-t-nh-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.5/P2-2-t-nh-sd-SMP-hp
new file mode 100644
index 000000000000..0f3b667d2a9f
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/P2-2-t-nh-sd-SMP-hp
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=4
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/P3-3-T-nh-SD-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.5/P3-3-T-nh-SD-SMP-hp
new file mode 100644
index 000000000000..b035e141bf2a
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/P3-3-T-nh-SD-SMP-hp
@@ -0,0 +1,20 @@
+CONFIG_RCU_TRACE=y
+CONFIG_NO_HZ=n
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=2
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/P4-A-t-NH-sd-SMP-HP b/tools/testing/selftests/rcutorture/configs/v3.5/P4-A-t-NH-sd-SMP-HP
new file mode 100644
index 000000000000..3ccf6a9447f5
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/P4-A-t-NH-sd-SMP-HP
@@ -0,0 +1,22 @@
+CONFIG_RCU_TRACE=n
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=n
+CONFIG_HOTPLUG_CPU=y
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_RT_MUTEXES=y
+CONFIG_RCU_BOOST=y
+CONFIG_RCU_BOOST_PRIO=2
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/P5-U-T-NH-sd-SMP-hp b/tools/testing/selftests/rcutorture/configs/v3.5/P5-U-T-NH-sd-SMP-hp
new file mode 100644
index 000000000000..ef624ce73d8e
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/P5-U-T-NH-sd-SMP-hp
@@ -0,0 +1,28 @@
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_CPU_STALL_INFO=y
+CONFIG_NO_HZ=y
+CONFIG_SMP=y
+CONFIG_RCU_FANOUT=6
+CONFIG_NR_CPUS=8
+CONFIG_RCU_FANOUT_EXACT=y
+CONFIG_HOTPLUG_CPU=n
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+#CHECK#CONFIG_TREE_PREEMPT_RCU=y
+CONFIG_DEBUG_KERNEL=y
+CONFIG_PROVE_RCU_DELAY=y
+CONFIG_DEBUG_OBJECTS=y
+CONFIG_DEBUG_OBJECTS_RCU_HEAD=y
+CONFIG_RT_MUTEXES=y
+CONFIG_RCU_BOOST=y
+CONFIG_RCU_BOOST_PRIO=2
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/PT1-nh b/tools/testing/selftests/rcutorture/configs/v3.5/PT1-nh
new file mode 100644
index 000000000000..e3361c3894a1
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/PT1-nh
@@ -0,0 +1,23 @@
+CONFIG_TINY_PREEMPT_RCU=y
+CONFIG_RCU_BOOST=y
+CONFIG_RCU_BOOST_PRIO=2
+CONFIG_RCU_TRACE=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=n
+#
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/PT2-NH b/tools/testing/selftests/rcutorture/configs/v3.5/PT2-NH
new file mode 100644
index 000000000000..64abfc3b4d94
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/PT2-NH
@@ -0,0 +1,22 @@
+CONFIG_TINY_PREEMPT_RCU=y
+CONFIG_RCU_TORTURE_TEST=m
+CONFIG_MODULE_UNLOAD=y
+CONFIG_SUSPEND=n
+CONFIG_HIBERNATION=n
+#
+CONFIG_SMP=n
+#
+CONFIG_HOTPLUG_CPU=n
+#
+CONFIG_NO_HZ=y
+#
+CONFIG_PREEMPT_NONE=n
+CONFIG_PREEMPT_VOLUNTARY=n
+CONFIG_PREEMPT=y
+CONFIG_PROVE_LOCKING=y
+CONFIG_PROVE_RCU=y
+CONFIG_SYSFS_DEPRECATED_V2=y
+CONFIG_IKCONFIG=y
+CONFIG_IKCONFIG_PROC=y
+CONFIG_PRINTK_TIME=y
diff --git a/tools/testing/selftests/rcutorture/configs/v3.5/ver_functions.sh b/tools/testing/selftests/rcutorture/configs/v3.5/ver_functions.sh
new file mode 100644
index 000000000000..6a5f13aab44d
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/v3.5/ver_functions.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+#
+# Kernel-version-dependent shell functions for the rest of the scripts.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2013
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+# rcutorture_param_n_barrier_cbs bootparam-string
+#
+# Adds n_barrier_cbs rcutorture module parameter to kernels having it.
+rcutorture_param_n_barrier_cbs () {
+        if echo $1 | grep -q "rcutorture\.n_barrier_cbs"
+        then
+                echo $1
+        else
+                echo $1 rcutorture.n_barrier_cbs=4
+        fi
+}
+# rcutorture_param_onoff bootparam-string config-file
+#
+# Adds onoff rcutorture module parameters to kernels having it.
+rcutorture_param_onoff () {
+        if ! bootparam_hotplug_cpu "$1" && configfrag_hotplug_cpu "$2"
+        then
+                echo CPU-hotplug kernel, adding rcutorture onoff.
+                echo $1 rcutorture.onoff_interval=3 rcutorture.onoff_holdoff=30
+        else
+                echo $1
+        fi
+}
diff --git a/tools/testing/selftests/rcutorture/configs/ver_functions.sh b/tools/testing/selftests/rcutorture/configs/ver_functions.sh
new file mode 100644
index 000000000000..5e40eadea777
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/configs/ver_functions.sh
@@ -0,0 +1,46 @@
+#!/bin/bash
+#
+# Kernel-version-dependent shell functions for the rest of the scripts.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program; if not, you can access it online at
+# http://www.gnu.org/licenses/gpl-2.0.html.
+#
+# Copyright (C) IBM Corporation, 2013
+#
+# Authors: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
+# rcutorture_param_n_barrier_cbs bootparam-string
+#
+# Adds n_barrier_cbs rcutorture module parameter to kernels having it.
+rcutorture_param_n_barrier_cbs () {
+        if echo $1 | grep -q "rcutorture\.n_barrier_cbs"
+        then
+                echo $1
+        else
+                echo $1 rcutorture.n_barrier_cbs=4
+        fi
+}
+# rcutorture_param_onoff bootparam-string config-file
+#
+# Adds onoff rcutorture module parameters to kernels having it.
+rcutorture_param_onoff () {
+        if ! bootparam_hotplug_cpu "$1" && configfrag_hotplug_cpu "$2"
+        then
+                echo CPU-hotplug kernel, adding rcutorture onoff. 1>&2
+                echo $1 rcutorture.onoff_interval=3 rcutorture.onoff_holdoff=30
+        else
+                echo $1
+        fi
+}
diff --git a/tools/testing/selftests/rcutorture/doc/TINY_RCU.txt b/tools/testing/selftests/rcutorture/doc/TINY_RCU.txt
new file mode 100644
index 000000000000..28db67b54e55
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/doc/TINY_RCU.txt
@@ -0,0 +1,40 @@
+This document gives a brief rationale for the TINY_RCU test cases.
+Kconfig Parameters:
+CONFIG_DEBUG_LOCK_ALLOC -- Do all three and none of the three.
+CONFIG_PREEMPT_COUNT
+CONFIG_RCU_TRACE
+The theory here is that randconfig testing will hit the other six possible
+combinations of these parameters.
+Kconfig Parameters Ignored:
+CONFIG_DEBUG_OBJECTS_RCU_HEAD
+CONFIG_PROVE_RCU
+        In common code tested by TREE_RCU test cases.
+CONFIG_NO_HZ_FULL_SYSIDLE
+CONFIG_RCU_NOCB_CPU
+CONFIG_RCU_USER_QS
+        Meaningless for TINY_RCU.
+CONFIG_RCU_STALL_COMMON
+CONFIG_RCU_TORTURE_TEST
+        Redundant with CONFIG_RCU_TRACE.
+CONFIG_HOTPLUG_CPU
+CONFIG_PREEMPT
+CONFIG_PREEMPT_RCU
+CONFIG_SMP
+CONFIG_TINY_RCU
+CONFIG_TREE_PREEMPT_RCU
+CONFIG_TREE_RCU
+        All forced by CONFIG_TINY_RCU.
diff --git a/tools/testing/selftests/rcutorture/doc/TREE_RCU-Kconfig.txt b/tools/testing/selftests/rcutorture/doc/TREE_RCU-Kconfig.txt
new file mode 100644
index 000000000000..adbb76cffb49
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/doc/TREE_RCU-Kconfig.txt
@@ -0,0 +1,95 @@
+This document gives a brief rationale for the TREE_RCU-related test
+cases, a group that includes TREE_PREEMPT_RCU.
+Kconfig Parameters:
+CONFIG_DEBUG_LOCK_ALLOC -- Do three, covering CONFIG_PROVE_LOCKING & not.
+CONFIG_DEBUG_OBJECTS_RCU_HEAD -- Do one.
+CONFIG_HOTPLUG_CPU -- Do half.  (Every second.)
+CONFIG_HZ_PERIODIC -- Do one.
+CONFIG_NO_HZ_IDLE -- Do those not otherwise specified. (Groups of two.)
+CONFIG_NO_HZ_FULL -- Do two, one with CONFIG_NO_HZ_FULL_SYSIDLE.
+CONFIG_NO_HZ_FULL_SYSIDLE -- Do one.
+CONFIG_PREEMPT -- Do half.  (First three and #8.)
+CONFIG_PROVE_LOCKING -- Do all but two, covering CONFIG_PROVE_RCU and not.
+CONFIG_PROVE_RCU -- Do all but one under CONFIG_PROVE_LOCKING.
+CONFIG_PROVE_RCU_DELAY -- Do one.
+CONFIG_RCU_BOOST -- one of TREE_PREEMPT_RCU.
+CONFIG_RCU_BOOST_PRIO -- set to 2 for _BOOST testing.
+CONFIG_RCU_CPU_STALL_INFO -- do one with and without _VERBOSE.
+CONFIG_RCU_CPU_STALL_VERBOSE -- do one with and without _INFO.
+CONFIG_RCU_FANOUT -- Cover hierarchy as currently, but overlap with others.
+CONFIG_RCU_FANOUT_EXACT -- Do one.
+CONFIG_RCU_FANOUT_LEAF -- Do one non-default.
+CONFIG_RCU_FAST_NO_HZ -- Do one, but not with CONFIG_RCU_NOCB_CPU_ALL.
+CONFIG_RCU_NOCB_CPU -- Do three, see below.
+CONFIG_RCU_NOCB_CPU_ALL -- Do one.
+CONFIG_RCU_NOCB_CPU_NONE -- Do one.
+CONFIG_RCU_NOCB_CPU_ZERO -- Do one.
+CONFIG_RCU_TRACE -- Do half.
+CONFIG_SMP -- Need one !SMP for TREE_PREEMPT_RCU.
+RCU-bh: Do one with PREEMPT and one with !PREEMPT.
+RCU-sched: Do one with PREEMPT but not BOOST.
+Hierarchy:
+TREE01. CONFIG_NR_CPUS=8, CONFIG_RCU_FANOUT=8, CONFIG_RCU_FANOUT_EXACT=n.
+TREE02. CONFIG_NR_CPUS=8, CONFIG_RCU_FANOUT=3, CONFIG_RCU_FANOUT_EXACT=n,
+        CONFIG_RCU_FANOUT_LEAF=3.
+TREE03. CONFIG_NR_CPUS=8, CONFIG_RCU_FANOUT=4, CONFIG_RCU_FANOUT_EXACT=n,
+        CONFIG_RCU_FANOUT_LEAF=4.
+TREE04. CONFIG_NR_CPUS=8, CONFIG_RCU_FANOUT=2, CONFIG_RCU_FANOUT_EXACT=n,
+        CONFIG_RCU_FANOUT_LEAF=2.
+TREE05. CONFIG_NR_CPUS=8, CONFIG_RCU_FANOUT=6, CONFIG_RCU_FANOUT_EXACT=n
+        CONFIG_RCU_FANOUT_LEAF=6.
+TREE06. CONFIG_NR_CPUS=8, CONFIG_RCU_FANOUT=6, CONFIG_RCU_FANOUT_EXACT=y
+        CONFIG_RCU_FANOUT_LEAF=6.
+TREE07. CONFIG_NR_CPUS=16, CONFIG_RCU_FANOUT=2, CONFIG_RCU_FANOUT_EXACT=n,
+        CONFIG_RCU_FANOUT_LEAF=2.
+TREE08. CONFIG_NR_CPUS=16, CONFIG_RCU_FANOUT=3, CONFIG_RCU_FANOUT_EXACT=y,
+        CONFIG_RCU_FANOUT_LEAF=2.
+TREE09. CONFIG_NR_CPUS=1.
+Kconfig Parameters Ignored:
+CONFIG_64BIT
+        Used only to check CONFIG_RCU_FANOUT value, inspection suffices.
+CONFIG_NO_HZ_FULL_SYSIDLE_SMALL
+        Defer until Frederic uses this.
+CONFIG_PREEMPT_COUNT
+CONFIG_PREEMPT_RCU
+        Redundant with CONFIG_PREEMPT, ignore.
+CONFIG_RCU_BOOST_DELAY
+        Inspection suffices, ignore.
+CONFIG_RCU_CPU_STALL_TIMEOUT
+        Inspection suffices, ignore.
+CONFIG_RCU_STALL_COMMON
+        Implied by TREE_RCU and TREE_PREEMPT_RCU.
+CONFIG_RCU_TORTURE_TEST
+CONFIG_RCU_TORTURE_TEST_RUNNABLE
+        Always used in KVM testing.
+CONFIG_RCU_USER_QS
+        Redundant with CONFIG_NO_HZ_FULL.
+CONFIG_TREE_PREEMPT_RCU
+CONFIG_TREE_RCU
+        These are controlled by CONFIG_PREEMPT.
diff --git a/tools/testing/selftests/rcutorture/doc/initrd.txt b/tools/testing/selftests/rcutorture/doc/initrd.txt
new file mode 100644
index 000000000000..49d134c25c04
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/doc/initrd.txt
@@ -0,0 +1,90 @@
+This document describes one way to create the initrd directory hierarchy
+in order to allow an initrd to be built into your kernel.  The trick
+here is to steal the initrd file used on your Linux laptop, Ubuntu in
+this case.  There are probably much better ways of doing this.
+That said, here are the commands:
+------------------------------------------------------------------------
+zcat /initrd.img > /tmp/initrd.img.zcat
+mkdir initrd
+cd initrd
+cpio -id < /tmp/initrd.img.zcat
+------------------------------------------------------------------------
+Interestingly enough, if you are running rcutorture, you don't really
+need userspace in many cases.  Running without userspace has the
+advantage of allowing you to test your kernel independently of the
+distro in place, the root-filesystem layout, and so on.  To make this
+happen, put the following script in the initrd's tree's "/init" file,
+with 0755 mode.
+------------------------------------------------------------------------
+#!/bin/sh
+[ -d /dev ] || mkdir -m 0755 /dev
+[ -d /root ] || mkdir -m 0700 /root
+[ -d /sys ] || mkdir /sys
+[ -d /proc ] || mkdir /proc
+[ -d /tmp ] || mkdir /tmp
+mkdir -p /var/lock
+mount -t sysfs -o nodev,noexec,nosuid sysfs /sys
+mount -t proc -o nodev,noexec,nosuid proc /proc
+# Some things don't work properly without /etc/mtab.
+ln -sf /proc/mounts /etc/mtab
+# Note that this only becomes /dev on the real filesystem if udev's scripts
+# are used; which they will be, but it's worth pointing out
+if ! mount -t devtmpfs -o mode=0755 udev /dev; then
+        echo "W: devtmpfs not available, falling back to tmpfs for /dev"
+        mount -t tmpfs -o mode=0755 udev /dev
+        [ -e /dev/console ] || mknod --mode=600 /dev/console c 5 1
+        [ -e /dev/kmsg ] || mknod --mode=644 /dev/kmsg c 1 11
+        [ -e /dev/null ] || mknod --mode=666 /dev/null c 1 3
+fi
+mkdir /dev/pts
+mount -t devpts -o noexec,nosuid,gid=5,mode=0620 devpts /dev/pts || true
+mount -t tmpfs -o "nosuid,size=20%,mode=0755" tmpfs /run
+mkdir /run/initramfs
+# compatibility symlink for the pre-oneiric locations
+ln -s /run/initramfs /dev/.initramfs
+# Export relevant variables
+export ROOT=
+export ROOTDELAY=
+export ROOTFLAGS=
+export ROOTFSTYPE=
+export IP=
+export BOOT=
+export BOOTIF=
+export UBIMTD=
+export break=
+export init=/sbin/init
+export quiet=n
+export readonly=y
+export rootmnt=/root
+export debug=
+export panic=
+export blacklist=
+export resume=
+export resume_offset=
+export recovery=
+for i in /sys/devices/system/cpu/cpu*/online
+do
+        case $i in
+        '/sys/devices/system/cpu/cpu0/online')
+                ;;
+        '/sys/devices/system/cpu/cpu*/online')
+                ;;
+        *)
+                echo 1 > $i
+                ;;
+        esac
+done
+while :
+do
+        sleep 10
+done
diff --git a/tools/testing/selftests/rcutorture/doc/rcu-test-image.txt b/tools/testing/selftests/rcutorture/doc/rcu-test-image.txt
new file mode 100644
index 000000000000..66efb59a1bd1
--- /dev/null
+++ b/tools/testing/selftests/rcutorture/doc/rcu-test-image.txt
@@ -0,0 +1,42 @@
+This document describes one way to created the rcu-test-image file
+that contains the filesystem used by the guest-OS kernel.  There are
+probably much better ways of doing this, and this filesystem could no
+doubt be smaller.  It is probably also possible to simply download
+an appropriate image from any number of places.
+That said, here are the commands:
+------------------------------------------------------------------------
+dd if=/dev/zero of=rcu-test-image bs=400M count=1
+mkfs.ext3 ./rcu-test-image
+sudo mount -o loop ./rcu-test-image /mnt
+# Replace "precise" below with your favorite Ubuntu release.
+# Empirical evidence says this image will work for 64-bit, but...
+# Note that debootstrap does take a few minutes to run.  Or longer.
+sudo debootstrap --verbose --arch i386 precise /mnt http://archive.ubuntu.com/ubuntu
+cat << '___EOF___' | sudo dd of=/mnt/etc/fstab
+# UNCONFIGURED FSTAB FOR BASE SYSTEM
+#
+/dev/vda        /               ext3    defaults        1 1
+dev             /dev            tmpfs   rw              0 0
+tmpfs           /dev/shm        tmpfs   defaults        0 0
+devpts          /dev/pts        devpts  gid=5,mode=620  0 0
+sysfs           /sys            sysfs   defaults        0 0
+proc            /proc           proc    defaults        0 0
+___EOF___
+sudo umount /mnt
+------------------------------------------------------------------------
+References:
+        http://sripathikodi.blogspot.com/2010/02/creating-kvm-bootable-fedora-system.html
+        https://help.ubuntu.com/community/KVM/CreateGuests
+        https://help.ubuntu.com/community/JeOSVMBuilder
+        http://wiki.libvirt.org/page/UbuntuKVMWalkthrough
+        http://www.moe.co.uk/2011/01/07/pci_add_option_rom-failed-to-find-romfile-pxe-rtl8139-bin/ -- "apt-get install kvm-pxe"
+        http://www.landley.net/writing/rootfs-howto.html
+        http://en.wikipedia.org/wiki/Initrd
+        http://en.wikipedia.org/wiki/Cpio
+        http://wiki.libvirt.org/page/UbuntuKVMWalkthrough
diff --git a/tools/vm/Makefile b/tools/vm/Makefile
index 24e9ddd93fa4..3d907dacf2ac 100644
--- a/tools/vm/Makefile
+++ b/tools/vm/Makefile
@@ -2,21 +2,21 @@
 #
 TARGETS=page-types slabinfo
-LK_DIR = ../lib/lk
+LIB_DIR = ../lib/api
-LIBLK = $(LK_DIR)/liblk.a
+LIBS = $(LIB_DIR)/libapikfs.a
 CC = $(CROSS_COMPILE)gcc
 CFLAGS = -Wall -Wextra -I../lib/
-LDFLAGS = $(LIBLK)
+LDFLAGS = $(LIBS)
-$(TARGETS): liblk
+$(TARGETS): $(LIBS)
-liblk:
+$(LIBS):
-        make -C $(LK_DIR)
+        make -C $(LIB_DIR)
 %: %.c
        $(CC) $(CFLAGS) -o $@ $< $(LDFLAGS)
 clean:
        $(RM) page-types slabinfo
-        make -C ../lib/lk clean
+        make -C $(LIB_DIR) clean
diff --git a/tools/vm/page-types.c b/tools/vm/page-types.c
index d5e9d6d185c8..f9be24d9efac 100644
--- a/tools/vm/page-types.c
+++ b/tools/vm/page-types.c
@@ -36,7 +36,7 @@
 #include <sys/statfs.h>
 #include "../../include/uapi/linux/magic.h"
 #include "../../include/uapi/linux/kernel-page-flags.h"
-#include <lk/debugfs.h>
+#include <api/fs/debugfs.h>
 #ifndef MAX_PATH
 # define MAX_PATH 256