109 files changed, 2990 insertions, 1677 deletions
diff --git a/arch/ia64/include/asm/sections.h b/arch/ia64/include/asm/sections.h
index f66799891036..1a873b36a4a1 100644
--- a/arch/ia64/include/asm/sections.h
+++ b/arch/ia64/include/asm/sections.h
@@ -11,6 +11,9 @@
 #include <asm-generic/sections.h>
 extern char __per_cpu_start[], __per_cpu_end[], __phys_per_cpu_start[];
+#ifdef  CONFIG_SMP
+extern char __cpu0_per_cpu[];
+#endif
 extern char __start___vtop_patchlist[], __end___vtop_patchlist[];
 extern char __start___rse_patchlist[], __end___rse_patchlist[];
 extern char __start___mckinley_e9_bundles[], __end___mckinley_e9_bundles[];
diff --git a/arch/ia64/kernel/head.S b/arch/ia64/kernel/head.S
index 8bdea8eb62e3..66e491d8baac 100644
--- a/arch/ia64/kernel/head.S
+++ b/arch/ia64/kernel/head.S
@@ -367,16 +367,17 @@ start_ap:
        ;;
 #else
 (isAP)  br.few 2f
-        mov r20=r19
+        movl r20=__cpu0_per_cpu
-        sub r19=r19,r18
        ;;
        shr.u r18=r18,3
 1:
-        ld8 r21=[r20],8;;
+        ld8 r21=[r19],8;;
-        st8[r19]=r21,8
+        st8[r20]=r21,8
        adds r18=-1,r18;;
        cmp4.lt p7,p6=0,r18
 (p7)    br.cond.dptk.few 1b
+        mov r19=r20
+        ;;
 2:
 #endif
        tpa r19=r19
diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
index de71da811cd6..10a7d47e8510 100644
--- a/arch/ia64/kernel/vmlinux.lds.S
+++ b/arch/ia64/kernel/vmlinux.lds.S
@@ -215,9 +215,6 @@ SECTIONS
  /* Per-cpu data: */
  percpu : { } :percpu
  . = ALIGN(PERCPU_PAGE_SIZE);
-#ifdef  CONFIG_SMP
-  . = . + PERCPU_PAGE_SIZE;     /* cpu0 per-cpu space */
-#endif
  __phys_per_cpu_start = .;
  .data.percpu PERCPU_ADDR : AT(__phys_per_cpu_start - LOAD_OFFSET)
        {
@@ -233,6 +230,11 @@ SECTIONS
  data : { } :data
  .data : AT(ADDR(.data) - LOAD_OFFSET)
        {
+#ifdef  CONFIG_SMP
+  . = ALIGN(PERCPU_PAGE_SIZE);
+                __cpu0_per_cpu = .;
+  . = . + PERCPU_PAGE_SIZE;     /* cpu0 per-cpu space */
+#endif
                DATA_DATA
                *(.data1)
                *(.gnu.linkonce.d*)
diff --git a/arch/ia64/mm/contig.c b/arch/ia64/mm/contig.c
index e566ff43884a..0ee085efbe29 100644
--- a/arch/ia64/mm/contig.c
+++ b/arch/ia64/mm/contig.c
@@ -163,7 +163,7 @@ per_cpu_init (void)
         * get_zeroed_page().
         */
        if (first_time) {
-                void *cpu0_data = __phys_per_cpu_start - PERCPU_PAGE_SIZE;
+                void *cpu0_data = __cpu0_per_cpu;
                first_time=0;
diff --git a/arch/ia64/mm/discontig.c b/arch/ia64/mm/discontig.c
index 78026aabaa7f..d8c5fcd89e5b 100644
--- a/arch/ia64/mm/discontig.c
+++ b/arch/ia64/mm/discontig.c
@@ -144,7 +144,7 @@ static void *per_cpu_node_setup(void *cpu_data, int node)
        for_each_possible_early_cpu(cpu) {
                if (cpu == 0) {
-                        void *cpu0_data = __phys_per_cpu_start - PERCPU_PAGE_SIZE;
+                        void *cpu0_data = __cpu0_per_cpu;
                        __per_cpu_offset[cpu] = (char*)cpu0_data -
                                __per_cpu_start;
                } else if (node == node_cpuid[cpu].nid) {
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 49896a2a1d72..c930b8ceb418 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -1403,7 +1403,6 @@ config MIPS_MT_SMTC
        depends on CPU_MIPS32_R2
        #depends on CPU_MIPS64_R2               # once there is hardware ...
        depends on SYS_SUPPORTS_MULTITHREADING
-        select GENERIC_CLOCKEVENTS_BROADCAST
        select CPU_MIPSR2_IRQ_VI
        select CPU_MIPSR2_IRQ_EI
        select MIPS_MT
@@ -1451,32 +1450,17 @@ config MIPS_VPE_LOADER
          Includes a loader for loading an elf relocatable object
          onto another VPE and running it.
-config MIPS_MT_SMTC_INSTANT_REPLAY
-        bool "Low-latency Dispatch of Deferred SMTC IPIs"
-        depends on MIPS_MT_SMTC && !PREEMPT
-        default y
-        help
-          SMTC pseudo-interrupts between TCs are deferred and queued
-          if the target TC is interrupt-inhibited (IXMT). In the first
-          SMTC prototypes, these queued IPIs were serviced on return
-          to user mode, or on entry into the kernel idle loop. The
-          INSTANT_REPLAY option dispatches them as part of local_irq_restore()
-          processing, which adds runtime overhead (hence the option to turn
-          it off), but ensures that IPIs are handled promptly even under
-          heavy I/O interrupt load.
 config MIPS_MT_SMTC_IM_BACKSTOP
        bool "Use per-TC register bits as backstop for inhibited IM bits"
        depends on MIPS_MT_SMTC
-        default y
+        default n
        help
          To support multiple TC microthreads acting as "CPUs" within
          a VPE, VPE-wide interrupt mask bits must be specially manipulated
          during interrupt handling. To support legacy drivers and interrupt
          controller management code, SMTC has a "backstop" to track and
          if necessary restore the interrupt mask. This has some performance
-          impact on interrupt service overhead. Disable it only if you know
+          impact on interrupt service overhead.
-          what you are doing.
 config MIPS_MT_SMTC_IRQAFF
        bool "Support IRQ affinity API"
@@ -1486,10 +1470,8 @@ config MIPS_MT_SMTC_IRQAFF
          Enables SMP IRQ affinity API (/proc/irq/*/smp_affinity, etc.)
          for SMTC Linux kernel. Requires platform support, of which
          an example can be found in the MIPS kernel i8259 and Malta
-          platform code.  It is recommended that MIPS_MT_SMTC_INSTANT_REPLAY
+          platform code.  Adds some overhead to interrupt dispatch, and
-          be enabled if MIPS_MT_SMTC_IRQAFF is used. Adds overhead to
+          should be used only if you know what you are doing.
-          interrupt dispatch, and should be used only if you know what
-          you are doing.
 config MIPS_VPE_LOADER_TOM
        bool "Load VPE program into memory hidden from linux"
diff --git a/arch/mips/kernel/Makefile b/arch/mips/kernel/Makefile
index 706f93974797..25775cb54000 100644
--- a/arch/mips/kernel/Makefile
+++ b/arch/mips/kernel/Makefile
@@ -10,6 +10,7 @@ obj-y		+= cpu-probe.o branch.o entry.o genex.o irq.o process.o \
 obj-$(CONFIG_CEVT_BCM1480)      += cevt-bcm1480.o
 obj-$(CONFIG_CEVT_R4K)          += cevt-r4k.o
+obj-$(CONFIG_MIPS_MT_SMTC)      += cevt-smtc.o
 obj-$(CONFIG_CEVT_DS1287)       += cevt-ds1287.o
 obj-$(CONFIG_CEVT_GT641XX)      += cevt-gt641xx.o
 obj-$(CONFIG_CEVT_SB1250)       += cevt-sb1250.o
diff --git a/arch/mips/kernel/cevt-r4k.c b/arch/mips/kernel/cevt-r4k.c
index 24a2d907aa0d..4a4c59f2737a 100644
--- a/arch/mips/kernel/cevt-r4k.c
+++ b/arch/mips/kernel/cevt-r4k.c
@@ -12,6 +12,14 @@
 #include <asm/smtc_ipi.h>
 #include <asm/time.h>
+#include <asm/cevt-r4k.h>
+/*
+ * The SMTC Kernel for the 34K, 1004K, et. al. replaces several
+ * of these routines with SMTC-specific variants.
+ */
+#ifndef CONFIG_MIPS_MT_SMTC
 static int mips_next_event(unsigned long delta,
                           struct clock_event_device *evt)
@@ -19,60 +27,27 @@ static int mips_next_event(unsigned long delta,
        unsigned int cnt;
        int res;
-#ifdef CONFIG_MIPS_MT_SMTC
-        {
-        unsigned long flags, vpflags;
-        local_irq_save(flags);
-        vpflags = dvpe();
-#endif
        cnt = read_c0_count();
        cnt += delta;
        write_c0_compare(cnt);
        res = ((int)(read_c0_count() - cnt) > 0) ? -ETIME : 0;
-#ifdef CONFIG_MIPS_MT_SMTC
-        evpe(vpflags);
-        local_irq_restore(flags);
-        }
-#endif
        return res;
 }
-static void mips_set_mode(enum clock_event_mode mode,
+#endif /* CONFIG_MIPS_MT_SMTC */
-                          struct clock_event_device *evt)
+void mips_set_clock_mode(enum clock_event_mode mode,
+                                struct clock_event_device *evt)
 {
        /* Nothing to do ...  */
 }
-static DEFINE_PER_CPU(struct clock_event_device, mips_clockevent_device);
+DEFINE_PER_CPU(struct clock_event_device, mips_clockevent_device);
-static int cp0_timer_irq_installed;
+int cp0_timer_irq_installed;
-/*
+#ifndef CONFIG_MIPS_MT_SMTC
- * Timer ack for an R4k-compatible timer of a known frequency.
- */
-static void c0_timer_ack(void)
-{
-        write_c0_compare(read_c0_compare());
-}
-/*
+irqreturn_t c0_compare_interrupt(int irq, void *dev_id)
- * Possibly handle a performance counter interrupt.
- * Return true if the timer interrupt should not be checked
- */
-static inline int handle_perf_irq(int r2)
-{
-        /*
-         * The performance counter overflow interrupt may be shared with the
-         * timer interrupt (cp0_perfcount_irq < 0). If it is and a
-         * performance counter has overflowed (perf_irq() == IRQ_HANDLED)
-         * and we can't reliably determine if a counter interrupt has also
-         * happened (!r2) then don't check for a timer interrupt.
-         */
-        return (cp0_perfcount_irq < 0) &&
-                perf_irq() == IRQ_HANDLED &&
-                !r2;
-}
-static irqreturn_t c0_compare_interrupt(int irq, void *dev_id)
 {
        const int r2 = cpu_has_mips_r2;
        struct clock_event_device *cd;
@@ -93,12 +68,8 @@ static irqreturn_t c0_compare_interrupt(int irq, void *dev_id)
         * interrupt.  Being the paranoiacs we are we check anyway.
         */
        if (!r2 || (read_c0_cause() & (1 << 30))) {
-                c0_timer_ack();
+                /* Clear Count/Compare Interrupt */
-#ifdef CONFIG_MIPS_MT_SMTC
+                write_c0_compare(read_c0_compare());
-                if (cpu_data[cpu].vpe_id)
-                        goto out;
-                cpu = 0;
-#endif
                cd = &per_cpu(mips_clockevent_device, cpu);
                cd->event_handler(cd);
        }
@@ -107,65 +78,16 @@ out:
        return IRQ_HANDLED;
 }
-static struct irqaction c0_compare_irqaction = {
+#endif /* Not CONFIG_MIPS_MT_SMTC */
+struct irqaction c0_compare_irqaction = {
        .handler = c0_compare_interrupt,
-#ifdef CONFIG_MIPS_MT_SMTC
-        .flags = IRQF_DISABLED,
-#else
        .flags = IRQF_DISABLED | IRQF_PERCPU,
-#endif
        .name = "timer",
 };
-#ifdef CONFIG_MIPS_MT_SMTC
-DEFINE_PER_CPU(struct clock_event_device, smtc_dummy_clockevent_device);
-static void smtc_set_mode(enum clock_event_mode mode,
-                          struct clock_event_device *evt)
-{
-}
-static void mips_broadcast(cpumask_t mask)
-{
-        unsigned int cpu;
-        for_each_cpu_mask(cpu, mask)
-                smtc_send_ipi(cpu, SMTC_CLOCK_TICK, 0);
-}
-static void setup_smtc_dummy_clockevent_device(void)
-{
-        //uint64_t mips_freq = mips_hpt_^frequency;
-        unsigned int cpu = smp_processor_id();
-        struct clock_event_device *cd;
-        cd = &per_cpu(smtc_dummy_clockevent_device, cpu);
+void mips_event_handler(struct clock_event_device *dev)
-        cd->name                = "SMTC";
-        cd->features            = CLOCK_EVT_FEAT_DUMMY;
-        /* Calculate the min / max delta */
-        cd->mult        = 0; //div_sc((unsigned long) mips_freq, NSEC_PER_SEC, 32);
-        cd->shift               = 0; //32;
-        cd->max_delta_ns        = 0; //clockevent_delta2ns(0x7fffffff, cd);
-        cd->min_delta_ns        = 0; //clockevent_delta2ns(0x30, cd);
-        cd->rating              = 200;
-        cd->irq                 = 17; //-1;
-//      if (cpu)
-//              cd->cpumask     = CPU_MASK_ALL; // cpumask_of_cpu(cpu);
-//      else
-                cd->cpumask     = cpumask_of_cpu(cpu);
-        cd->set_mode            = smtc_set_mode;
-        cd->broadcast           = mips_broadcast;
-        clockevents_register_device(cd);
-}
-#endif
-static void mips_event_handler(struct clock_event_device *dev)
 {
 }
@@ -177,7 +99,23 @@ static int c0_compare_int_pending(void)
        return (read_c0_cause() >> cp0_compare_irq) & 0x100;
 }
-static int c0_compare_int_usable(void)
+/*
+ * Compare interrupt can be routed and latched outside the core,
+ * so a single execution hazard barrier may not be enough to give
+ * it time to clear as seen in the Cause register.  4 time the
+ * pipeline depth seems reasonably conservative, and empirically
+ * works better in configurations with high CPU/bus clock ratios.
+ */
+#define compare_change_hazard() \
+        do { \
+                irq_disable_hazard(); \
+                irq_disable_hazard(); \
+                irq_disable_hazard(); \
+                irq_disable_hazard(); \
+        } while (0)
+int c0_compare_int_usable(void)
 {
        unsigned int delta;
        unsigned int cnt;
@@ -187,7 +125,7 @@ static int c0_compare_int_usable(void)
         */
        if (c0_compare_int_pending()) {
                write_c0_compare(read_c0_count());
-                irq_disable_hazard();
+                compare_change_hazard();
                if (c0_compare_int_pending())
                        return 0;
        }
@@ -196,7 +134,7 @@ static int c0_compare_int_usable(void)
                cnt = read_c0_count();
                cnt += delta;
                write_c0_compare(cnt);
-                irq_disable_hazard();
+                compare_change_hazard();
                if ((int)(read_c0_count() - cnt) < 0)
                    break;
                /* increase delta if the timer was already expired */
@@ -205,11 +143,12 @@ static int c0_compare_int_usable(void)
        while ((int)(read_c0_count() - cnt) <= 0)
                ;       /* Wait for expiry  */
+        compare_change_hazard();
        if (!c0_compare_int_pending())
                return 0;
        write_c0_compare(read_c0_count());
-        irq_disable_hazard();
+        compare_change_hazard();
        if (c0_compare_int_pending())
                return 0;
@@ -219,6 +158,8 @@ static int c0_compare_int_usable(void)
        return 1;
 }
+#ifndef CONFIG_MIPS_MT_SMTC
 int __cpuinit mips_clockevent_init(void)
 {
        uint64_t mips_freq = mips_hpt_frequency;
@@ -229,17 +170,6 @@ int __cpuinit mips_clockevent_init(void)
        if (!cpu_has_counter || !mips_hpt_frequency)
                return -ENXIO;
-#ifdef CONFIG_MIPS_MT_SMTC
-        setup_smtc_dummy_clockevent_device();
-        /*
-         * On SMTC we only register VPE0's compare interrupt as clockevent
-         * device.
-         */
-        if (cpu)
-                return 0;
-#endif
        if (!c0_compare_int_usable())
                return -ENXIO;
@@ -265,13 +195,9 @@ int __cpuinit mips_clockevent_init(void)
        cd->rating              = 300;
        cd->irq                 = irq;
-#ifdef CONFIG_MIPS_MT_SMTC
-        cd->cpumask             = CPU_MASK_ALL;
-#else
        cd->cpumask             = cpumask_of_cpu(cpu);
-#endif
        cd->set_next_event      = mips_next_event;
-        cd->set_mode            = mips_set_mode;
+        cd->set_mode            = mips_set_clock_mode;
        cd->event_handler       = mips_event_handler;
        clockevents_register_device(cd);
@@ -281,12 +207,9 @@ int __cpuinit mips_clockevent_init(void)
        cp0_timer_irq_installed = 1;
-#ifdef CONFIG_MIPS_MT_SMTC
-#define CPUCTR_IMASKBIT (0x100 << cp0_compare_irq)
-        setup_irq_smtc(irq, &c0_compare_irqaction, CPUCTR_IMASKBIT);
-#else
        setup_irq(irq, &c0_compare_irqaction);
-#endif
        return 0;
 }
+#endif /* Not CONFIG_MIPS_MT_SMTC */
diff --git a/arch/mips/kernel/cevt-smtc.c b/arch/mips/kernel/cevt-smtc.c
new file mode 100644
index 000000000000..5162fe4b5952
--- /dev/null
+++ b/arch/mips/kernel/cevt-smtc.c
@@ -0,0 +1,321 @@
+/*
+ * This file is subject to the terms and conditions of the GNU General Public
+ * License.  See the file "COPYING" in the main directory of this archive
+ * for more details.
+ *
+ * Copyright (C) 2007 MIPS Technologies, Inc.
+ * Copyright (C) 2007 Ralf Baechle <ralf@linux-mips.org>
+ * Copyright (C) 2008 Kevin D. Kissell, Paralogos sarl
+ */
+#include <linux/clockchips.h>
+#include <linux/interrupt.h>
+#include <linux/percpu.h>
+#include <asm/smtc_ipi.h>
+#include <asm/time.h>
+#include <asm/cevt-r4k.h>
+/*
+ * Variant clock event timer support for SMTC on MIPS 34K, 1004K
+ * or other MIPS MT cores.
+ *
+ * Notes on SMTC Support:
+ *
+ * SMTC has multiple microthread TCs pretending to be Linux CPUs.
+ * But there's only one Count/Compare pair per VPE, and Compare
+ * interrupts are taken opportunisitically by available TCs
+ * bound to the VPE with the Count register.  The new timer
+ * framework provides for global broadcasts, but we really
+ * want VPE-level multicasts for best behavior. So instead
+ * of invoking the high-level clock-event broadcast code,
+ * this version of SMTC support uses the historical SMTC
+ * multicast mechanisms "under the hood", appearing to the
+ * generic clock layer as if the interrupts are per-CPU.
+ *
+ * The approach taken here is to maintain a set of NR_CPUS
+ * virtual timers, and track which "CPU" needs to be alerted
+ * at each event.
+ *
+ * It's unlikely that we'll see a MIPS MT core with more than
+ * 2 VPEs, but we *know* that we won't need to handle more
+ * VPEs than we have "CPUs".  So NCPUs arrays of NCPUs elements
+ * is always going to be overkill, but always going to be enough.
+ */
+unsigned long smtc_nexttime[NR_CPUS][NR_CPUS];
+static int smtc_nextinvpe[NR_CPUS];
+/*
+ * Timestamps stored are absolute values to be programmed
+ * into Count register.  Valid timestamps will never be zero.
+ * If a Zero Count value is actually calculated, it is converted
+ * to be a 1, which will introduce 1 or two CPU cycles of error
+ * roughly once every four billion events, which at 1000 HZ means
+ * about once every 50 days.  If that's actually a problem, one
+ * could alternate squashing 0 to 1 and to -1.
+ */
+#define MAKEVALID(x) (((x) == 0L) ? 1L : (x))
+#define ISVALID(x) ((x) != 0L)
+/*
+ * Time comparison is subtle, as it's really truncated
+ * modular arithmetic.
+ */
+#define IS_SOONER(a, b, reference) \
+    (((a) - (unsigned long)(reference)) < ((b) - (unsigned long)(reference)))
+/*
+ * CATCHUP_INCREMENT, used when the function falls behind the counter.
+ * Could be an increasing function instead of a constant;
+ */
+#define CATCHUP_INCREMENT 64
+static int mips_next_event(unsigned long delta,
+                                struct clock_event_device *evt)
+{
+        unsigned long flags;
+        unsigned int mtflags;
+        unsigned long timestamp, reference, previous;
+        unsigned long nextcomp = 0L;
+        int vpe = current_cpu_data.vpe_id;
+        int cpu = smp_processor_id();
+        local_irq_save(flags);
+        mtflags = dmt();
+        /*
+         * Maintain the per-TC virtual timer
+         * and program the per-VPE shared Count register
+         * as appropriate here...
+         */
+        reference = (unsigned long)read_c0_count();
+        timestamp = MAKEVALID(reference + delta);
+        /*
+         * To really model the clock, we have to catch the case
+         * where the current next-in-VPE timestamp is the old
+         * timestamp for the calling CPE, but the new value is
+         * in fact later.  In that case, we have to do a full
+         * scan and discover the new next-in-VPE CPU id and
+         * timestamp.
+         */
+        previous = smtc_nexttime[vpe][cpu];
+        if (cpu == smtc_nextinvpe[vpe] && ISVALID(previous)
+            && IS_SOONER(previous, timestamp, reference)) {
+                int i;
+                int soonest = cpu;
+                /*
+                 * Update timestamp array here, so that new
+                 * value gets considered along with those of
+                 * other virtual CPUs on the VPE.
+                 */
+                smtc_nexttime[vpe][cpu] = timestamp;
+                for_each_online_cpu(i) {
+                        if (ISVALID(smtc_nexttime[vpe][i])
+                            && IS_SOONER(smtc_nexttime[vpe][i],
+                                smtc_nexttime[vpe][soonest], reference)) {
+                                    soonest = i;
+                        }
+                }
+                smtc_nextinvpe[vpe] = soonest;
+                nextcomp = smtc_nexttime[vpe][soonest];
+        /*
+         * Otherwise, we don't have to process the whole array rank,
+         * we just have to see if the event horizon has gotten closer.
+         */
+        } else {
+                if (!ISVALID(smtc_nexttime[vpe][smtc_nextinvpe[vpe]]) ||
+                    IS_SOONER(timestamp,
+                        smtc_nexttime[vpe][smtc_nextinvpe[vpe]], reference)) {
+                            smtc_nextinvpe[vpe] = cpu;
+                            nextcomp = timestamp;
+                }
+                /*
+                 * Since next-in-VPE may me the same as the executing
+                 * virtual CPU, we update the array *after* checking
+                 * its value.
+                 */
+                smtc_nexttime[vpe][cpu] = timestamp;
+        }
+        /*
+         * It may be that, in fact, we don't need to update Compare,
+         * but if we do, we want to make sure we didn't fall into
+         * a crack just behind Count.
+         */
+        if (ISVALID(nextcomp)) {
+                write_c0_compare(nextcomp);
+                ehb();
+                /*
+                 * We never return an error, we just make sure
+                 * that we trigger the handlers as quickly as
+                 * we can if we fell behind.
+                 */
+                while ((nextcomp - (unsigned long)read_c0_count())
+                        > (unsigned long)LONG_MAX) {
+                        nextcomp += CATCHUP_INCREMENT;
+                        write_c0_compare(nextcomp);
+                        ehb();
+                }
+        }
+        emt(mtflags);
+        local_irq_restore(flags);
+        return 0;
+}
+void smtc_distribute_timer(int vpe)
+{
+        unsigned long flags;
+        unsigned int mtflags;
+        int cpu;
+        struct clock_event_device *cd;
+        unsigned long nextstamp = 0L;
+        unsigned long reference;
+repeat:
+        for_each_online_cpu(cpu) {
+            /*
+             * Find virtual CPUs within the current VPE who have
+             * unserviced timer requests whose time is now past.
+             */
+            local_irq_save(flags);
+            mtflags = dmt();
+            if (cpu_data[cpu].vpe_id == vpe &&
+                ISVALID(smtc_nexttime[vpe][cpu])) {
+                reference = (unsigned long)read_c0_count();
+                if ((smtc_nexttime[vpe][cpu] - reference)
+                         > (unsigned long)LONG_MAX) {
+                            smtc_nexttime[vpe][cpu] = 0L;
+                            emt(mtflags);
+                            local_irq_restore(flags);
+                            /*
+                             * We don't send IPIs to ourself.
+                             */
+                            if (cpu != smp_processor_id()) {
+                                smtc_send_ipi(cpu, SMTC_CLOCK_TICK, 0);
+                            } else {
+                                cd = &per_cpu(mips_clockevent_device, cpu);
+                                cd->event_handler(cd);
+                            }
+                } else {
+                        /* Local to VPE but Valid Time not yet reached. */
+                        if (!ISVALID(nextstamp) ||
+                            IS_SOONER(smtc_nexttime[vpe][cpu], nextstamp,
+                            reference)) {
+                                smtc_nextinvpe[vpe] = cpu;
+                                nextstamp = smtc_nexttime[vpe][cpu];
+                        }
+                        emt(mtflags);
+                        local_irq_restore(flags);
+                }
+            } else {
+                emt(mtflags);
+                local_irq_restore(flags);
+            }
+        }
+        /* Reprogram for interrupt at next soonest timestamp for VPE */
+        if (ISVALID(nextstamp)) {
+                write_c0_compare(nextstamp);
+                ehb();
+                if ((nextstamp - (unsigned long)read_c0_count())
+                        > (unsigned long)LONG_MAX)
+                                goto repeat;
+        }
+}
+irqreturn_t c0_compare_interrupt(int irq, void *dev_id)
+{
+        int cpu = smp_processor_id();
+        /* If we're running SMTC, we've got MIPS MT and therefore MIPS32R2 */
+        handle_perf_irq(1);
+        if (read_c0_cause() & (1 << 30)) {
+                /* Clear Count/Compare Interrupt */
+                write_c0_compare(read_c0_compare());
+                smtc_distribute_timer(cpu_data[cpu].vpe_id);
+        }
+        return IRQ_HANDLED;
+}
+int __cpuinit mips_clockevent_init(void)
+{
+        uint64_t mips_freq = mips_hpt_frequency;
+        unsigned int cpu = smp_processor_id();
+        struct clock_event_device *cd;
+        unsigned int irq;
+        int i;
+        int j;
+        if (!cpu_has_counter || !mips_hpt_frequency)
+                return -ENXIO;
+        if (cpu == 0) {
+                for (i = 0; i < num_possible_cpus(); i++) {
+                        smtc_nextinvpe[i] = 0;
+                        for (j = 0; j < num_possible_cpus(); j++)
+                                smtc_nexttime[i][j] = 0L;
+                }
+                /*
+                 * SMTC also can't have the usablility test
+                 * run by secondary TCs once Compare is in use.
+                 */
+                if (!c0_compare_int_usable())
+                        return -ENXIO;
+        }
+        /*
+         * With vectored interrupts things are getting platform specific.
+         * get_c0_compare_int is a hook to allow a platform to return the
+         * interrupt number of it's liking.
+         */
+        irq = MIPS_CPU_IRQ_BASE + cp0_compare_irq;
+        if (get_c0_compare_int)
+                irq = get_c0_compare_int();
+        cd = &per_cpu(mips_clockevent_device, cpu);
+        cd->name                = "MIPS";
+        cd->features            = CLOCK_EVT_FEAT_ONESHOT;
+        /* Calculate the min / max delta */
+        cd->mult        = div_sc((unsigned long) mips_freq, NSEC_PER_SEC, 32);
+        cd->shift               = 32;
+        cd->max_delta_ns        = clockevent_delta2ns(0x7fffffff, cd);
+        cd->min_delta_ns        = clockevent_delta2ns(0x300, cd);
+        cd->rating              = 300;
+        cd->irq                 = irq;
+        cd->cpumask             = cpumask_of_cpu(cpu);
+        cd->set_next_event      = mips_next_event;
+        cd->set_mode            = mips_set_clock_mode;
+        cd->event_handler       = mips_event_handler;
+        clockevents_register_device(cd);
+        /*
+         * On SMTC we only want to do the data structure
+         * initialization and IRQ setup once.
+         */
+        if (cpu)
+                return 0;
+        /*
+         * And we need the hwmask associated with the c0_compare
+         * vector to be initialized.
+         */
+        irq_hwmask[irq] = (0x100 << cp0_compare_irq);
+        if (cp0_timer_irq_installed)
+                return 0;
+        cp0_timer_irq_installed = 1;
+        setup_irq(irq, &c0_compare_irqaction);
+        return 0;
+}
diff --git a/arch/mips/kernel/cpu-probe.c b/arch/mips/kernel/cpu-probe.c
index 11c92dc53791..e621fda8ab37 100644
--- a/arch/mips/kernel/cpu-probe.c
+++ b/arch/mips/kernel/cpu-probe.c
@@ -54,14 +54,18 @@ extern void r4k_wait(void);
 * interrupt is requested" restriction in the MIPS32/MIPS64 architecture makes
 * using this version a gamble.
 */
-static void r4k_wait_irqoff(void)
+void r4k_wait_irqoff(void)
 {
        local_irq_disable();
        if (!need_resched())
-                __asm__("       .set    mips3           \n"
+                __asm__("       .set    push            \n"
+                        "       .set    mips3           \n"
                        "       wait                    \n"
-                        "       .set    mips0           \n");
+                        "       .set    pop             \n");
        local_irq_enable();
+        __asm__("       .globl __pastwait       \n"
+                "__pastwait:                    \n");
+        return;
 }
 /*
diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S
index e29598ae939d..ffa331029e08 100644
--- a/arch/mips/kernel/entry.S
+++ b/arch/mips/kernel/entry.S
@@ -79,11 +79,6 @@ FEXPORT(syscall_exit)
 FEXPORT(restore_all)                    # restore full frame
 #ifdef CONFIG_MIPS_MT_SMTC
-/* Detect and execute deferred IPI "interrupts" */
-        LONG_L  s0, TI_REGS($28)
-        LONG_S  sp, TI_REGS($28)
-        jal     deferred_smtc_ipi
-        LONG_S  s0, TI_REGS($28)
 #ifdef CONFIG_MIPS_MT_SMTC_IM_BACKSTOP
 /* Re-arm any temporarily masked interrupts not explicitly "acked" */
        mfc0    v0, CP0_TCSTATUS
@@ -112,6 +107,11 @@ FEXPORT(restore_all)			# restore full frame
        xor     t0, t0, t3
        mtc0    t0, CP0_TCCONTEXT
 #endif /* CONFIG_MIPS_MT_SMTC_IM_BACKSTOP */
+/* Detect and execute deferred IPI "interrupts" */
+        LONG_L  s0, TI_REGS($28)
+        LONG_S  sp, TI_REGS($28)
+        jal     deferred_smtc_ipi
+        LONG_S  s0, TI_REGS($28)
 #endif /* CONFIG_MIPS_MT_SMTC */
        .set    noat
        RESTORE_TEMP
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index f886dd7f708e..01dcbe38fa01 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -282,8 +282,8 @@ NESTED(except_vec_vi_handler, 0, sp)
        and     t0, a0, t1
 #ifdef CONFIG_MIPS_MT_SMTC_IM_BACKSTOP
        mfc0    t2, CP0_TCCONTEXT
-        or      t0, t0, t2
+        or      t2, t0, t2
-        mtc0    t0, CP0_TCCONTEXT
+        mtc0    t2, CP0_TCCONTEXT
 #endif /* CONFIG_MIPS_MT_SMTC_IM_BACKSTOP */
        xor     t1, t1, t0
        mtc0    t1, CP0_STATUS
diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c
index df4d3f2f740c..dc9eb72ed9de 100644
--- a/arch/mips/kernel/mips-mt-fpaff.c
+++ b/arch/mips/kernel/mips-mt-fpaff.c
@@ -159,7 +159,7 @@ __setup("fpaff=", fpaff_thresh);
 /*
 * FPU Use Factor empirically derived from experiments on 34K
 */
-#define FPUSEFACTOR 333
+#define FPUSEFACTOR 2000
 static __init int mt_fp_affinity_init(void)
 {
diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c
index ce7684335a41..22fc19bbe87f 100644
--- a/arch/mips/kernel/process.c
+++ b/arch/mips/kernel/process.c
@@ -55,7 +55,7 @@ void __noreturn cpu_idle(void)
        while (1) {
                tick_nohz_stop_sched_tick(1);
                while (!need_resched()) {
-#ifdef CONFIG_SMTC_IDLE_HOOK_DEBUG
+#ifdef CONFIG_MIPS_MT_SMTC
                        extern void smtc_idle_loop_hook(void);
                        smtc_idle_loop_hook();
@@ -145,19 +145,18 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long usp,
         */
        p->thread.cp0_status = read_c0_status() & ~(ST0_CU2|ST0_CU1);
        childregs->cp0_status &= ~(ST0_CU2|ST0_CU1);
+#ifdef CONFIG_MIPS_MT_SMTC
+        /*
+         * SMTC restores TCStatus after Status, and the CU bits
+         * are aliased there.
+         */
+        childregs->cp0_tcstatus &= ~(ST0_CU2|ST0_CU1);
+#endif
        clear_tsk_thread_flag(p, TIF_USEDFPU);
 #ifdef CONFIG_MIPS_MT_FPAFF
        clear_tsk_thread_flag(p, TIF_FPUBOUND);
-        /*
-         * FPU affinity support is cleaner if we track the
-         * user-visible CPU affinity from the very beginning.
-         * The generic cpus_allowed mask will already have
-         * been copied from the parent before copy_thread
-         * is invoked.
-         */
-        p->thread.user_cpus_allowed = p->cpus_allowed;
 #endif /* CONFIG_MIPS_MT_FPAFF */
        if (clone_flags & CLONE_SETTLS)
diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c
index 35234b92b9a5..96ffc9c6d194 100644
--- a/arch/mips/kernel/ptrace.c
+++ b/arch/mips/kernel/ptrace.c
@@ -238,7 +238,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                case FPC_EIR: { /* implementation / version register */
                        unsigned int flags;
 #ifdef CONFIG_MIPS_MT_SMTC
-                        unsigned int irqflags;
+                        unsigned long irqflags;
                        unsigned int mtflags;
 #endif /* CONFIG_MIPS_MT_SMTC */
diff --git a/arch/mips/kernel/smtc.c b/arch/mips/kernel/smtc.c
index a516286532ab..897fb2b4751c 100644
--- a/arch/mips/kernel/smtc.c
+++ b/arch/mips/kernel/smtc.c
@@ -1,4 +1,21 @@
-/* Copyright (C) 2004 Mips Technologies, Inc */
+/*
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version 2
+ * of the License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
+ *
+ * Copyright (C) 2004 Mips Technologies, Inc
+ * Copyright (C) 2008 Kevin D. Kissell
+ */
 #include <linux/clockchips.h>
 #include <linux/kernel.h>
@@ -21,7 +38,6 @@
 #include <asm/time.h>
 #include <asm/addrspace.h>
 #include <asm/smtc.h>
-#include <asm/smtc_ipi.h>
 #include <asm/smtc_proc.h>
 /*
@@ -58,11 +74,6 @@ unsigned long irq_hwmask[NR_IRQS];
 asiduse smtc_live_asid[MAX_SMTC_TLBS][MAX_SMTC_ASIDS];
-/*
- * Clock interrupt "latch" buffers, per "CPU"
- */
-static atomic_t ipi_timer_latch[NR_CPUS];
 /*
 * Number of InterProcessor Interrupt (IPI) message buffers to allocate
@@ -70,7 +81,7 @@ static atomic_t ipi_timer_latch[NR_CPUS];
 #define IPIBUF_PER_CPU 4
-static struct smtc_ipi_q IPIQ[NR_CPUS];
+struct smtc_ipi_q IPIQ[NR_CPUS];
 static struct smtc_ipi_q freeIPIq;
@@ -282,7 +293,7 @@ static void smtc_configure_tlb(void)
 * phys_cpu_present_map and the logical/physical mappings.
 */
-int __init mipsmt_build_cpu_map(int start_cpu_slot)
+int __init smtc_build_cpu_map(int start_cpu_slot)
 {
        int i, ntcs;
@@ -325,7 +336,12 @@ static void smtc_tc_setup(int vpe, int tc, int cpu)
        write_tc_c0_tcstatus((read_tc_c0_tcstatus()
                        & ~(TCSTATUS_TKSU | TCSTATUS_DA | TCSTATUS_IXMT))
                        | TCSTATUS_A);
-        write_tc_c0_tccontext(0);
+        /*
+         * TCContext gets an offset from the base of the IPIQ array
+         * to be used in low-level code to detect the presence of
+         * an active IPI queue
+         */
+        write_tc_c0_tccontext((sizeof(struct smtc_ipi_q) * cpu) << 16);
        /* Bind tc to vpe */
        write_tc_c0_tcbind(vpe);
        /* In general, all TCs should have the same cpu_data indications */
@@ -336,10 +352,18 @@ static void smtc_tc_setup(int vpe, int tc, int cpu)
                cpu_data[cpu].options &= ~MIPS_CPU_FPU;
        cpu_data[cpu].vpe_id = vpe;
        cpu_data[cpu].tc_id = tc;
+        /* Multi-core SMTC hasn't been tested, but be prepared */
+        cpu_data[cpu].core = (read_vpe_c0_ebase() >> 1) & 0xff;
 }
+/*
+ * Tweak to get Count registes in as close a sync as possible.
+ * Value seems good for 34K-class cores.
+ */
+#define CP0_SKEW 8
-void mipsmt_prepare_cpus(void)
+void smtc_prepare_cpus(int cpus)
 {
        int i, vpe, tc, ntc, nvpe, tcpervpe[NR_CPUS], slop, cpu;
        unsigned long flags;
@@ -363,13 +387,13 @@ void mipsmt_prepare_cpus(void)
                IPIQ[i].head = IPIQ[i].tail = NULL;
                spin_lock_init(&IPIQ[i].lock);
                IPIQ[i].depth = 0;
-                atomic_set(&ipi_timer_latch[i], 0);
        }
        /* cpu_data index starts at zero */
        cpu = 0;
        cpu_data[cpu].vpe_id = 0;
        cpu_data[cpu].tc_id = 0;
+        cpu_data[cpu].core = (read_c0_ebase() >> 1) & 0xff;
        cpu++;
        /* Report on boot-time options */
@@ -484,7 +508,8 @@ void mipsmt_prepare_cpus(void)
                        write_vpe_c0_compare(0);
                        /* Propagate Config7 */
                        write_vpe_c0_config7(read_c0_config7());
-                        write_vpe_c0_count(read_c0_count());
+                        write_vpe_c0_count(read_c0_count() + CP0_SKEW);
+                        ehb();
                }
                /* enable multi-threading within VPE */
                write_vpe_c0_vpecontrol(read_vpe_c0_vpecontrol() | VPECONTROL_TE);
@@ -556,7 +581,7 @@ void mipsmt_prepare_cpus(void)
 void __cpuinit smtc_boot_secondary(int cpu, struct task_struct *idle)
 {
        extern u32 kernelsp[NR_CPUS];
-        long flags;
+        unsigned long flags;
        int mtflags;
        LOCK_MT_PRA();
@@ -585,24 +610,22 @@ void __cpuinit smtc_boot_secondary(int cpu, struct task_struct *idle)
 void smtc_init_secondary(void)
 {
-        /*
-         * Start timer on secondary VPEs if necessary.
-         * plat_timer_setup has already have been invoked by init/main
-         * on "boot" TC.  Like per_cpu_trap_init() hack, this assumes that
-         * SMTC init code assigns TCs consdecutively and in ascending order
-         * to across available VPEs.
-         */
-        if (((read_c0_tcbind() & TCBIND_CURTC) != 0) &&
-            ((read_c0_tcbind() & TCBIND_CURVPE)
-            != cpu_data[smp_processor_id() - 1].vpe_id)){
-                write_c0_compare(read_c0_count() + mips_hpt_frequency/HZ);
-        }
        local_irq_enable();
 }
 void smtc_smp_finish(void)
 {
+        int cpu = smp_processor_id();
+        /*
+         * Lowest-numbered CPU per VPE starts a clock tick.
+         * Like per_cpu_trap_init() hack, this assumes that
+         * SMTC init code assigns TCs consdecutively and
+         * in ascending order across available VPEs.
+         */
+        if (cpu > 0 && (cpu_data[cpu].vpe_id != cpu_data[cpu - 1].vpe_id))
+                write_c0_compare(read_c0_count() + mips_hpt_frequency/HZ);
        printk("TC %d going on-line as CPU %d\n",
                cpu_data[smp_processor_id()].tc_id, smp_processor_id());
 }
@@ -753,8 +776,10 @@ void smtc_send_ipi(int cpu, int type, unsigned int action)
 {
        int tcstatus;
        struct smtc_ipi *pipi;
-        long flags;
+        unsigned long flags;
        int mtflags;
+        unsigned long tcrestart;
+        extern void r4k_wait_irqoff(void), __pastwait(void);
        if (cpu == smp_processor_id()) {
                printk("Cannot Send IPI to self!\n");
@@ -771,8 +796,6 @@ void smtc_send_ipi(int cpu, int type, unsigned int action)
        pipi->arg = (void *)action;
        pipi->dest = cpu;
        if (cpu_data[cpu].vpe_id != cpu_data[smp_processor_id()].vpe_id) {
-                if (type == SMTC_CLOCK_TICK)
-                        atomic_inc(&ipi_timer_latch[cpu]);
                /* If not on same VPE, enqueue and send cross-VPE interrupt */
                smtc_ipi_nq(&IPIQ[cpu], pipi);
                LOCK_CORE_PRA();
@@ -800,22 +823,29 @@ void smtc_send_ipi(int cpu, int type, unsigned int action)
                if ((tcstatus & TCSTATUS_IXMT) != 0) {
                        /*
-                         * Spin-waiting here can deadlock,
+                         * If we're in the the irq-off version of the wait
-                         * so we queue the message for the target TC.
+                         * loop, we need to force exit from the wait and
+                         * do a direct post of the IPI.
+                         */
+                        if (cpu_wait == r4k_wait_irqoff) {
+                                tcrestart = read_tc_c0_tcrestart();
+                                if (tcrestart >= (unsigned long)r4k_wait_irqoff
+                                    && tcrestart < (unsigned long)__pastwait) {
+                                        write_tc_c0_tcrestart(__pastwait);
+                                        tcstatus &= ~TCSTATUS_IXMT;
+                                        write_tc_c0_tcstatus(tcstatus);
+                                        goto postdirect;
+                                }
+                        }
+                        /*
+                         * Otherwise we queue the message for the target TC
+                         * to pick up when he does a local_irq_restore()
                         */
                        write_tc_c0_tchalt(0);
                        UNLOCK_CORE_PRA();
-                        /* Try to reduce redundant timer interrupt messages */
-                        if (type == SMTC_CLOCK_TICK) {
-                            if (atomic_postincrement(&ipi_timer_latch[cpu])!=0){
-                                smtc_ipi_nq(&freeIPIq, pipi);
-                                return;
-                            }
-                        }
                        smtc_ipi_nq(&IPIQ[cpu], pipi);
                } else {
-                        if (type == SMTC_CLOCK_TICK)
+postdirect:
-                                atomic_inc(&ipi_timer_latch[cpu]);
                        post_direct_ipi(cpu, pipi);
                        write_tc_c0_tchalt(0);
                        UNLOCK_CORE_PRA();
@@ -883,7 +913,7 @@ static void ipi_call_interrupt(void)
        smp_call_function_interrupt();
 }
-DECLARE_PER_CPU(struct clock_event_device, smtc_dummy_clockevent_device);
+DECLARE_PER_CPU(struct clock_event_device, mips_clockevent_device);
 void ipi_decode(struct smtc_ipi *pipi)
 {
@@ -891,20 +921,13 @@ void ipi_decode(struct smtc_ipi *pipi)
        struct clock_event_device *cd;
        void *arg_copy = pipi->arg;
        int type_copy = pipi->type;
-        int ticks;
        smtc_ipi_nq(&freeIPIq, pipi);
        switch (type_copy) {
        case SMTC_CLOCK_TICK:
                irq_enter();
                kstat_this_cpu.irqs[MIPS_CPU_IRQ_BASE + 1]++;
-                cd = &per_cpu(smtc_dummy_clockevent_device, cpu);
+                cd = &per_cpu(mips_clockevent_device, cpu);
-                ticks = atomic_read(&ipi_timer_latch[cpu]);
+                cd->event_handler(cd);
-                atomic_sub(ticks, &ipi_timer_latch[cpu]);
-                while (ticks) {
-                        cd->event_handler(cd);
-                        ticks--;
-                }
                irq_exit();
                break;
@@ -937,24 +960,48 @@ void ipi_decode(struct smtc_ipi *pipi)
        }
 }
+/*
+ * Similar to smtc_ipi_replay(), but invoked from context restore,
+ * so it reuses the current exception frame rather than set up a
+ * new one with self_ipi.
+ */
 void deferred_smtc_ipi(void)
 {
-        struct smtc_ipi *pipi;
+        int cpu = smp_processor_id();
-        unsigned long flags;
-/* DEBUG */
-        int q = smp_processor_id();
        /*
         * Test is not atomic, but much faster than a dequeue,
         * and the vast majority of invocations will have a null queue.
+         * If irq_disabled when this was called, then any IPIs queued
+         * after we test last will be taken on the next irq_enable/restore.
+         * If interrupts were enabled, then any IPIs added after the
+         * last test will be taken directly.
         */
-        if (IPIQ[q].head != NULL) {
-                while((pipi = smtc_ipi_dq(&IPIQ[q])) != NULL) {
+        while (IPIQ[cpu].head != NULL) {
-                        /* ipi_decode() should be called with interrupts off */
+                struct smtc_ipi_q *q = &IPIQ[cpu];
-                        local_irq_save(flags);
+                struct smtc_ipi *pipi;
+                unsigned long flags;
+                /*
+                 * It may be possible we'll come in with interrupts
+                 * already enabled.
+                 */
+                local_irq_save(flags);
+                spin_lock(&q->lock);
+                pipi = __smtc_ipi_dq(q);
+                spin_unlock(&q->lock);
+                if (pipi != NULL)
                        ipi_decode(pipi);
-                        local_irq_restore(flags);
+                /*
-                }
+                 * The use of the __raw_local restore isn't
+                 * as obviously necessary here as in smtc_ipi_replay(),
+                 * but it's more efficient, given that we're already
+                 * running down the IPI queue.
+                 */
+                __raw_local_irq_restore(flags);
        }
 }
@@ -975,7 +1022,7 @@ static irqreturn_t ipi_interrupt(int irq, void *dev_idm)
        struct smtc_ipi *pipi;
        unsigned long tcstatus;
        int sent;
-        long flags;
+        unsigned long flags;
        unsigned int mtflags;
        unsigned int vpflags;
@@ -1066,55 +1113,53 @@ static void setup_cross_vpe_interrupts(unsigned int nvpe)
 /*
 * SMTC-specific hacks invoked from elsewhere in the kernel.
- *
- * smtc_ipi_replay is called from raw_local_irq_restore which is only ever
- * called with interrupts disabled.  We do rely on interrupts being disabled
- * here because using spin_lock_irqsave()/spin_unlock_irqrestore() would
- * result in a recursive call to raw_local_irq_restore().
 */
-static void __smtc_ipi_replay(void)
+ /*
+  * smtc_ipi_replay is called from raw_local_irq_restore
+  */
+void smtc_ipi_replay(void)
 {
        unsigned int cpu = smp_processor_id();
        /*
         * To the extent that we've ever turned interrupts off,
         * we may have accumulated deferred IPIs.  This is subtle.
-         * If we use the smtc_ipi_qdepth() macro, we'll get an
-         * exact number - but we'll also disable interrupts
-         * and create a window of failure where a new IPI gets
-         * queued after we test the depth but before we re-enable
-         * interrupts. So long as IXMT never gets set, however,
         * we should be OK:  If we pick up something and dispatch
         * it here, that's great. If we see nothing, but concurrent
         * with this operation, another TC sends us an IPI, IXMT
         * is clear, and we'll handle it as a real pseudo-interrupt
-         * and not a pseudo-pseudo interrupt.
+         * and not a pseudo-pseudo interrupt.  The important thing
+         * is to do the last check for queued message *after* the
+         * re-enabling of interrupts.
         */
-        if (IPIQ[cpu].depth > 0) {
+        while (IPIQ[cpu].head != NULL) {
-                while (1) {
+                struct smtc_ipi_q *q = &IPIQ[cpu];
-                        struct smtc_ipi_q *q = &IPIQ[cpu];
+                struct smtc_ipi *pipi;
-                        struct smtc_ipi *pipi;
+                unsigned long flags;
-                        extern void self_ipi(struct smtc_ipi *);
+                /*
-                        spin_lock(&q->lock);
+                 * It's just possible we'll come in with interrupts
-                        pipi = __smtc_ipi_dq(q);
+                 * already enabled.
-                        spin_unlock(&q->lock);
+                 */
-                        if (!pipi)
+                local_irq_save(flags);
-                                break;
+                spin_lock(&q->lock);
+                pipi = __smtc_ipi_dq(q);
+                spin_unlock(&q->lock);
+                /*
+                 ** But use a raw restore here to avoid recursion.
+                 */
+                __raw_local_irq_restore(flags);
+                if (pipi) {
                        self_ipi(pipi);
                        smtc_cpu_stats[cpu].selfipis++;
                }
        }
 }
-void smtc_ipi_replay(void)
-{
-        raw_local_irq_disable();
-        __smtc_ipi_replay();
-}
 EXPORT_SYMBOL(smtc_ipi_replay);
 void smtc_idle_loop_hook(void)
@@ -1193,40 +1238,13 @@ void smtc_idle_loop_hook(void)
                }
        }
-        /*
-         * Now that we limit outstanding timer IPIs, check for hung TC
-         */
-        for (tc = 0; tc < NR_CPUS; tc++) {
-                /* Don't check ourself - we'll dequeue IPIs just below */
-                if ((tc != smp_processor_id()) &&
-                    atomic_read(&ipi_timer_latch[tc]) > timerq_limit) {
-                    if (clock_hang_reported[tc] == 0) {
-                        pdb_msg += sprintf(pdb_msg,
-                                "TC %d looks hung with timer latch at %d\n",
-                                tc, atomic_read(&ipi_timer_latch[tc]));
-                        clock_hang_reported[tc]++;
-                        }
-                }
-        }
        emt(mtflags);
        local_irq_restore(flags);
        if (pdb_msg != &id_ho_db_msg[0])
                printk("CPU%d: %s", smp_processor_id(), id_ho_db_msg);
 #endif /* CONFIG_SMTC_IDLE_HOOK_DEBUG */
-        /*
+        smtc_ipi_replay();
-         * Replay any accumulated deferred IPIs. If "Instant Replay"
-         * is in use, there should never be any.
-         */
-#ifndef CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY
-        {
-                unsigned long flags;
-                local_irq_save(flags);
-                __smtc_ipi_replay();
-                local_irq_restore(flags);
-        }
-#endif /* CONFIG_MIPS_MT_SMTC_INSTANT_REPLAY */
 }
 void smtc_soft_dump(void)
@@ -1242,10 +1260,6 @@ void smtc_soft_dump(void)
                printk("%d: %ld\n", i, smtc_cpu_stats[i].selfipis);
        }
        smtc_ipi_qdump();
-        printk("Timer IPI Backlogs:\n");
-        for (i=0; i < NR_CPUS; i++) {
-                printk("%d: %d\n", i, atomic_read(&ipi_timer_latch[i]));
-        }
        printk("%d Recoveries of \"stolen\" FPU\n",
               atomic_read(&smtc_fpu_recoveries));
 }
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index 5fd0cd020af5..b602ac6eb47d 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -825,8 +825,10 @@ static void mt_ase_fp_affinity(void)
                if (cpus_intersects(current->cpus_allowed, mt_fpu_cpumask)) {
                        cpumask_t tmask;
-                        cpus_and(tmask, current->thread.user_cpus_allowed,
+                        current->thread.user_cpus_allowed
-                                 mt_fpu_cpumask);
+                                = current->cpus_allowed;
+                        cpus_and(tmask, current->cpus_allowed,
+                                mt_fpu_cpumask);
                        set_cpus_allowed(current, tmask);
                        set_thread_flag(TIF_FPUBOUND);
                }
diff --git a/arch/mips/mti-malta/Makefile b/arch/mips/mti-malta/Makefile
index 3b7dd722c32a..cef2db8d2225 100644
--- a/arch/mips/mti-malta/Makefile
+++ b/arch/mips/mti-malta/Makefile
@@ -15,6 +15,6 @@ obj-$(CONFIG_EARLY_PRINTK)	+= malta-console.o
 obj-$(CONFIG_PCI)               += malta-pci.o
 # FIXME FIXME FIXME
-obj-$(CONFIG_MIPS_MT_SMTC)      += malta_smtc.o
+obj-$(CONFIG_MIPS_MT_SMTC)      += malta-smtc.o
 EXTRA_CFLAGS += -Werror
diff --git a/arch/mips/mti-malta/malta-smtc.c b/arch/mips/mti-malta/malta-smtc.c
index 5ea705e49454..f84a46a8ae6e 100644
--- a/arch/mips/mti-malta/malta-smtc.c
+++ b/arch/mips/mti-malta/malta-smtc.c
@@ -84,12 +84,17 @@ static void msmtc_cpus_done(void)
 static void __init msmtc_smp_setup(void)
 {
-        mipsmt_build_cpu_map(0);
+        /*
+         * we won't get the definitive value until
+         * we've run smtc_prepare_cpus later, but
+         * we would appear to need an upper bound now.
+         */
+        smp_num_siblings = smtc_build_cpu_map(0);
 }
 static void __init msmtc_prepare_cpus(unsigned int max_cpus)
 {
-        mipsmt_prepare_cpus();
+        smtc_prepare_cpus(max_cpus);
 }
 struct plat_smp_ops msmtc_smp_ops = {
diff --git a/arch/mn10300/kernel/irq.c b/arch/mn10300/kernel/irq.c
index 761c434a2488..56c64ccc9c21 100644
--- a/arch/mn10300/kernel/irq.c
+++ b/arch/mn10300/kernel/irq.c
@@ -20,22 +20,8 @@ EXPORT_SYMBOL(__mn10300_irq_enabled_epsw);
 atomic_t irq_err_count;
 /*
- * MN10300 INTC controller operations
+ * MN10300 interrupt controller operations
 */
-static void mn10300_cpupic_disable(unsigned int irq)
-{
-        u16 tmp = GxICR(irq);
-        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_DETECT;
-        tmp = GxICR(irq);
-}
-static void mn10300_cpupic_enable(unsigned int irq)
-{
-        u16 tmp = GxICR(irq);
-        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE;
-        tmp = GxICR(irq);
-}
 static void mn10300_cpupic_ack(unsigned int irq)
 {
        u16 tmp;
@@ -60,26 +46,54 @@ static void mn10300_cpupic_mask_ack(unsigned int irq)
 static void mn10300_cpupic_unmask(unsigned int irq)
 {
        u16 tmp = GxICR(irq);
-        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE | GxICR_DETECT;
+        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE;
        tmp = GxICR(irq);
 }
-static void mn10300_cpupic_end(unsigned int irq)
+static void mn10300_cpupic_unmask_clear(unsigned int irq)
 {
+        /* the MN10300 PIC latches its interrupt request bit, even after the
+         * device has ceased to assert its interrupt line and the interrupt
+         * channel has been disabled in the PIC, so for level-triggered
+         * interrupts we need to clear the request bit when we re-enable */
        u16 tmp = GxICR(irq);
-        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE;
+        GxICR(irq) = (tmp & GxICR_LEVEL) | GxICR_ENABLE | GxICR_DETECT;
        tmp = GxICR(irq);
 }
-static struct irq_chip mn10300_cpu_pic = {
+/*
-        .name           = "cpu",
+ * MN10300 PIC level-triggered IRQ handling.
-        .disable        = mn10300_cpupic_disable,
+ *
-        .enable         = mn10300_cpupic_enable,
+ * The PIC has no 'ACK' function per se.  It is possible to clear individual
+ * channel latches, but each latch relatches whether or not the channel is
+ * masked, so we need to clear the latch when we unmask the channel.
+ *
+ * Also for this reason, we don't supply an ack() op (it's unused anyway if
+ * mask_ack() is provided), and mask_ack() just masks.
+ */
+static struct irq_chip mn10300_cpu_pic_level = {
+        .name           = "cpu_l",
+        .disable        = mn10300_cpupic_mask,
+        .enable         = mn10300_cpupic_unmask_clear,
+        .ack            = NULL,
+        .mask           = mn10300_cpupic_mask,
+        .mask_ack       = mn10300_cpupic_mask,
+        .unmask         = mn10300_cpupic_unmask_clear,
+};
+/*
+ * MN10300 PIC edge-triggered IRQ handling.
+ *
+ * We use the latch clearing function of the PIC as the 'ACK' function.
+ */
+static struct irq_chip mn10300_cpu_pic_edge = {
+        .name           = "cpu_e",
+        .disable        = mn10300_cpupic_mask,
+        .enable         = mn10300_cpupic_unmask,
        .ack            = mn10300_cpupic_ack,
        .mask           = mn10300_cpupic_mask,
        .mask_ack       = mn10300_cpupic_mask_ack,
        .unmask         = mn10300_cpupic_unmask,
-        .end            = mn10300_cpupic_end,
 };
 /*
@@ -114,7 +128,8 @@ void set_intr_level(int irq, u16 level)
 */
 void set_intr_postackable(int irq)
 {
-        set_irq_handler(irq, handle_level_irq);
+        set_irq_chip_and_handler(irq, &mn10300_cpu_pic_level,
+                                 handle_level_irq);
 }
 /*
@@ -126,8 +141,12 @@ void __init init_IRQ(void)
        for (irq = 0; irq < NR_IRQS; irq++)
                if (irq_desc[irq].chip == &no_irq_type)
-                        set_irq_chip_and_handler(irq, &mn10300_cpu_pic,
+                        /* due to the PIC latching interrupt requests, even
-                                                 handle_edge_irq);
+                         * when the IRQ is disabled, IRQ_PENDING is superfluous
+                         * and we can use handle_level_irq() for edge-triggered
+                         * interrupts */
+                        set_irq_chip_and_handler(irq, &mn10300_cpu_pic_edge,
+                                                 handle_level_irq);
        unit_init_IRQ();
 }
diff --git a/arch/mn10300/unit-asb2303/unit-init.c b/arch/mn10300/unit-asb2303/unit-init.c
index 14b2c817cff8..70e8cb4ea266 100644
--- a/arch/mn10300/unit-asb2303/unit-init.c
+++ b/arch/mn10300/unit-asb2303/unit-init.c
@@ -51,7 +51,7 @@ void __init unit_init_IRQ(void)
                switch (GET_XIRQ_TRIGGER(extnum)) {
                case XIRQ_TRIGGER_HILEVEL:
                case XIRQ_TRIGGER_LOWLEVEL:
-                        set_irq_handler(XIRQ2IRQ(extnum), handle_level_irq);
+                        set_intr_postackable(XIRQ2IRQ(extnum));
                        break;
                default:
                        break;
diff --git a/arch/mn10300/unit-asb2305/unit-init.c b/arch/mn10300/unit-asb2305/unit-init.c
index 6a352414a358..72812a9439ac 100644
--- a/arch/mn10300/unit-asb2305/unit-init.c
+++ b/arch/mn10300/unit-asb2305/unit-init.c
@@ -52,7 +52,7 @@ void __init unit_init_IRQ(void)
                switch (GET_XIRQ_TRIGGER(extnum)) {
                case XIRQ_TRIGGER_HILEVEL:
                case XIRQ_TRIGGER_LOWLEVEL:
-                        set_irq_handler(XIRQ2IRQ(extnum), handle_level_irq);
+                        set_intr_postackable(XIRQ2IRQ(extnum));
                        break;
                default:
                        break;
diff --git a/arch/powerpc/boot/dts/holly.dts b/arch/powerpc/boot/dts/holly.dts
index f87fe7b9ced9..c6e11ebecebb 100644
--- a/arch/powerpc/boot/dts/holly.dts
+++ b/arch/powerpc/boot/dts/holly.dts
@@ -133,61 +133,61 @@
                        reg = <0x00007400 0x00000400>;
                        big-endian;
                };
+        };
-                pci@1000 {
+        pci@c0001000 {
-                        device_type = "pci";
+                device_type = "pci";
-                        compatible = "tsi109-pci", "tsi108-pci";
+                compatible = "tsi109-pci", "tsi108-pci";
-                        #interrupt-cells = <1>;
+                #interrupt-cells = <1>;
-                        #size-cells = <2>;
+                #size-cells = <2>;
-                        #address-cells = <3>;
+                #address-cells = <3>;
-                        reg = <0x00001000 0x00001000>;
+                reg = <0xc0001000 0x00001000>;
-                        bus-range = <0x0 0x0>;
+                bus-range = <0x0 0x0>;
-                        /*----------------------------------------------------+
+                /*----------------------------------------------------+
-                        | PCI memory range.
+                | PCI memory range.
-                        | 01 denotes I/O space
+                | 01 denotes I/O space
-                        | 02 denotes 32-bit memory space
+                | 02 denotes 32-bit memory space
-                        +----------------------------------------------------*/
+                +----------------------------------------------------*/
-                        ranges = <0x02000000 0x00000000 0x40000000 0x40000000 0x00000000 0x10000000
+                ranges = <0x02000000 0x00000000 0x40000000 0x40000000 0x00000000 0x10000000
-                                  0x01000000 0x00000000 0x00000000 0x7e000000 0x00000000 0x00010000>;
+                          0x01000000 0x00000000 0x00000000 0x7e000000 0x00000000 0x00010000>;
-                        clock-frequency = <133333332>;
+                clock-frequency = <133333332>;
-                        interrupt-parent = <&MPIC>;
+                interrupt-parent = <&MPIC>;
+                interrupts = <0x17 0x2>;
+                interrupt-map-mask = <0xf800 0x0 0x0 0x7>;
+                /*----------------------------------------------------+
+                | The INTA, INTB, INTC, INTD are shared.
+                +----------------------------------------------------*/
+                interrupt-map = <
+                        0x800 0x0 0x0 0x1 &RT0 0x24 0x0
+                        0x800 0x0 0x0 0x2 &RT0 0x25 0x0
+                        0x800 0x0 0x0 0x3 &RT0 0x26 0x0
+                        0x800 0x0 0x0 0x4 &RT0 0x27 0x0
+                        0x1000 0x0 0x0 0x1 &RT0 0x25 0x0
+                        0x1000 0x0 0x0 0x2 &RT0 0x26 0x0
+                        0x1000 0x0 0x0 0x3 &RT0 0x27 0x0
+                        0x1000 0x0 0x0 0x4 &RT0 0x24 0x0
+                        0x1800 0x0 0x0 0x1 &RT0 0x26 0x0
+                        0x1800 0x0 0x0 0x2 &RT0 0x27 0x0
+                        0x1800 0x0 0x0 0x3 &RT0 0x24 0x0
+                        0x1800 0x0 0x0 0x4 &RT0 0x25 0x0
+                        0x2000 0x0 0x0 0x1 &RT0 0x27 0x0
+                        0x2000 0x0 0x0 0x2 &RT0 0x24 0x0
+                        0x2000 0x0 0x0 0x3 &RT0 0x25 0x0
+                        0x2000 0x0 0x0 0x4 &RT0 0x26 0x0
+                        >;
+                RT0: router@1180 {
+                        device_type = "pic-router";
+                        interrupt-controller;
+                        big-endian;
+                        clock-frequency = <0>;
+                        #address-cells = <0>;
+                        #interrupt-cells = <2>;
                        interrupts = <0x17 0x2>;
-                        interrupt-map-mask = <0xf800 0x0 0x0 0x7>;
+                        interrupt-parent = <&MPIC>;
-                        /*----------------------------------------------------+
-                        | The INTA, INTB, INTC, INTD are shared.
-                        +----------------------------------------------------*/
-                        interrupt-map = <
-                                0x800 0x0 0x0 0x1 &RT0 0x24 0x0
-                                0x800 0x0 0x0 0x2 &RT0 0x25 0x0
-                                0x800 0x0 0x0 0x3 &RT0 0x26 0x0
-                                0x800 0x0 0x0 0x4 &RT0 0x27 0x0
-                                0x1000 0x0 0x0 0x1 &RT0 0x25 0x0
-                                0x1000 0x0 0x0 0x2 &RT0 0x26 0x0
-                                0x1000 0x0 0x0 0x3 &RT0 0x27 0x0
-                                0x1000 0x0 0x0 0x4 &RT0 0x24 0x0
-                                0x1800 0x0 0x0 0x1 &RT0 0x26 0x0
-                                0x1800 0x0 0x0 0x2 &RT0 0x27 0x0
-                                0x1800 0x0 0x0 0x3 &RT0 0x24 0x0
-                                0x1800 0x0 0x0 0x4 &RT0 0x25 0x0
-                                0x2000 0x0 0x0 0x1 &RT0 0x27 0x0
-                                0x2000 0x0 0x0 0x2 &RT0 0x24 0x0
-                                0x2000 0x0 0x0 0x3 &RT0 0x25 0x0
-                                0x2000 0x0 0x0 0x4 &RT0 0x26 0x0
-                                >;
-                        RT0: router@1180 {
-                                device_type = "pic-router";
-                                interrupt-controller;
-                                big-endian;
-                                clock-frequency = <0>;
-                                #address-cells = <0>;
-                                #interrupt-cells = <2>;
-                                interrupts = <0x17 0x2>;
-                                interrupt-parent = <&MPIC>;
-                        };
                };
        };
diff --git a/arch/powerpc/kernel/idle.c b/arch/powerpc/kernel/idle.c
index d308a9f70f1b..31982d05d81a 100644
--- a/arch/powerpc/kernel/idle.c
+++ b/arch/powerpc/kernel/idle.c
@@ -34,11 +34,7 @@
 #include <asm/smp.h>
 #ifdef CONFIG_HOTPLUG_CPU
-/* this is used for software suspend, and that shuts down
+#define cpu_should_die()        cpu_is_offline(smp_processor_id())
- * CPUs even while the system is still booting... */
-#define cpu_should_die()        (cpu_is_offline(smp_processor_id()) && \
-                                   (system_state == SYSTEM_RUNNING     \
-                                 || system_state == SYSTEM_BOOTING))
 #else
 #define cpu_should_die()        0
 #endif
diff --git a/arch/powerpc/platforms/fsl_uli1575.c b/arch/powerpc/platforms/fsl_uli1575.c
index ef74a0763ec1..8c619963becc 100644
--- a/arch/powerpc/platforms/fsl_uli1575.c
+++ b/arch/powerpc/platforms/fsl_uli1575.c
@@ -219,11 +219,21 @@ static void __devinit quirk_final_uli5249(struct pci_dev *dev)
        int i;
        u8 *dummy;
        struct pci_bus *bus = dev->bus;
+        resource_size_t end = 0;
+        for (i = PCI_BRIDGE_RESOURCES; i < PCI_BRIDGE_RESOURCES+3; i++) {
+                unsigned long flags = pci_resource_flags(dev, i);
+                if ((flags & (IORESOURCE_MEM|IORESOURCE_PREFETCH)) == IORESOURCE_MEM)
+                        end = pci_resource_end(dev, i);
+        }
        for (i = 0; i < PCI_BUS_NUM_RESOURCES; i++) {
                if ((bus->resource[i]) &&
                        (bus->resource[i]->flags & IORESOURCE_MEM)) {
-                        dummy = ioremap(bus->resource[i]->end - 3, 0x4);
+                        if (bus->resource[i]->end == end)
+                                dummy = ioremap(bus->resource[i]->start, 0x4);
+                        else
+                                dummy = ioremap(bus->resource[i]->end - 3, 0x4);
                        if (dummy) {
                                in_8(dummy);
                                iounmap(dummy);
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index ca114fe46ffb..06acb1a18bbc 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -169,6 +169,8 @@ void init_cpu_timer(void)
 static void clock_comparator_interrupt(__u16 code)
 {
+        if (S390_lowcore.clock_comparator == -1ULL)
+                set_clock_comparator(S390_lowcore.clock_comparator);
 }
 static void etr_timing_alert(struct etr_irq_parm *);
diff --git a/arch/s390/lib/delay.c b/arch/s390/lib/delay.c
index fc6ab6094df8..0953cee05efc 100644
--- a/arch/s390/lib/delay.c
+++ b/arch/s390/lib/delay.c
@@ -1,14 +1,9 @@
 /*
- *  arch/s390/lib/delay.c
 *    Precise Delay Loops for S390
 *
- *  S390 version
+ *    Copyright IBM Corp. 1999,2008
- *    Copyright (C) 1999 IBM Deutschland Entwicklung GmbH, IBM Corporation
+ *    Author(s): Martin Schwidefsky <schwidefsky@de.ibm.com>,
- *    Author(s): Martin Schwidefsky (schwidefsky@de.ibm.com),
+ *               Heiko Carstens <heiko.carstens@de.ibm.com>,
- *
- *  Derived from "arch/i386/lib/delay.c"
- *    Copyright (C) 1993 Linus Torvalds
- *    Copyright (C) 1997 Martin Mares <mj@atrey.karlin.mff.cuni.cz>
 */
 #include <linux/sched.h>
@@ -29,30 +24,31 @@ void __delay(unsigned long loops)
        asm volatile("0: brct %0,0b" : : "d" ((loops/2) + 1));
 }
-/*
+static void __udelay_disabled(unsigned long usecs)
- * Waits for 'usecs' microseconds using the TOD clock comparator.
- */
-void __udelay(unsigned long usecs)
 {
-        u64 end, time, old_cc = 0;
+        unsigned long mask, cr0, cr0_saved;
-        unsigned long flags, cr0, mask, dummy;
+        u64 clock_saved;
-        int irq_context;
-        irq_context = in_interrupt();
+        clock_saved = local_tick_disable();
-        if (!irq_context)
+        set_clock_comparator(get_clock() + ((u64) usecs << 12));
-                local_bh_disable();
+        __ctl_store(cr0_saved, 0, 0);
-        local_irq_save(flags);
+        cr0 = (cr0_saved & 0xffff00e0) | 0x00000800;
-        if (raw_irqs_disabled_flags(flags)) {
+        __ctl_load(cr0 , 0, 0);
-                old_cc = local_tick_disable();
+        mask = psw_kernel_bits | PSW_MASK_WAIT | PSW_MASK_EXT;
-                S390_lowcore.clock_comparator = -1ULL;
+        trace_hardirqs_on();
-                __ctl_store(cr0, 0, 0);
+        __load_psw_mask(mask);
-                dummy = (cr0 & 0xffff00e0) | 0x00000800;
+        local_irq_disable();
-                __ctl_load(dummy , 0, 0);
+        __ctl_load(cr0_saved, 0, 0);
-                mask = psw_kernel_bits | PSW_MASK_WAIT | PSW_MASK_EXT;
+        local_tick_enable(clock_saved);
-        } else
+        set_clock_comparator(S390_lowcore.clock_comparator);
-                mask = psw_kernel_bits | PSW_MASK_WAIT |
+}
-                        PSW_MASK_EXT | PSW_MASK_IO;
+static void __udelay_enabled(unsigned long usecs)
+{
+        unsigned long mask;
+        u64 end, time;
+        mask = psw_kernel_bits | PSW_MASK_WAIT | PSW_MASK_EXT | PSW_MASK_IO;
        end = get_clock() + ((u64) usecs << 12);
        do {
                time = end < S390_lowcore.clock_comparator ?
@@ -62,13 +58,37 @@ void __udelay(unsigned long usecs)
                __load_psw_mask(mask);
                local_irq_disable();
        } while (get_clock() < end);
+        set_clock_comparator(S390_lowcore.clock_comparator);
+}
-        if (raw_irqs_disabled_flags(flags)) {
+/*
-                __ctl_load(cr0, 0, 0);
+ * Waits for 'usecs' microseconds using the TOD clock comparator.
-                local_tick_enable(old_cc);
+ */
+void __udelay(unsigned long usecs)
+{
+        unsigned long flags;
+        preempt_disable();
+        local_irq_save(flags);
+        if (in_irq()) {
+                __udelay_disabled(usecs);
+                goto out;
+        }
+        if (in_softirq()) {
+                if (raw_irqs_disabled_flags(flags))
+                        __udelay_disabled(usecs);
+                else
+                        __udelay_enabled(usecs);
+                goto out;
        }
-        if (!irq_context)
+        if (raw_irqs_disabled_flags(flags)) {
+                local_bh_disable();
+                __udelay_disabled(usecs);
                _local_bh_enable();
-        set_clock_comparator(S390_lowcore.clock_comparator);
+                goto out;
+        }
+        __udelay_enabled(usecs);
+out:
        local_irq_restore(flags);
+        preempt_enable();
 }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index ed92864d1325..97f0d2b6dc0c 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -29,6 +29,7 @@ config X86
        select HAVE_FTRACE
        select HAVE_KVM if ((X86_32 && !X86_VOYAGER && !X86_VISWS && !X86_NUMAQ) || X86_64)
        select HAVE_ARCH_KGDB if !X86_VOYAGER
+        select HAVE_ARCH_TRACEHOOK
        select HAVE_GENERIC_DMA_COHERENT if X86_32
        select HAVE_EFFICIENT_UNALIGNED_ACCESS
@@ -1020,7 +1021,7 @@ config HAVE_ARCH_ALLOC_REMAP
 config ARCH_FLATMEM_ENABLE
        def_bool y
-        depends on X86_32 && ARCH_SELECT_MEMORY_MODEL && X86_PC && !NUMA
+        depends on X86_32 && ARCH_SELECT_MEMORY_MODEL && !NUMA
 config ARCH_DISCONTIGMEM_ENABLE
        def_bool y
@@ -1036,7 +1037,7 @@ config ARCH_SPARSEMEM_DEFAULT
 config ARCH_SPARSEMEM_ENABLE
        def_bool y
-        depends on X86_64 || NUMA || (EXPERIMENTAL && X86_PC)
+        depends on X86_64 || NUMA || (EXPERIMENTAL && X86_PC) || X86_GENERICARCH
        select SPARSEMEM_STATIC if X86_32
        select SPARSEMEM_VMEMMAP_ENABLE if X86_64
@@ -1117,10 +1118,10 @@ config MTRR
          You can safely say Y even if your machine doesn't have MTRRs, you'll
          just add about 9 KB to your kernel.
-          See <file:Documentation/mtrr.txt> for more information.
+          See <file:Documentation/x86/mtrr.txt> for more information.
 config MTRR_SANITIZER
-        bool
+        def_bool y
        prompt "MTRR cleanup support"
        depends on MTRR
        help
@@ -1131,7 +1132,7 @@ config MTRR_SANITIZER
          The largest mtrr entry size for a continous block can be set with
          mtrr_chunk_size.
-          If unsure, say N.
+          If unsure, say Y.
 config MTRR_SANITIZER_ENABLE_DEFAULT
        int "MTRR cleanup enable value (0-1)"
@@ -1191,7 +1192,6 @@ config IRQBALANCE
 config SECCOMP
        def_bool y
        prompt "Enable seccomp to safely compute untrusted bytecode"
-        depends on PROC_FS
        help
          This kernel feature is useful for number crunching applications
          that may need to compute untrusted bytecode during their
@@ -1199,7 +1199,7 @@ config SECCOMP
          the process as file descriptors supporting the read/write
          syscalls, it's possible to isolate those applications in
          their own address space using seccomp. Once seccomp is
-          enabled via /proc/<pid>/seccomp, it cannot be disabled
+          enabled via prctl(PR_SET_SECCOMP), it cannot be disabled
          and the task is only allowed to execute a few safe syscalls
          defined by each seccomp mode.
@@ -1356,14 +1356,14 @@ config PHYSICAL_ALIGN
          Don't change this unless you know what you are doing.
 config HOTPLUG_CPU
-        bool "Support for suspend on SMP and hot-pluggable CPUs (EXPERIMENTAL)"
+        bool "Support for hot-pluggable CPUs"
-        depends on SMP && HOTPLUG && EXPERIMENTAL && !X86_VOYAGER
+        depends on SMP && HOTPLUG && !X86_VOYAGER
        ---help---
-          Say Y here to experiment with turning CPUs off and on, and to
+          Say Y here to allow turning CPUs off and on. CPUs can be
-          enable suspend on SMP systems. CPUs can be controlled through
+          controlled through /sys/devices/system/cpu.
-          /sys/devices/system/cpu.
+          ( Note: power management support will enable this option
-          Say N if you want to disable CPU hotplug and don't need to
+            automatically on SMP systems. )
-          suspend.
+          Say N if you want to disable CPU hotplug.
 config COMPAT_VDSO
        def_bool y
@@ -1378,6 +1378,51 @@ config COMPAT_VDSO
          If unsure, say Y.
+config CMDLINE_BOOL
+        bool "Built-in kernel command line"
+        default n
+        help
+          Allow for specifying boot arguments to the kernel at
+          build time.  On some systems (e.g. embedded ones), it is
+          necessary or convenient to provide some or all of the
+          kernel boot arguments with the kernel itself (that is,
+          to not rely on the boot loader to provide them.)
+          To compile command line arguments into the kernel,
+          set this option to 'Y', then fill in the
+          the boot arguments in CONFIG_CMDLINE.
+          Systems with fully functional boot loaders (i.e. non-embedded)
+          should leave this option set to 'N'.
+config CMDLINE
+        string "Built-in kernel command string"
+        depends on CMDLINE_BOOL
+        default ""
+        help
+          Enter arguments here that should be compiled into the kernel
+          image and used at boot time.  If the boot loader provides a
+          command line at boot time, it is appended to this string to
+          form the full kernel command line, when the system boots.
+          However, you can use the CONFIG_CMDLINE_OVERRIDE option to
+          change this behavior.
+          In most cases, the command line (whether built-in or provided
+          by the boot loader) should specify the device for the root
+          file system.
+config CMDLINE_OVERRIDE
+        bool "Built-in command line overrides boot loader arguments"
+        default n
+        depends on CMDLINE_BOOL
+        help
+          Set this option to 'Y' to have the kernel ignore the boot loader
+          command line, and use ONLY the built-in command line.
+          This is used to work around broken boot loaders.  This should
+          be set to 'N' under normal conditions.
 endmenu
 config ARCH_ENABLE_MEMORY_HOTPLUG
@@ -1773,7 +1818,7 @@ config COMPAT_FOR_U64_ALIGNMENT
 config SYSVIPC_COMPAT
        def_bool y
-        depends on X86_64 && COMPAT && SYSVIPC
+        depends on COMPAT && SYSVIPC
 endmenu
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index b225219c448c..60a85768cfcb 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -418,3 +418,21 @@ config X86_MINIMUM_CPU_FAMILY
 config X86_DEBUGCTLMSR
        def_bool y
        depends on !(MK6 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MCYRIXIII || M586MMX || M586TSC || M586 || M486 || M386)
+config X86_DS
+        bool "Debug Store support"
+        default y
+        help
+          Add support for Debug Store.
+          This allows the kernel to provide a memory buffer to the hardware
+          to store various profiling and tracing events.
+config X86_PTRACE_BTS
+        bool "ptrace interface to Branch Trace Store"
+        default y
+        depends on (X86_DS && X86_DEBUGCTLMSR)
+        help
+          Add a ptrace interface to allow collecting an execution trace
+          of the traced task.
+          This collects control flow changes in a (cyclic) buffer and allows
+          debuggers to fill in the gaps and show an execution trace of the debuggee.
diff --git a/arch/x86/boot/compressed/head_32.S b/arch/x86/boot/compressed/head_32.S
index ba7736cf2ec7..29c5fbf08392 100644
--- a/arch/x86/boot/compressed/head_32.S
+++ b/arch/x86/boot/compressed/head_32.S
@@ -137,14 +137,15 @@ relocated:
 */
        movl output_len(%ebx), %eax
        pushl %eax
+                        # push arguments for decompress_kernel:
        pushl %ebp      # output address
        movl input_len(%ebx), %eax
        pushl %eax      # input_len
        leal input_data(%ebx), %eax
        pushl %eax      # input_data
        leal boot_heap(%ebx), %eax
-        pushl %eax      # heap area as third argument
+        pushl %eax      # heap area
-        pushl %esi      # real mode pointer as second arg
+        pushl %esi      # real mode pointer
        call decompress_kernel
        addl $20, %esp
        popl %ecx
diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c
index 9fea73706479..5780d361105b 100644
--- a/arch/x86/boot/compressed/misc.c
+++ b/arch/x86/boot/compressed/misc.c
@@ -16,7 +16,7 @@
 */
 #undef CONFIG_PARAVIRT
 #ifdef CONFIG_X86_32
-#define _ASM_DESC_H_ 1
+#define ASM_X86__DESC_H 1
 #endif
 #ifdef CONFIG_X86_64
@@ -27,7 +27,7 @@
 #include <linux/linkage.h>
 #include <linux/screen_info.h>
 #include <linux/elf.h>
-#include <asm/io.h>
+#include <linux/io.h>
 #include <asm/page.h>
 #include <asm/boot.h>
 #include <asm/bootparam.h>
@@ -251,7 +251,7 @@ static void __putstr(int error, const char *s)
                                y--;
                        }
                } else {
-                        vidmem [(x + cols * y) * 2] = c;
+                        vidmem[(x + cols * y) * 2] = c;
                        if (++x >= cols) {
                                x = 0;
                                if (++y >= lines) {
@@ -277,7 +277,8 @@ static void *memset(void *s, int c, unsigned n)
        int i;
        char *ss = s;
-        for (i = 0; i < n; i++) ss[i] = c;
+        for (i = 0; i < n; i++)
+                ss[i] = c;
        return s;
 }
@@ -287,7 +288,8 @@ static void *memcpy(void *dest, const void *src, unsigned n)
        const char *s = src;
        char *d = dest;
-        for (i = 0; i < n; i++) d[i] = s[i];
+        for (i = 0; i < n; i++)
+                d[i] = s[i];
        return dest;
 }
diff --git a/arch/x86/boot/compressed/relocs.c b/arch/x86/boot/compressed/relocs.c
index a1310c52fc0c..857e492c571e 100644
--- a/arch/x86/boot/compressed/relocs.c
+++ b/arch/x86/boot/compressed/relocs.c
@@ -492,7 +492,7 @@ static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
                        continue;
                }
                sh_symtab = sec_symtab->symtab;
-                sym_strtab = sec->link->strtab;
+                sym_strtab = sec_symtab->link->strtab;
                for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
                        Elf32_Rel *rel;
                        Elf32_Sym *sym;
diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S
index af86e431acfa..b993062e9a5f 100644
--- a/arch/x86/boot/header.S
+++ b/arch/x86/boot/header.S
@@ -30,7 +30,6 @@ SYSSEG		= DEF_SYSSEG		/* system loaded at 0x10000 (65536) */
 SYSSIZE         = DEF_SYSSIZE           /* system size: # of 16-byte clicks */
                                        /* to be loaded */
 ROOT_DEV        = 0                     /* ROOT_DEV is now written by "build" */
-SWAP_DEV        = 0                     /* SWAP_DEV is now written by "build" */
 #ifndef SVGA_MODE
 #define SVGA_MODE ASK_VGA
diff --git a/arch/x86/configs/i386_defconfig b/arch/x86/configs/i386_defconfig
index 104275e191a8..ef9a52005ec9 100644
--- a/arch/x86/configs/i386_defconfig
+++ b/arch/x86/configs/i386_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.27-rc4
+# Linux kernel version: 2.6.27-rc5
-# Mon Aug 25 15:04:00 2008
+# Wed Sep  3 17:23:09 2008
 #
 # CONFIG_64BIT is not set
 CONFIG_X86_32=y
@@ -202,7 +202,7 @@ CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 # CONFIG_M586 is not set
 # CONFIG_M586TSC is not set
 # CONFIG_M586MMX is not set
-# CONFIG_M686 is not set
+CONFIG_M686=y
 # CONFIG_MPENTIUMII is not set
 # CONFIG_MPENTIUMIII is not set
 # CONFIG_MPENTIUMM is not set
@@ -221,13 +221,14 @@ CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 # CONFIG_MVIAC3_2 is not set
 # CONFIG_MVIAC7 is not set
 # CONFIG_MPSC is not set
-CONFIG_MCORE2=y
+# CONFIG_MCORE2 is not set
 # CONFIG_GENERIC_CPU is not set
 CONFIG_X86_GENERIC=y
 CONFIG_X86_CPU=y
 CONFIG_X86_CMPXCHG=y
 CONFIG_X86_L1_CACHE_SHIFT=7
 CONFIG_X86_XADD=y
+# CONFIG_X86_PPRO_FENCE is not set
 CONFIG_X86_WP_WORKS_OK=y
 CONFIG_X86_INVLPG=y
 CONFIG_X86_BSWAP=y
@@ -235,14 +236,15 @@ CONFIG_X86_POPAD_OK=y
 CONFIG_X86_INTEL_USERCOPY=y
 CONFIG_X86_USE_PPRO_CHECKSUM=y
 CONFIG_X86_TSC=y
+CONFIG_X86_CMOV=y
 CONFIG_X86_MINIMUM_CPU_FAMILY=4
 CONFIG_X86_DEBUGCTLMSR=y
 CONFIG_HPET_TIMER=y
 CONFIG_HPET_EMULATE_RTC=y
 CONFIG_DMI=y
 # CONFIG_IOMMU_HELPER is not set
-CONFIG_NR_CPUS=4
+CONFIG_NR_CPUS=64
-# CONFIG_SCHED_SMT is not set
+CONFIG_SCHED_SMT=y
 CONFIG_SCHED_MC=y
 # CONFIG_PREEMPT_NONE is not set
 CONFIG_PREEMPT_VOLUNTARY=y
@@ -254,7 +256,8 @@ CONFIG_VM86=y
 # CONFIG_TOSHIBA is not set
 # CONFIG_I8K is not set
 CONFIG_X86_REBOOTFIXUPS=y
-# CONFIG_MICROCODE is not set
+CONFIG_MICROCODE=y
+CONFIG_MICROCODE_OLD_INTERFACE=y
 CONFIG_X86_MSR=y
 CONFIG_X86_CPUID=y
 # CONFIG_NOHIGHMEM is not set
@@ -2115,7 +2118,7 @@ CONFIG_IO_DELAY_0X80=y
 CONFIG_DEFAULT_IO_DELAY_TYPE=0
 CONFIG_DEBUG_BOOT_PARAMS=y
 # CONFIG_CPA_DEBUG is not set
-# CONFIG_OPTIMIZE_INLINING is not set
+CONFIG_OPTIMIZE_INLINING=y
 #
 # Security options
diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
index 678c8acefe04..e620ea6e2a7a 100644
--- a/arch/x86/configs/x86_64_defconfig
+++ b/arch/x86/configs/x86_64_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.27-rc4
+# Linux kernel version: 2.6.27-rc5
-# Mon Aug 25 14:40:46 2008
+# Wed Sep  3 17:13:39 2008
 #
 CONFIG_64BIT=y
 # CONFIG_X86_32 is not set
@@ -218,17 +218,14 @@ CONFIG_X86_PC=y
 # CONFIG_MVIAC3_2 is not set
 # CONFIG_MVIAC7 is not set
 # CONFIG_MPSC is not set
-CONFIG_MCORE2=y
+# CONFIG_MCORE2 is not set
-# CONFIG_GENERIC_CPU is not set
+CONFIG_GENERIC_CPU=y
 CONFIG_X86_CPU=y
-CONFIG_X86_L1_CACHE_BYTES=64
+CONFIG_X86_L1_CACHE_BYTES=128
-CONFIG_X86_INTERNODE_CACHE_BYTES=64
+CONFIG_X86_INTERNODE_CACHE_BYTES=128
 CONFIG_X86_CMPXCHG=y
-CONFIG_X86_L1_CACHE_SHIFT=6
+CONFIG_X86_L1_CACHE_SHIFT=7
 CONFIG_X86_WP_WORKS_OK=y
-CONFIG_X86_INTEL_USERCOPY=y
-CONFIG_X86_USE_PPRO_CHECKSUM=y
-CONFIG_X86_P6_NOP=y
 CONFIG_X86_TSC=y
 CONFIG_X86_CMPXCHG64=y
 CONFIG_X86_CMOV=y
@@ -243,9 +240,8 @@ CONFIG_CALGARY_IOMMU_ENABLED_BY_DEFAULT=y
 CONFIG_AMD_IOMMU=y
 CONFIG_SWIOTLB=y
 CONFIG_IOMMU_HELPER=y
-# CONFIG_MAXSMP is not set
+CONFIG_NR_CPUS=64
-CONFIG_NR_CPUS=4
+CONFIG_SCHED_SMT=y
-# CONFIG_SCHED_SMT is not set
 CONFIG_SCHED_MC=y
 # CONFIG_PREEMPT_NONE is not set
 CONFIG_PREEMPT_VOLUNTARY=y
@@ -254,7 +250,8 @@ CONFIG_X86_LOCAL_APIC=y
 CONFIG_X86_IO_APIC=y
 # CONFIG_X86_MCE is not set
 # CONFIG_I8K is not set
-# CONFIG_MICROCODE is not set
+CONFIG_MICROCODE=y
+CONFIG_MICROCODE_OLD_INTERFACE=y
 CONFIG_X86_MSR=y
 CONFIG_X86_CPUID=y
 CONFIG_NUMA=y
@@ -290,7 +287,7 @@ CONFIG_BOUNCE=y
 CONFIG_VIRT_TO_BUS=y
 CONFIG_MTRR=y
 # CONFIG_MTRR_SANITIZER is not set
-# CONFIG_X86_PAT is not set
+CONFIG_X86_PAT=y
 CONFIG_EFI=y
 CONFIG_SECCOMP=y
 # CONFIG_HZ_100 is not set
@@ -2089,7 +2086,7 @@ CONFIG_IO_DELAY_0X80=y
 CONFIG_DEFAULT_IO_DELAY_TYPE=0
 CONFIG_DEBUG_BOOT_PARAMS=y
 # CONFIG_CPA_DEBUG is not set
-# CONFIG_OPTIMIZE_INLINING is not set
+CONFIG_OPTIMIZE_INLINING=y
 #
 # Security options
diff --git a/arch/x86/ia32/ia32_aout.c b/arch/x86/ia32/ia32_aout.c
index a0e1dbe67dc1..127ec3f07214 100644
--- a/arch/x86/ia32/ia32_aout.c
+++ b/arch/x86/ia32/ia32_aout.c
@@ -85,8 +85,10 @@ static void dump_thread32(struct pt_regs *regs, struct user32 *dump)
        dump->regs.ax = regs->ax;
        dump->regs.ds = current->thread.ds;
        dump->regs.es = current->thread.es;
-        asm("movl %%fs,%0" : "=r" (fs)); dump->regs.fs = fs;
+        savesegment(fs, fs);
-        asm("movl %%gs,%0" : "=r" (gs)); dump->regs.gs = gs;
+        dump->regs.fs = fs;
+        savesegment(gs, gs);
+        dump->regs.gs = gs;
        dump->regs.orig_ax = regs->orig_ax;
        dump->regs.ip = regs->ip;
        dump->regs.cs = regs->cs;
@@ -430,8 +432,9 @@ beyond_if:
        current->mm->start_stack =
                (unsigned long)create_aout_tables((char __user *)bprm->p, bprm);
        /* start thread */
-        asm volatile("movl %0,%%fs" :: "r" (0)); \
+        loadsegment(fs, 0);
-        asm volatile("movl %0,%%es; movl %0,%%ds": :"r" (__USER32_DS));
+        loadsegment(ds, __USER32_DS);
+        loadsegment(es, __USER32_DS);
        load_gs_index(0);
        (regs)->ip = ex.a_entry;
        (regs)->sp = current->mm->start_stack;
diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
index 20af4c79579a..f1a2ac777faf 100644
--- a/arch/x86/ia32/ia32_signal.c
+++ b/arch/x86/ia32/ia32_signal.c
@@ -206,7 +206,7 @@ struct rt_sigframe
        { unsigned int cur;                                             \
          unsigned short pre;                                           \
          err |= __get_user(pre, &sc->seg);                             \
-          asm volatile("movl %%" #seg ",%0" : "=r" (cur));              \
+          savesegment(seg, cur);                                        \
          pre |= mask;                                                  \
          if (pre != cur) loadsegment(seg, pre); }
@@ -235,7 +235,7 @@ static int ia32_restore_sigcontext(struct pt_regs *regs,
         */
        err |= __get_user(gs, &sc->gs);
        gs |= 3;
-        asm("movl %%gs,%0" : "=r" (oldgs));
+        savesegment(gs, oldgs);
        if (gs != oldgs)
                load_gs_index(gs);
@@ -355,14 +355,13 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc,
 {
        int tmp, err = 0;
-        tmp = 0;
+        savesegment(gs, tmp);
-        __asm__("movl %%gs,%0" : "=r"(tmp): "0"(tmp));
        err |= __put_user(tmp, (unsigned int __user *)&sc->gs);
-        __asm__("movl %%fs,%0" : "=r"(tmp): "0"(tmp));
+        savesegment(fs, tmp);
        err |= __put_user(tmp, (unsigned int __user *)&sc->fs);
-        __asm__("movl %%ds,%0" : "=r"(tmp): "0"(tmp));
+        savesegment(ds, tmp);
        err |= __put_user(tmp, (unsigned int __user *)&sc->ds);
-        __asm__("movl %%es,%0" : "=r"(tmp): "0"(tmp));
+        savesegment(es, tmp);
        err |= __put_user(tmp, (unsigned int __user *)&sc->es);
        err |= __put_user((u32)regs->di, &sc->di);
@@ -498,8 +497,8 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
        regs->dx = 0;
        regs->cx = 0;
-        asm volatile("movl %0,%%ds" :: "r" (__USER32_DS));
+        loadsegment(ds, __USER32_DS);
-        asm volatile("movl %0,%%es" :: "r" (__USER32_DS));
+        loadsegment(es, __USER32_DS);
        regs->cs = __USER32_CS;
        regs->ss = __USER32_DS;
@@ -591,8 +590,8 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
        regs->dx = (unsigned long) &frame->info;
        regs->cx = (unsigned long) &frame->uc;
-        asm volatile("movl %0,%%ds" :: "r" (__USER32_DS));
+        loadsegment(ds, __USER32_DS);
-        asm volatile("movl %0,%%es" :: "r" (__USER32_DS));
+        loadsegment(es, __USER32_DS);
        regs->cs = __USER32_CS;
        regs->ss = __USER32_DS;
diff --git a/arch/x86/ia32/sys_ia32.c b/arch/x86/ia32/sys_ia32.c
index d3c64088b981..beda4232ce69 100644
--- a/arch/x86/ia32/sys_ia32.c
+++ b/arch/x86/ia32/sys_ia32.c
@@ -556,15 +556,6 @@ asmlinkage long sys32_rt_sigqueueinfo(int pid, int sig,
        return ret;
 }
-/* These are here just in case some old ia32 binary calls it. */
-asmlinkage long sys32_pause(void)
-{
-        current->state = TASK_INTERRUPTIBLE;
-        schedule();
-        return -ERESTARTNOHAND;
-}
 #ifdef CONFIG_SYSCTL_SYSCALL
 struct sysctl_ia32 {
        unsigned int    name;
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index bfd10fd211cd..e5032d7b391d 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -58,7 +58,6 @@ EXPORT_SYMBOL(acpi_disabled);
 #ifdef  CONFIG_X86_64
 #include <asm/proto.h>
-#include <asm/genapic.h>
 #else                           /* X86 */
@@ -97,8 +96,6 @@ static u64 acpi_lapic_addr __initdata = APIC_DEFAULT_PHYS_BASE;
 #warning ACPI uses CMPXCHG, i486 and later hardware
 #endif
-static int acpi_mcfg_64bit_base_addr __initdata = FALSE;
 /* --------------------------------------------------------------------------
                              Boot-time Configuration
   -------------------------------------------------------------------------- */
@@ -160,6 +157,8 @@ char *__init __acpi_map_table(unsigned long phys, unsigned long size)
 struct acpi_mcfg_allocation *pci_mmcfg_config;
 int pci_mmcfg_config_num;
+static int acpi_mcfg_64bit_base_addr __initdata = FALSE;
 static int __init acpi_mcfg_oem_check(struct acpi_table_mcfg *mcfg)
 {
        if (!strcmp(mcfg->header.oem_id, "SGI"))
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index 65a0c1b48696..fb04e49776ba 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -231,25 +231,25 @@ static void alternatives_smp_lock(u8 **start, u8 **end, u8 *text, u8 *text_end)
                        continue;
                if (*ptr > text_end)
                        continue;
-                text_poke(*ptr, ((unsigned char []){0xf0}), 1); /* add lock prefix */
+                /* turn DS segment override prefix into lock prefix */
+                text_poke(*ptr, ((unsigned char []){0xf0}), 1);
        };
 }
 static void alternatives_smp_unlock(u8 **start, u8 **end, u8 *text, u8 *text_end)
 {
        u8 **ptr;
-        char insn[1];
        if (noreplace_smp)
                return;
-        add_nops(insn, 1);
        for (ptr = start; ptr < end; ptr++) {
                if (*ptr < text)
                        continue;
                if (*ptr > text_end)
                        continue;
-                text_poke(*ptr, insn, 1);
+                /* turn lock prefix into DS segment override prefix */
+                text_poke(*ptr, ((unsigned char []){0x3E}), 1);
        };
 }
diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c
index 44e21826db11..9a32b37ee2ee 100644
--- a/arch/x86/kernel/aperture_64.c
+++ b/arch/x86/kernel/aperture_64.c
@@ -455,11 +455,11 @@ out:
                   force_iommu ||
                   valid_agp ||
                   fallback_aper_force) {
-                printk(KERN_ERR
+                printk(KERN_INFO
                        "Your BIOS doesn't leave a aperture memory hole\n");
-                printk(KERN_ERR
+                printk(KERN_INFO
                        "Please enable the IOMMU option in the BIOS setup\n");
-                printk(KERN_ERR
+                printk(KERN_INFO
                        "This costs you %d MB of RAM\n",
                                32 << fallback_aper_order);
diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
index 732d1f4e10ee..5145a6e72bbb 100644
--- a/arch/x86/kernel/apm_32.c
+++ b/arch/x86/kernel/apm_32.c
@@ -228,7 +228,6 @@
 #include <linux/suspend.h>
 #include <linux/kthread.h>
 #include <linux/jiffies.h>
-#include <linux/smp_lock.h>
 #include <asm/system.h>
 #include <asm/uaccess.h>
diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
index aa89387006fe..505543a75a56 100644
--- a/arch/x86/kernel/asm-offsets_64.c
+++ b/arch/x86/kernel/asm-offsets_64.c
@@ -22,7 +22,7 @@
 #define __NO_STUBS 1
 #undef __SYSCALL
-#undef _ASM_X86_64_UNISTD_H_
+#undef ASM_X86__UNISTD_64_H
 #define __SYSCALL(nr, sym) [nr] = 1,
 static char syscalls[] = {
 #include <asm/unistd.h>
diff --git a/arch/x86/kernel/bios_uv.c b/arch/x86/kernel/bios_uv.c
index c639bd55391c..fdd585f9c53d 100644
--- a/arch/x86/kernel/bios_uv.c
+++ b/arch/x86/kernel/bios_uv.c
@@ -25,11 +25,11 @@ x86_bios_strerror(long status)
 {
        const char *str;
        switch (status) {
-        case  0: str = "Call completed without error"; break;
+        case  0: str = "Call completed without error";  break;
-        case -1: str = "Not implemented"; break;
+        case -1: str = "Not implemented";               break;
-        case -2: str = "Invalid argument"; break;
+        case -2: str = "Invalid argument";              break;
-        case -3: str = "Call completed with error"; break;
+        case -3: str = "Call completed with error";     break;
-        default: str = "Unknown BIOS status code"; break;
+        default: str = "Unknown BIOS status code";      break;
        }
        return str;
 }
diff --git a/arch/x86/kernel/cpu/common_64.c b/arch/x86/kernel/cpu/common_64.c
index a11f5d4477cd..305b465889b0 100644
--- a/arch/x86/kernel/cpu/common_64.c
+++ b/arch/x86/kernel/cpu/common_64.c
@@ -430,6 +430,49 @@ static __init int setup_noclflush(char *arg)
 }
 __setup("noclflush", setup_noclflush);
+struct msr_range {
+        unsigned min;
+        unsigned max;
+};
+static struct msr_range msr_range_array[] __cpuinitdata = {
+        { 0x00000000, 0x00000418},
+        { 0xc0000000, 0xc000040b},
+        { 0xc0010000, 0xc0010142},
+        { 0xc0011000, 0xc001103b},
+};
+static void __cpuinit print_cpu_msr(void)
+{
+        unsigned index;
+        u64 val;
+        int i;
+        unsigned index_min, index_max;
+        for (i = 0; i < ARRAY_SIZE(msr_range_array); i++) {
+                index_min = msr_range_array[i].min;
+                index_max = msr_range_array[i].max;
+                for (index = index_min; index < index_max; index++) {
+                        if (rdmsrl_amd_safe(index, &val))
+                                continue;
+                        printk(KERN_INFO " MSR%08x: %016llx\n", index, val);
+                }
+        }
+}
+static int show_msr __cpuinitdata;
+static __init int setup_show_msr(char *arg)
+{
+        int num;
+        get_option(&arg, &num);
+        if (num > 0)
+                show_msr = num;
+        return 1;
+}
+__setup("show_msr=", setup_show_msr);
 void __cpuinit print_cpu_info(struct cpuinfo_x86 *c)
 {
        if (c->x86_model_id[0])
@@ -439,6 +482,14 @@ void __cpuinit print_cpu_info(struct cpuinfo_x86 *c)
                printk(KERN_CONT " stepping %02x\n", c->x86_mask);
        else
                printk(KERN_CONT "\n");
+#ifdef CONFIG_SMP
+        if (c->cpu_index < show_msr)
+                print_cpu_msr();
+#else
+        if (show_msr)
+                print_cpu_msr();
+#endif
 }
 static __init int setup_disablecpuid(char *arg)
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index b75f2569b8f8..f113ef4595f6 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -222,10 +222,11 @@ static void __cpuinit init_intel(struct cpuinfo_x86 *c)
                        set_cpu_cap(c, X86_FEATURE_BTS);
                if (!(l1 & (1<<12)))
                        set_cpu_cap(c, X86_FEATURE_PEBS);
+                ds_init_intel(c);
        }
        if (cpu_has_bts)
-                ds_init_intel(c);
+                ptrace_bts_init_intel(c);
        /*
         * See if we have a good local APIC by checking for buggy Pentia,
diff --git a/arch/x86/kernel/cpu/mtrr/generic.c b/arch/x86/kernel/cpu/mtrr/generic.c
index cb7d3b6a80eb..4e8d77f01eeb 100644
--- a/arch/x86/kernel/cpu/mtrr/generic.c
+++ b/arch/x86/kernel/cpu/mtrr/generic.c
@@ -401,12 +401,7 @@ static void generic_get_mtrr(unsigned int reg, unsigned long *base,
                tmp |= ~((1<<(hi - 1)) - 1);
                if (tmp != mask_lo) {
-                        static int once = 1;
+                        WARN_ONCE(1, KERN_INFO "mtrr: your BIOS has set up an incorrect mask, fixing it up.\n");
-                        if (once) {
-                                printk(KERN_INFO "mtrr: your BIOS has set up an incorrect mask, fixing it up.\n");
-                                once = 0;
-                        }
                        mask_lo = tmp;
                }
        }
diff --git a/arch/x86/kernel/cpu/mtrr/if.c b/arch/x86/kernel/cpu/mtrr/if.c
index 84c480bb3715..4c4214690dd1 100644
--- a/arch/x86/kernel/cpu/mtrr/if.c
+++ b/arch/x86/kernel/cpu/mtrr/if.c
@@ -405,9 +405,9 @@ static int mtrr_seq_show(struct seq_file *seq, void *offset)
                        }
                        /* RED-PEN: base can be > 32bit */ 
                        len += seq_printf(seq, 
-                                   "reg%02i: base=0x%05lx000 (%4luMB), size=%4lu%cB: %s, count=%d\n",
+                                   "reg%02i: base=0x%06lx000 (%5luMB), size=%5lu%cB, count=%d: %s\n",
                             i, base, base >> (20 - PAGE_SHIFT), size, factor,
-                             mtrr_attrib_to_str(type), mtrr_usage_table[i]);
+                             mtrr_usage_table[i], mtrr_attrib_to_str(type));
                }
        }
        return 0;
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index b117d7f8a564..c78c04821ea1 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -729,7 +729,7 @@ struct var_mtrr_range_state {
        mtrr_type type;
 };
-struct var_mtrr_range_state __initdata range_state[RANGE_NUM];
+static struct var_mtrr_range_state __initdata range_state[RANGE_NUM];
 static int __initdata debug_print;
 static int __init
@@ -759,7 +759,8 @@ x86_get_mtrr_mem_range(struct res_range *range, int nr_range,
        /* take out UC ranges */
        for (i = 0; i < num_var_ranges; i++) {
                type = range_state[i].type;
-                if (type != MTRR_TYPE_UNCACHABLE)
+                if (type != MTRR_TYPE_UNCACHABLE &&
+                    type != MTRR_TYPE_WRPROT)
                        continue;
                size = range_state[i].size_pfn;
                if (!size)
@@ -834,7 +835,14 @@ static int __init enable_mtrr_cleanup_setup(char *str)
                enable_mtrr_cleanup = 1;
        return 0;
 }
-early_param("enble_mtrr_cleanup", enable_mtrr_cleanup_setup);
+early_param("enable_mtrr_cleanup", enable_mtrr_cleanup_setup);
+static int __init mtrr_cleanup_debug_setup(char *str)
+{
+        debug_print = 1;
+        return 0;
+}
+early_param("mtrr_cleanup_debug", mtrr_cleanup_debug_setup);
 struct var_mtrr_state {
        unsigned long   range_startk;
@@ -898,6 +906,27 @@ set_var_mtrr_all(unsigned int address_bits)
        }
 }
+static unsigned long to_size_factor(unsigned long sizek, char *factorp)
+{
+        char factor;
+        unsigned long base = sizek;
+        if (base & ((1<<10) - 1)) {
+                /* not MB alignment */
+                factor = 'K';
+        } else if (base & ((1<<20) - 1)){
+                factor = 'M';
+                base >>= 10;
+        } else {
+                factor = 'G';
+                base >>= 20;
+        }
+        *factorp = factor;
+        return base;
+}
 static unsigned int __init
 range_to_mtrr(unsigned int reg, unsigned long range_startk,
              unsigned long range_sizek, unsigned char type)
@@ -919,13 +948,21 @@ range_to_mtrr(unsigned int reg, unsigned long range_startk,
                        align = max_align;
                sizek = 1 << align;
-                if (debug_print)
+                if (debug_print) {
+                        char start_factor = 'K', size_factor = 'K';
+                        unsigned long start_base, size_base;
+                        start_base = to_size_factor(range_startk, &start_factor),
+                        size_base = to_size_factor(sizek, &size_factor),
                        printk(KERN_DEBUG "Setting variable MTRR %d, "
-                                "base: %ldMB, range: %ldMB, type %s\n",
+                                "base: %ld%cB, range: %ld%cB, type %s\n",
-                                reg, range_startk >> 10, sizek >> 10,
+                                reg, start_base, start_factor,
+                                size_base, size_factor,
                                (type == MTRR_TYPE_UNCACHABLE)?"UC":
                                    ((type == MTRR_TYPE_WRBACK)?"WB":"Other")
                                );
+                }
                save_var_mtrr(reg++, range_startk, sizek, type);
                range_startk += sizek;
                range_sizek -= sizek;
@@ -970,6 +1007,8 @@ range_to_mtrr_with_hole(struct var_mtrr_state *state, unsigned long basek,
        /* try to append some small hole */
        range0_basek = state->range_startk;
        range0_sizek = ALIGN(state->range_sizek, chunk_sizek);
+        /* no increase */
        if (range0_sizek == state->range_sizek) {
                if (debug_print)
                        printk(KERN_DEBUG "rangeX: %016lx - %016lx\n",
@@ -980,13 +1019,40 @@ range_to_mtrr_with_hole(struct var_mtrr_state *state, unsigned long basek,
                return 0;
        }
-        range0_sizek -= chunk_sizek;
+        /* only cut back, when it is not the last */
-        if (range0_sizek && sizek) {
+        if (sizek) {
-            while (range0_basek + range0_sizek > (basek + sizek)) {
+                while (range0_basek + range0_sizek > (basek + sizek)) {
-                range0_sizek -= chunk_sizek;
+                        if (range0_sizek >= chunk_sizek)
-                if (!range0_sizek)
+                                range0_sizek -= chunk_sizek;
-                        break;
+                        else
-            }
+                                range0_sizek = 0;
+                        if (!range0_sizek)
+                                break;
+                }
+        }
+second_try:
+        range_basek = range0_basek + range0_sizek;
+        /* one hole in the middle */
+        if (range_basek > basek && range_basek <= (basek + sizek))
+                second_sizek = range_basek - basek;
+        if (range0_sizek > state->range_sizek) {
+                /* one hole in middle or at end */
+                hole_sizek = range0_sizek - state->range_sizek - second_sizek;
+                /* hole size should be less than half of range0 size */
+                if (hole_sizek >= (range0_sizek >> 1) &&
+                    range0_sizek >= chunk_sizek) {
+                        range0_sizek -= chunk_sizek;
+                        second_sizek = 0;
+                        hole_sizek = 0;
+                        goto second_try;
+                }
        }
        if (range0_sizek) {
@@ -996,50 +1062,28 @@ range_to_mtrr_with_hole(struct var_mtrr_state *state, unsigned long basek,
                                (range0_basek + range0_sizek)<<10);
                state->reg = range_to_mtrr(state->reg, range0_basek,
                                range0_sizek, MTRR_TYPE_WRBACK);
-        }
-        range_basek = range0_basek + range0_sizek;
-        range_sizek = chunk_sizek;
-        if (range_basek + range_sizek > basek &&
-            range_basek + range_sizek <= (basek + sizek)) {
-                /* one hole */
-                second_basek = basek;
-                second_sizek = range_basek + range_sizek - basek;
        }
-        /* if last piece, only could one hole near end */
+        if (range0_sizek < state->range_sizek) {
-        if ((second_basek || !basek) &&
+                /* need to handle left over */
-            range_sizek - (state->range_sizek - range0_sizek) - second_sizek <
-            (chunk_sizek >> 1)) {
-                /*
-                 * one hole in middle (second_sizek is 0) or at end
-                 * (second_sizek is 0 )
-                 */
-                hole_sizek = range_sizek - (state->range_sizek - range0_sizek)
-                                 - second_sizek;
-                hole_basek = range_basek + range_sizek - hole_sizek
-                                 - second_sizek;
-        } else {
-                /* fallback for big hole, or several holes */
                range_sizek = state->range_sizek - range0_sizek;
-                second_basek = 0;
-                second_sizek = 0;
+                if (debug_print)
+                        printk(KERN_DEBUG "range: %016lx - %016lx\n",
+                                 range_basek<<10,
+                                 (range_basek + range_sizek)<<10);
+                state->reg = range_to_mtrr(state->reg, range_basek,
+                                 range_sizek, MTRR_TYPE_WRBACK);
        }
-        if (debug_print)
-                printk(KERN_DEBUG "range: %016lx - %016lx\n", range_basek<<10,
-                         (range_basek + range_sizek)<<10);
-        state->reg = range_to_mtrr(state->reg, range_basek, range_sizek,
-                                         MTRR_TYPE_WRBACK);
        if (hole_sizek) {
+                hole_basek = range_basek - hole_sizek - second_sizek;
                if (debug_print)
                        printk(KERN_DEBUG "hole: %016lx - %016lx\n",
-                                 hole_basek<<10, (hole_basek + hole_sizek)<<10);
+                                 hole_basek<<10,
-                state->reg = range_to_mtrr(state->reg, hole_basek, hole_sizek,
+                                 (hole_basek + hole_sizek)<<10);
-                                                 MTRR_TYPE_UNCACHABLE);
+                state->reg = range_to_mtrr(state->reg, hole_basek,
+                                 hole_sizek, MTRR_TYPE_UNCACHABLE);
        }
        return second_sizek;
@@ -1154,11 +1198,11 @@ struct mtrr_cleanup_result {
 };
 /*
- * gran_size: 1M, 2M, ..., 2G
+ * gran_size: 64K, 128K, 256K, 512K, 1M, 2M, ..., 2G
- * chunk size: gran_size, ..., 4G
+ * chunk size: gran_size, ..., 2G
- * so we need (2+13)*6
+ * so we need (1+16)*8
 */
-#define NUM_RESULT      90
+#define NUM_RESULT      136
 #define PSHIFT          (PAGE_SHIFT - 10)
 static struct mtrr_cleanup_result __initdata result[NUM_RESULT];
@@ -1168,13 +1212,14 @@ static unsigned long __initdata min_loss_pfn[RANGE_NUM];
 static int __init mtrr_cleanup(unsigned address_bits)
 {
        unsigned long extra_remove_base, extra_remove_size;
-        unsigned long i, base, size, def, dummy;
+        unsigned long base, size, def, dummy;
        mtrr_type type;
        int nr_range, nr_range_new;
        u64 chunk_size, gran_size;
        unsigned long range_sums, range_sums_new;
        int index_good;
        int num_reg_good;
+        int i;
        /* extra one for all 0 */
        int num[MTRR_NUM_TYPES + 1];
@@ -1204,6 +1249,8 @@ static int __init mtrr_cleanup(unsigned address_bits)
                        continue;
                if (!size)
                        type = MTRR_NUM_TYPES;
+                if (type == MTRR_TYPE_WRPROT)
+                        type = MTRR_TYPE_UNCACHABLE;
                num[type]++;
        }
@@ -1216,23 +1263,57 @@ static int __init mtrr_cleanup(unsigned address_bits)
                num_var_ranges - num[MTRR_NUM_TYPES])
                return 0;
+        /* print original var MTRRs at first, for debugging: */
+        printk(KERN_DEBUG "original variable MTRRs\n");
+        for (i = 0; i < num_var_ranges; i++) {
+                char start_factor = 'K', size_factor = 'K';
+                unsigned long start_base, size_base;
+                size_base = range_state[i].size_pfn << (PAGE_SHIFT - 10);
+                if (!size_base)
+                        continue;
+                size_base = to_size_factor(size_base, &size_factor),
+                start_base = range_state[i].base_pfn << (PAGE_SHIFT - 10);
+                start_base = to_size_factor(start_base, &start_factor),
+                type = range_state[i].type;
+                printk(KERN_DEBUG "reg %d, base: %ld%cB, range: %ld%cB, type %s\n",
+                        i, start_base, start_factor,
+                        size_base, size_factor,
+                        (type == MTRR_TYPE_UNCACHABLE) ? "UC" :
+                            ((type == MTRR_TYPE_WRPROT) ? "WP" :
+                             ((type == MTRR_TYPE_WRBACK) ? "WB" : "Other"))
+                        );
+        }
        memset(range, 0, sizeof(range));
        extra_remove_size = 0;
-        if (mtrr_tom2) {
+        extra_remove_base = 1 << (32 - PAGE_SHIFT);
-                extra_remove_base = 1 << (32 - PAGE_SHIFT);
+        if (mtrr_tom2)
                extra_remove_size =
                        (mtrr_tom2 >> PAGE_SHIFT) - extra_remove_base;
-        }
        nr_range = x86_get_mtrr_mem_range(range, 0, extra_remove_base,
                                          extra_remove_size);
+        /*
+         * [0, 1M) should always be coverred by var mtrr with WB
+         * and fixed mtrrs should take effective before var mtrr for it
+         */
+        nr_range = add_range_with_merge(range, nr_range, 0,
+                                        (1ULL<<(20 - PAGE_SHIFT)) - 1);
+        /* sort the ranges */
+        sort(range, nr_range, sizeof(struct res_range), cmp_range, NULL);
        range_sums = sum_ranges(range, nr_range);
        printk(KERN_INFO "total RAM coverred: %ldM\n",
               range_sums >> (20 - PAGE_SHIFT));
        if (mtrr_chunk_size && mtrr_gran_size) {
                int num_reg;
+                char gran_factor, chunk_factor, lose_factor;
+                unsigned long gran_base, chunk_base, lose_base;
-                debug_print = 1;
+                debug_print++;
                /* convert ranges to var ranges state */
                num_reg = x86_setup_var_mtrrs(range, nr_range, mtrr_chunk_size,
                                              mtrr_gran_size);
@@ -1256,34 +1337,48 @@ static int __init mtrr_cleanup(unsigned address_bits)
                        result[i].lose_cover_sizek =
                                (range_sums - range_sums_new) << PSHIFT;
-                printk(KERN_INFO "%sgran_size: %ldM \tchunk_size: %ldM \t",
+                gran_base = to_size_factor(result[i].gran_sizek, &gran_factor),
-                         result[i].bad?"*BAD*":" ", result[i].gran_sizek >> 10,
+                chunk_base = to_size_factor(result[i].chunk_sizek, &chunk_factor),
-                         result[i].chunk_sizek >> 10);
+                lose_base = to_size_factor(result[i].lose_cover_sizek, &lose_factor),
-                printk(KERN_CONT "num_reg: %d  \tlose cover RAM: %s%ldM \n",
+                printk(KERN_INFO "%sgran_size: %ld%c \tchunk_size: %ld%c \t",
+                         result[i].bad?"*BAD*":" ",
+                         gran_base, gran_factor, chunk_base, chunk_factor);
+                printk(KERN_CONT "num_reg: %d  \tlose cover RAM: %s%ld%c\n",
                         result[i].num_reg, result[i].bad?"-":"",
-                         result[i].lose_cover_sizek >> 10);
+                         lose_base, lose_factor);
                if (!result[i].bad) {
                        set_var_mtrr_all(address_bits);
                        return 1;
                }
                printk(KERN_INFO "invalid mtrr_gran_size or mtrr_chunk_size, "
                       "will find optimal one\n");
-                debug_print = 0;
+                debug_print--;
                memset(result, 0, sizeof(result[0]));
        }
        i = 0;
        memset(min_loss_pfn, 0xff, sizeof(min_loss_pfn));
        memset(result, 0, sizeof(result));
-        for (gran_size = (1ULL<<20); gran_size < (1ULL<<32); gran_size <<= 1) {
+        for (gran_size = (1ULL<<16); gran_size < (1ULL<<32); gran_size <<= 1) {
-                for (chunk_size = gran_size; chunk_size < (1ULL<<33);
+                char gran_factor;
+                unsigned long gran_base;
+                if (debug_print)
+                        gran_base = to_size_factor(gran_size >> 10, &gran_factor);
+                for (chunk_size = gran_size; chunk_size < (1ULL<<32);
                     chunk_size <<= 1) {
                        int num_reg;
-                        if (debug_print)
+                        if (debug_print) {
-                                printk(KERN_INFO
+                                char chunk_factor;
-                               "\ngran_size: %lldM   chunk_size_size: %lldM\n",
+                                unsigned long chunk_base;
-                                       gran_size >> 20, chunk_size >> 20);
+                                chunk_base = to_size_factor(chunk_size>>10, &chunk_factor),
+                                printk(KERN_INFO "\n");
+                                printk(KERN_INFO "gran_size: %ld%c   chunk_size: %ld%c \n",
+                                       gran_base, gran_factor, chunk_base, chunk_factor);
+                        }
                        if (i >= NUM_RESULT)
                                continue;
@@ -1326,12 +1421,18 @@ static int __init mtrr_cleanup(unsigned address_bits)
        /* print out all */
        for (i = 0; i < NUM_RESULT; i++) {
-                printk(KERN_INFO "%sgran_size: %ldM \tchunk_size: %ldM \t",
+                char gran_factor, chunk_factor, lose_factor;
-                       result[i].bad?"*BAD* ":" ", result[i].gran_sizek >> 10,
+                unsigned long gran_base, chunk_base, lose_base;
-                       result[i].chunk_sizek >> 10);
-                printk(KERN_CONT "num_reg: %d \tlose RAM: %s%ldM\n",
+                gran_base = to_size_factor(result[i].gran_sizek, &gran_factor),
-                       result[i].num_reg, result[i].bad?"-":"",
+                chunk_base = to_size_factor(result[i].chunk_sizek, &chunk_factor),
-                       result[i].lose_cover_sizek >> 10);
+                lose_base = to_size_factor(result[i].lose_cover_sizek, &lose_factor),
+                printk(KERN_INFO "%sgran_size: %ld%c \tchunk_size: %ld%c \t",
+                         result[i].bad?"*BAD*":" ",
+                         gran_base, gran_factor, chunk_base, chunk_factor);
+                printk(KERN_CONT "num_reg: %d  \tlose cover RAM: %s%ld%c\n",
+                         result[i].num_reg, result[i].bad?"-":"",
+                         lose_base, lose_factor);
        }
        /* try to find the optimal index */
@@ -1339,10 +1440,8 @@ static int __init mtrr_cleanup(unsigned address_bits)
                nr_mtrr_spare_reg = num_var_ranges - 1;
        num_reg_good = -1;
        for (i = num_var_ranges - nr_mtrr_spare_reg; i > 0; i--) {
-                if (!min_loss_pfn[i]) {
+                if (!min_loss_pfn[i])
                        num_reg_good = i;
-                        break;
-                }
        }
        index_good = -1;
@@ -1358,21 +1457,26 @@ static int __init mtrr_cleanup(unsigned address_bits)
        }
        if (index_good != -1) {
+                char gran_factor, chunk_factor, lose_factor;
+                unsigned long gran_base, chunk_base, lose_base;
                printk(KERN_INFO "Found optimal setting for mtrr clean up\n");
                i = index_good;
-                printk(KERN_INFO "gran_size: %ldM \tchunk_size: %ldM \t",
+                gran_base = to_size_factor(result[i].gran_sizek, &gran_factor),
-                                result[i].gran_sizek >> 10,
+                chunk_base = to_size_factor(result[i].chunk_sizek, &chunk_factor),
-                                result[i].chunk_sizek >> 10);
+                lose_base = to_size_factor(result[i].lose_cover_sizek, &lose_factor),
-                printk(KERN_CONT "num_reg: %d \tlose RAM: %ldM\n",
+                printk(KERN_INFO "gran_size: %ld%c \tchunk_size: %ld%c \t",
-                                result[i].num_reg,
+                         gran_base, gran_factor, chunk_base, chunk_factor);
-                                result[i].lose_cover_sizek >> 10);
+                printk(KERN_CONT "num_reg: %d  \tlose RAM: %ld%c\n",
+                         result[i].num_reg, lose_base, lose_factor);
                /* convert ranges to var ranges state */
                chunk_size = result[i].chunk_sizek;
                chunk_size <<= 10;
                gran_size = result[i].gran_sizek;
                gran_size <<= 10;
-                debug_print = 1;
+                debug_print++;
                x86_setup_var_mtrrs(range, nr_range, chunk_size, gran_size);
+                debug_print--;
                set_var_mtrr_all(address_bits);
                return 1;
        }
diff --git a/arch/x86/kernel/cpu/perfctr-watchdog.c b/arch/x86/kernel/cpu/perfctr-watchdog.c
index 05cc22dbd4ff..6bff382094f5 100644
--- a/arch/x86/kernel/cpu/perfctr-watchdog.c
+++ b/arch/x86/kernel/cpu/perfctr-watchdog.c
@@ -295,13 +295,19 @@ static int setup_k7_watchdog(unsigned nmi_hz)
        /* setup the timer */
        wrmsr(evntsel_msr, evntsel, 0);
        write_watchdog_counter(perfctr_msr, "K7_PERFCTR0",nmi_hz);
-        apic_write(APIC_LVTPC, APIC_DM_NMI);
-        evntsel |= K7_EVNTSEL_ENABLE;
-        wrmsr(evntsel_msr, evntsel, 0);
+        /* initialize the wd struct before enabling */
        wd->perfctr_msr = perfctr_msr;
        wd->evntsel_msr = evntsel_msr;
        wd->cccr_msr = 0;  /* unused */
+        /* ok, everything is initialized, announce that we're set */
+        cpu_nmi_set_wd_enabled();
+        apic_write(APIC_LVTPC, APIC_DM_NMI);
+        evntsel |= K7_EVNTSEL_ENABLE;
+        wrmsr(evntsel_msr, evntsel, 0);
        return 1;
 }
@@ -379,13 +385,19 @@ static int setup_p6_watchdog(unsigned nmi_hz)
        wrmsr(evntsel_msr, evntsel, 0);
        nmi_hz = adjust_for_32bit_ctr(nmi_hz);
        write_watchdog_counter32(perfctr_msr, "P6_PERFCTR0",nmi_hz);
-        apic_write(APIC_LVTPC, APIC_DM_NMI);
-        evntsel |= P6_EVNTSEL0_ENABLE;
-        wrmsr(evntsel_msr, evntsel, 0);
+        /* initialize the wd struct before enabling */
        wd->perfctr_msr = perfctr_msr;
        wd->evntsel_msr = evntsel_msr;
        wd->cccr_msr = 0;  /* unused */
+        /* ok, everything is initialized, announce that we're set */
+        cpu_nmi_set_wd_enabled();
+        apic_write(APIC_LVTPC, APIC_DM_NMI);
+        evntsel |= P6_EVNTSEL0_ENABLE;
+        wrmsr(evntsel_msr, evntsel, 0);
        return 1;
 }
@@ -432,6 +444,27 @@ static const struct wd_ops p6_wd_ops = {
 #define P4_CCCR_ENABLE          (1 << 12)
 #define P4_CCCR_OVF             (1 << 31)
+#define P4_CONTROLS 18
+static unsigned int p4_controls[18] = {
+        MSR_P4_BPU_CCCR0,
+        MSR_P4_BPU_CCCR1,
+        MSR_P4_BPU_CCCR2,
+        MSR_P4_BPU_CCCR3,
+        MSR_P4_MS_CCCR0,
+        MSR_P4_MS_CCCR1,
+        MSR_P4_MS_CCCR2,
+        MSR_P4_MS_CCCR3,
+        MSR_P4_FLAME_CCCR0,
+        MSR_P4_FLAME_CCCR1,
+        MSR_P4_FLAME_CCCR2,
+        MSR_P4_FLAME_CCCR3,
+        MSR_P4_IQ_CCCR0,
+        MSR_P4_IQ_CCCR1,
+        MSR_P4_IQ_CCCR2,
+        MSR_P4_IQ_CCCR3,
+        MSR_P4_IQ_CCCR4,
+        MSR_P4_IQ_CCCR5,
+};
 /*
 * Set up IQ_COUNTER0 to behave like a clock, by having IQ_CCCR0 filter
 * CRU_ESCR0 (with any non-null event selector) through a complemented
@@ -473,6 +506,26 @@ static int setup_p4_watchdog(unsigned nmi_hz)
                evntsel_msr = MSR_P4_CRU_ESCR0;
                cccr_msr = MSR_P4_IQ_CCCR0;
                cccr_val = P4_CCCR_OVF_PMI0 | P4_CCCR_ESCR_SELECT(4);
+                /*
+                 * If we're on the kdump kernel or other situation, we may
+                 * still have other performance counter registers set to
+                 * interrupt and they'll keep interrupting forever because
+                 * of the P4_CCCR_OVF quirk. So we need to ACK all the
+                 * pending interrupts and disable all the registers here,
+                 * before reenabling the NMI delivery. Refer to p4_rearm()
+                 * about the P4_CCCR_OVF quirk.
+                 */
+                if (reset_devices) {
+                        unsigned int low, high;
+                        int i;
+                        for (i = 0; i < P4_CONTROLS; i++) {
+                                rdmsr(p4_controls[i], low, high);
+                                low &= ~(P4_CCCR_ENABLE | P4_CCCR_OVF);
+                                wrmsr(p4_controls[i], low, high);
+                        }
+                }
        } else {
                /* logical cpu 1 */
                perfctr_msr = MSR_P4_IQ_PERFCTR1;
@@ -499,12 +552,17 @@ static int setup_p4_watchdog(unsigned nmi_hz)
        wrmsr(evntsel_msr, evntsel, 0);
        wrmsr(cccr_msr, cccr_val, 0);
        write_watchdog_counter(perfctr_msr, "P4_IQ_COUNTER0", nmi_hz);
-        apic_write(APIC_LVTPC, APIC_DM_NMI);
-        cccr_val |= P4_CCCR_ENABLE;
-        wrmsr(cccr_msr, cccr_val, 0);
        wd->perfctr_msr = perfctr_msr;
        wd->evntsel_msr = evntsel_msr;
        wd->cccr_msr = cccr_msr;
+        /* ok, everything is initialized, announce that we're set */
+        cpu_nmi_set_wd_enabled();
+        apic_write(APIC_LVTPC, APIC_DM_NMI);
+        cccr_val |= P4_CCCR_ENABLE;
+        wrmsr(cccr_msr, cccr_val, 0);
        return 1;
 }
@@ -620,13 +678,17 @@ static int setup_intel_arch_watchdog(unsigned nmi_hz)
        wrmsr(evntsel_msr, evntsel, 0);
        nmi_hz = adjust_for_32bit_ctr(nmi_hz);
        write_watchdog_counter32(perfctr_msr, "INTEL_ARCH_PERFCTR0", nmi_hz);
-        apic_write(APIC_LVTPC, APIC_DM_NMI);
-        evntsel |= ARCH_PERFMON_EVENTSEL0_ENABLE;
-        wrmsr(evntsel_msr, evntsel, 0);
        wd->perfctr_msr = perfctr_msr;
        wd->evntsel_msr = evntsel_msr;
        wd->cccr_msr = 0;  /* unused */
+        /* ok, everything is initialized, announce that we're set */
+        cpu_nmi_set_wd_enabled();
+        apic_write(APIC_LVTPC, APIC_DM_NMI);
+        evntsel |= ARCH_PERFMON_EVENTSEL0_ENABLE;
+        wrmsr(evntsel_msr, evntsel, 0);
        intel_arch_wd_ops.checkbit = 1ULL << (eax.split.bit_width - 1);
        return 1;
 }
diff --git a/arch/x86/kernel/cpuid.c b/arch/x86/kernel/cpuid.c
index 8e9cd6a8ec12..6a44d6465991 100644
--- a/arch/x86/kernel/cpuid.c
+++ b/arch/x86/kernel/cpuid.c
@@ -36,7 +36,6 @@
 #include <linux/smp_lock.h>
 #include <linux/major.h>
 #include <linux/fs.h>
-#include <linux/smp_lock.h>
 #include <linux/device.h>
 #include <linux/cpu.h>
 #include <linux/notifier.h>
diff --git a/arch/x86/kernel/crash_dump_64.c b/arch/x86/kernel/crash_dump_64.c
index 15e6c6bc4a46..e90a60ef10c2 100644
--- a/arch/x86/kernel/crash_dump_64.c
+++ b/arch/x86/kernel/crash_dump_64.c
@@ -7,9 +7,8 @@
 #include <linux/errno.h>
 #include <linux/crash_dump.h>
+#include <linux/uaccess.h>
-#include <asm/uaccess.h>
+#include <linux/io.h>
-#include <asm/io.h>
 /**
 * copy_oldmem_page - copy one page from "oldmem"
@@ -25,7 +24,7 @@
 * in the current kernel. We stitch up a pte, similar to kmap_atomic.
 */
 ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
-                               size_t csize, unsigned long offset, int userbuf)
+                size_t csize, unsigned long offset, int userbuf)
 {
        void  *vaddr;
@@ -33,14 +32,16 @@ ssize_t copy_oldmem_page(unsigned long pfn, char *buf,
                return 0;
        vaddr = ioremap(pfn << PAGE_SHIFT, PAGE_SIZE);
+        if (!vaddr)
+                return -ENOMEM;
        if (userbuf) {
-                if (copy_to_user(buf, (vaddr + offset), csize)) {
+                if (copy_to_user(buf, vaddr + offset, csize)) {
                        iounmap(vaddr);
                        return -EFAULT;
                }
        } else
-        memcpy(buf, (vaddr + offset), csize);
+                memcpy(buf, vaddr + offset, csize);
        iounmap(vaddr);
        return csize;
diff --git a/arch/x86/kernel/ds.c b/arch/x86/kernel/ds.c
index 11c11b8ec48d..2b69994fd3a8 100644
--- a/arch/x86/kernel/ds.c
+++ b/arch/x86/kernel/ds.c
@@ -2,26 +2,49 @@
 * Debug Store support
 *
 * This provides a low-level interface to the hardware's Debug Store
- * feature that is used for last branch recording (LBR) and
+ * feature that is used for branch trace store (BTS) and
 * precise-event based sampling (PEBS).
 *
- * Different architectures use a different DS layout/pointer size.
+ * It manages:
- * The below functions therefore work on a void*.
+ * - per-thread and per-cpu allocation of BTS and PEBS
+ * - buffer memory allocation (optional)
+ * - buffer overflow handling
+ * - buffer access
 *
+ * It assumes:
+ * - get_task_struct on all parameter tasks
+ * - current is allowed to trace parameter tasks
 *
- * Since there is no user for PEBS, yet, only LBR (or branch
- * trace store, BTS) is supported.
 *
- *
+ * Copyright (C) 2007-2008 Intel Corporation.
- * Copyright (C) 2007 Intel Corporation.
+ * Markus Metzger <markus.t.metzger@intel.com>, 2007-2008
- * Markus Metzger <markus.t.metzger@intel.com>, Dec 2007
 */
+#ifdef CONFIG_X86_DS
 #include <asm/ds.h>
 #include <linux/errno.h>
 #include <linux/string.h>
 #include <linux/slab.h>
+#include <linux/sched.h>
+#include <linux/mm.h>
+/*
+ * The configuration for a particular DS hardware implementation.
+ */
+struct ds_configuration {
+        /* the size of the DS structure in bytes */
+        unsigned char  sizeof_ds;
+        /* the size of one pointer-typed field in the DS structure in bytes;
+           this covers the first 8 fields related to buffer management. */
+        unsigned char  sizeof_field;
+        /* the size of a BTS/PEBS record in bytes */
+        unsigned char  sizeof_rec[2];
+};
+static struct ds_configuration ds_cfg;
 /*
@@ -44,378 +67,747 @@
 *   (interrupt occurs when write pointer passes interrupt pointer)
 * - value to which counter is reset following counter overflow
 *
- * On later architectures, the last branch recording hardware uses
+ * Later architectures use 64bit pointers throughout, whereas earlier
- * 64bit pointers even in 32bit mode.
+ * architectures use 32bit pointers in 32bit mode.
- *
- *
- * Branch Trace Store (BTS) records store information about control
- * flow changes. They at least provide the following information:
- * - source linear address
- * - destination linear address
 *
- * Netburst supported a predicated bit that had been dropped in later
- * architectures. We do not suppor it.
 *
+ * We compute the base address for the first 8 fields based on:
+ * - the field size stored in the DS configuration
+ * - the relative field position
+ * - an offset giving the start of the respective region
 *
- * In order to abstract from the actual DS and BTS layout, we describe
+ * This offset is further used to index various arrays holding
- * the access to the relevant fields.
+ * information for BTS and PEBS at the respective index.
- * Thanks to Andi Kleen for proposing this design.
 *
- * The implementation, however, is not as general as it might seem. In
+ * On later 32bit processors, we only access the lower 32bit of the
- * order to stay somewhat simple and efficient, we assume an
+ * 64bit pointer fields. The upper halves will be zeroed out.
- * underlying unsigned type (mostly a pointer type) and we expect the
- * field to be at least as big as that type.
 */
-/*
+enum ds_field {
- * A special from_ip address to indicate that the BTS record is an
+        ds_buffer_base = 0,
- * info record that needs to be interpreted or skipped.
+        ds_index,
- */
+        ds_absolute_maximum,
-#define BTS_ESCAPE_ADDRESS (-1)
+        ds_interrupt_threshold,
+};
-/*
+enum ds_qualifier {
- * A field access descriptor
+        ds_bts  = 0,
- */
+        ds_pebs
-struct access_desc {
-        unsigned char offset;
-        unsigned char size;
 };
+static inline unsigned long ds_get(const unsigned char *base,
+                                   enum ds_qualifier qual, enum ds_field field)
+{
+        base += (ds_cfg.sizeof_field * (field + (4 * qual)));
+        return *(unsigned long *)base;
+}
+static inline void ds_set(unsigned char *base, enum ds_qualifier qual,
+                          enum ds_field field, unsigned long value)
+{
+        base += (ds_cfg.sizeof_field * (field + (4 * qual)));
+        (*(unsigned long *)base) = value;
+}
 /*
- * The configuration for a particular DS/BTS hardware implementation.
+ * Locking is done only for allocating BTS or PEBS resources and for
+ * guarding context and buffer memory allocation.
+ *
+ * Most functions require the current task to own the ds context part
+ * they are going to access. All the locking is done when validating
+ * access to the context.
 */
-struct ds_configuration {
+static spinlock_t ds_lock = __SPIN_LOCK_UNLOCKED(ds_lock);
-        /* the DS configuration */
-        unsigned char  sizeof_ds;
-        struct access_desc bts_buffer_base;
-        struct access_desc bts_index;
-        struct access_desc bts_absolute_maximum;
-        struct access_desc bts_interrupt_threshold;
-        /* the BTS configuration */
-        unsigned char  sizeof_bts;
-        struct access_desc from_ip;
-        struct access_desc to_ip;
-        /* BTS variants used to store additional information like
-           timestamps */
-        struct access_desc info_type;
-        struct access_desc info_data;
-        unsigned long debugctl_mask;
-};
 /*
- * The global configuration used by the below accessor functions
+ * Validate that the current task is allowed to access the BTS/PEBS
+ * buffer of the parameter task.
+ *
+ * Returns 0, if access is granted; -Eerrno, otherwise.
 */
-static struct ds_configuration ds_cfg;
+static inline int ds_validate_access(struct ds_context *context,
+                                     enum ds_qualifier qual)
+{
+        if (!context)
+                return -EPERM;
+        if (context->owner[qual] == current)
+                return 0;
+        return -EPERM;
+}
 /*
- * Accessor functions for some DS and BTS fields using the above
+ * We either support (system-wide) per-cpu or per-thread allocation.
- * global ptrace_bts_cfg.
+ * We distinguish the two based on the task_struct pointer, where a
+ * NULL pointer indicates per-cpu allocation for the current cpu.
+ *
+ * Allocations are use-counted. As soon as resources are allocated,
+ * further allocations must be of the same type (per-cpu or
+ * per-thread). We model this by counting allocations (i.e. the number
+ * of tracers of a certain type) for one type negatively:
+ *   =0  no tracers
+ *   >0  number of per-thread tracers
+ *   <0  number of per-cpu tracers
+ *
+ * The below functions to get and put tracers and to check the
+ * allocation type require the ds_lock to be held by the caller.
+ *
+ * Tracers essentially gives the number of ds contexts for a certain
+ * type of allocation.
 */
-static inline unsigned long get_bts_buffer_base(char *base)
+static long tracers;
+static inline void get_tracer(struct task_struct *task)
 {
-        return *(unsigned long *)(base + ds_cfg.bts_buffer_base.offset);
+        tracers += (task ? 1 : -1);
 }
-static inline void set_bts_buffer_base(char *base, unsigned long value)
+static inline void put_tracer(struct task_struct *task)
 {
-        (*(unsigned long *)(base + ds_cfg.bts_buffer_base.offset)) = value;
+        tracers -= (task ? 1 : -1);
 }
-static inline unsigned long get_bts_index(char *base)
+static inline int check_tracer(struct task_struct *task)
 {
-        return *(unsigned long *)(base + ds_cfg.bts_index.offset);
+        return (task ? (tracers >= 0) : (tracers <= 0));
 }
-static inline void set_bts_index(char *base, unsigned long value)
+/*
+ * The DS context is either attached to a thread or to a cpu:
+ * - in the former case, the thread_struct contains a pointer to the
+ *   attached context.
+ * - in the latter case, we use a static array of per-cpu context
+ *   pointers.
+ *
+ * Contexts are use-counted. They are allocated on first access and
+ * deallocated when the last user puts the context.
+ *
+ * We distinguish between an allocating and a non-allocating get of a
+ * context:
+ * - the allocating get is used for requesting BTS/PEBS resources. It
+ *   requires the caller to hold the global ds_lock.
+ * - the non-allocating get is used for all other cases. A
+ *   non-existing context indicates an error. It acquires and releases
+ *   the ds_lock itself for obtaining the context.
+ *
+ * A context and its DS configuration are allocated and deallocated
+ * together. A context always has a DS configuration of the
+ * appropriate size.
+ */
+static DEFINE_PER_CPU(struct ds_context *, system_context);
+#define this_system_context per_cpu(system_context, smp_processor_id())
+/*
+ * Returns the pointer to the parameter task's context or to the
+ * system-wide context, if task is NULL.
+ *
+ * Increases the use count of the returned context, if not NULL.
+ */
+static inline struct ds_context *ds_get_context(struct task_struct *task)
 {
-        (*(unsigned long *)(base + ds_cfg.bts_index.offset)) = value;
+        struct ds_context *context;
+        spin_lock(&ds_lock);
+        context = (task ? task->thread.ds_ctx : this_system_context);
+        if (context)
+                context->count++;
+        spin_unlock(&ds_lock);
+        return context;
 }
-static inline unsigned long get_bts_absolute_maximum(char *base)
+/*
+ * Same as ds_get_context, but allocates the context and it's DS
+ * structure, if necessary; returns NULL; if out of memory.
+ *
+ * pre: requires ds_lock to be held
+ */
+static inline struct ds_context *ds_alloc_context(struct task_struct *task)
 {
-        return *(unsigned long *)(base + ds_cfg.bts_absolute_maximum.offset);
+        struct ds_context **p_context =
+                (task ? &task->thread.ds_ctx : &this_system_context);
+        struct ds_context *context = *p_context;
+        if (!context) {
+                context = kzalloc(sizeof(*context), GFP_KERNEL);
+                if (!context)
+                        return NULL;
+                context->ds = kzalloc(ds_cfg.sizeof_ds, GFP_KERNEL);
+                if (!context->ds) {
+                        kfree(context);
+                        return NULL;
+                }
+                *p_context = context;
+                context->this = p_context;
+                context->task = task;
+                if (task)
+                        set_tsk_thread_flag(task, TIF_DS_AREA_MSR);
+                if (!task || (task == current))
+                        wrmsr(MSR_IA32_DS_AREA, (unsigned long)context->ds, 0);
+                get_tracer(task);
+        }
+        context->count++;
+        return context;
 }
-static inline void set_bts_absolute_maximum(char *base, unsigned long value)
+/*
+ * Decreases the use count of the parameter context, if not NULL.
+ * Deallocates the context, if the use count reaches zero.
+ */
+static inline void ds_put_context(struct ds_context *context)
 {
-        (*(unsigned long *)(base + ds_cfg.bts_absolute_maximum.offset)) = value;
+        if (!context)
+                return;
+        spin_lock(&ds_lock);
+        if (--context->count)
+                goto out;
+        *(context->this) = NULL;
+        if (context->task)
+                clear_tsk_thread_flag(context->task, TIF_DS_AREA_MSR);
+        if (!context->task || (context->task == current))
+                wrmsrl(MSR_IA32_DS_AREA, 0);
+        put_tracer(context->task);
+        /* free any leftover buffers from tracers that did not
+         * deallocate them properly. */
+        kfree(context->buffer[ds_bts]);
+        kfree(context->buffer[ds_pebs]);
+        kfree(context->ds);
+        kfree(context);
+ out:
+        spin_unlock(&ds_lock);
 }
-static inline unsigned long get_bts_interrupt_threshold(char *base)
+/*
+ * Handle a buffer overflow
+ *
+ * task: the task whose buffers are overflowing;
+ *       NULL for a buffer overflow on the current cpu
+ * context: the ds context
+ * qual: the buffer type
+ */
+static void ds_overflow(struct task_struct *task, struct ds_context *context,
+                        enum ds_qualifier qual)
 {
-        return *(unsigned long *)(base + ds_cfg.bts_interrupt_threshold.offset);
+        if (!context)
+                return;
+        if (context->callback[qual])
+                (*context->callback[qual])(task);
+        /* todo: do some more overflow handling */
 }
-static inline void set_bts_interrupt_threshold(char *base, unsigned long value)
+/*
+ * Allocate a non-pageable buffer of the parameter size.
+ * Checks the memory and the locked memory rlimit.
+ *
+ * Returns the buffer, if successful;
+ *         NULL, if out of memory or rlimit exceeded.
+ *
+ * size: the requested buffer size in bytes
+ * pages (out): if not NULL, contains the number of pages reserved
+ */
+static inline void *ds_allocate_buffer(size_t size, unsigned int *pages)
 {
-        (*(unsigned long *)(base + ds_cfg.bts_interrupt_threshold.offset)) = value;
+        unsigned long rlim, vm, pgsz;
+        void *buffer;
+        pgsz = PAGE_ALIGN(size) >> PAGE_SHIFT;
+        rlim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
+        vm   = current->mm->total_vm  + pgsz;
+        if (rlim < vm)
+                return NULL;
+        rlim = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
+        vm   = current->mm->locked_vm  + pgsz;
+        if (rlim < vm)
+                return NULL;
+        buffer = kzalloc(size, GFP_KERNEL);
+        if (!buffer)
+                return NULL;
+        current->mm->total_vm  += pgsz;
+        current->mm->locked_vm += pgsz;
+        if (pages)
+                *pages = pgsz;
+        return buffer;
 }
-static inline unsigned long get_from_ip(char *base)
+static int ds_request(struct task_struct *task, void *base, size_t size,
+                      ds_ovfl_callback_t ovfl, enum ds_qualifier qual)
 {
-        return *(unsigned long *)(base + ds_cfg.from_ip.offset);
+        struct ds_context *context;
+        unsigned long buffer, adj;
+        const unsigned long alignment = (1 << 3);
+        int error = 0;
+        if (!ds_cfg.sizeof_ds)
+                return -EOPNOTSUPP;
+        /* we require some space to do alignment adjustments below */
+        if (size < (alignment + ds_cfg.sizeof_rec[qual]))
+                return -EINVAL;
+        /* buffer overflow notification is not yet implemented */
+        if (ovfl)
+                return -EOPNOTSUPP;
+        spin_lock(&ds_lock);
+        if (!check_tracer(task))
+                return -EPERM;
+        error = -ENOMEM;
+        context = ds_alloc_context(task);
+        if (!context)
+                goto out_unlock;
+        error = -EALREADY;
+        if (context->owner[qual] == current)
+                goto out_unlock;
+        error = -EPERM;
+        if (context->owner[qual] != NULL)
+                goto out_unlock;
+        context->owner[qual] = current;
+        spin_unlock(&ds_lock);
+        error = -ENOMEM;
+        if (!base) {
+                base = ds_allocate_buffer(size, &context->pages[qual]);
+                if (!base)
+                        goto out_release;
+                context->buffer[qual]   = base;
+        }
+        error = 0;
+        context->callback[qual] = ovfl;
+        /* adjust the buffer address and size to meet alignment
+         * constraints:
+         * - buffer is double-word aligned
+         * - size is multiple of record size
+         *
+         * We checked the size at the very beginning; we have enough
+         * space to do the adjustment.
+         */
+        buffer = (unsigned long)base;
+        adj = ALIGN(buffer, alignment) - buffer;
+        buffer += adj;
+        size   -= adj;
+        size /= ds_cfg.sizeof_rec[qual];
+        size *= ds_cfg.sizeof_rec[qual];
+        ds_set(context->ds, qual, ds_buffer_base, buffer);
+        ds_set(context->ds, qual, ds_index, buffer);
+        ds_set(context->ds, qual, ds_absolute_maximum, buffer + size);
+        if (ovfl) {
+                /* todo: select a suitable interrupt threshold */
+        } else
+                ds_set(context->ds, qual,
+                       ds_interrupt_threshold, buffer + size + 1);
+        /* we keep the context until ds_release */
+        return error;
+ out_release:
+        context->owner[qual] = NULL;
+        ds_put_context(context);
+        return error;
+ out_unlock:
+        spin_unlock(&ds_lock);
+        ds_put_context(context);
+        return error;
 }
-static inline void set_from_ip(char *base, unsigned long value)
+int ds_request_bts(struct task_struct *task, void *base, size_t size,
+                   ds_ovfl_callback_t ovfl)
 {
-        (*(unsigned long *)(base + ds_cfg.from_ip.offset)) = value;
+        return ds_request(task, base, size, ovfl, ds_bts);
 }
-static inline unsigned long get_to_ip(char *base)
+int ds_request_pebs(struct task_struct *task, void *base, size_t size,
+                    ds_ovfl_callback_t ovfl)
 {
-        return *(unsigned long *)(base + ds_cfg.to_ip.offset);
+        return ds_request(task, base, size, ovfl, ds_pebs);
 }
-static inline void set_to_ip(char *base, unsigned long value)
+static int ds_release(struct task_struct *task, enum ds_qualifier qual)
 {
-        (*(unsigned long *)(base + ds_cfg.to_ip.offset)) = value;
+        struct ds_context *context;
+        int error;
+        context = ds_get_context(task);
+        error = ds_validate_access(context, qual);
+        if (error < 0)
+                goto out;
+        kfree(context->buffer[qual]);
+        context->buffer[qual] = NULL;
+        current->mm->total_vm  -= context->pages[qual];
+        current->mm->locked_vm -= context->pages[qual];
+        context->pages[qual] = 0;
+        context->owner[qual] = NULL;
+        /*
+         * we put the context twice:
+         *   once for the ds_get_context
+         *   once for the corresponding ds_request
+         */
+        ds_put_context(context);
+ out:
+        ds_put_context(context);
+        return error;
 }
-static inline unsigned char get_info_type(char *base)
+int ds_release_bts(struct task_struct *task)
 {
-        return *(unsigned char *)(base + ds_cfg.info_type.offset);
+        return ds_release(task, ds_bts);
 }
-static inline void set_info_type(char *base, unsigned char value)
+int ds_release_pebs(struct task_struct *task)
 {
-        (*(unsigned char *)(base + ds_cfg.info_type.offset)) = value;
+        return ds_release(task, ds_pebs);
 }
-static inline unsigned long get_info_data(char *base)
+static int ds_get_index(struct task_struct *task, size_t *pos,
+                        enum ds_qualifier qual)
 {
-        return *(unsigned long *)(base + ds_cfg.info_data.offset);
+        struct ds_context *context;
+        unsigned long base, index;
+        int error;
+        context = ds_get_context(task);
+        error = ds_validate_access(context, qual);
+        if (error < 0)
+                goto out;
+        base  = ds_get(context->ds, qual, ds_buffer_base);
+        index = ds_get(context->ds, qual, ds_index);
+        error = ((index - base) / ds_cfg.sizeof_rec[qual]);
+        if (pos)
+                *pos = error;
+ out:
+        ds_put_context(context);
+        return error;
 }
-static inline void set_info_data(char *base, unsigned long value)
+int ds_get_bts_index(struct task_struct *task, size_t *pos)
 {
-        (*(unsigned long *)(base + ds_cfg.info_data.offset)) = value;
+        return ds_get_index(task, pos, ds_bts);
 }
+int ds_get_pebs_index(struct task_struct *task, size_t *pos)
+{
+        return ds_get_index(task, pos, ds_pebs);
+}
-int ds_allocate(void **dsp, size_t bts_size_in_bytes)
+static int ds_get_end(struct task_struct *task, size_t *pos,
+                      enum ds_qualifier qual)
 {
-        size_t bts_size_in_records;
+        struct ds_context *context;
-        unsigned long bts;
+        unsigned long base, end;
-        void *ds;
+        int error;
+        context = ds_get_context(task);
+        error = ds_validate_access(context, qual);
+        if (error < 0)
+                goto out;
+        base = ds_get(context->ds, qual, ds_buffer_base);
+        end  = ds_get(context->ds, qual, ds_absolute_maximum);
+        error = ((end - base) / ds_cfg.sizeof_rec[qual]);
+        if (pos)
+                *pos = error;
+ out:
+        ds_put_context(context);
+        return error;
+}
-        if (!ds_cfg.sizeof_ds || !ds_cfg.sizeof_bts)
+int ds_get_bts_end(struct task_struct *task, size_t *pos)
-                return -EOPNOTSUPP;
+{
+        return ds_get_end(task, pos, ds_bts);
+}
-        if (bts_size_in_bytes < 0)
+int ds_get_pebs_end(struct task_struct *task, size_t *pos)
-                return -EINVAL;
+{
+        return ds_get_end(task, pos, ds_pebs);
+}
-        bts_size_in_records =
+static int ds_access(struct task_struct *task, size_t index,
-                bts_size_in_bytes / ds_cfg.sizeof_bts;
+                     const void **record, enum ds_qualifier qual)
-        bts_size_in_bytes =
+{
-                bts_size_in_records * ds_cfg.sizeof_bts;
+        struct ds_context *context;
+        unsigned long base, idx;
+        int error;
-        if (bts_size_in_bytes <= 0)
+        if (!record)
                return -EINVAL;
-        bts = (unsigned long)kzalloc(bts_size_in_bytes, GFP_KERNEL);
+        context = ds_get_context(task);
+        error = ds_validate_access(context, qual);
-        if (!bts)
+        if (error < 0)
-                return -ENOMEM;
+                goto out;
-        ds = kzalloc(ds_cfg.sizeof_ds, GFP_KERNEL);
+        base = ds_get(context->ds, qual, ds_buffer_base);
+        idx = base + (index * ds_cfg.sizeof_rec[qual]);
-        if (!ds) {
+        error = -EINVAL;
-                kfree((void *)bts);
+        if (idx > ds_get(context->ds, qual, ds_absolute_maximum))
-                return -ENOMEM;
+                goto out;
-        }
-        set_bts_buffer_base(ds, bts);
-        set_bts_index(ds, bts);
-        set_bts_absolute_maximum(ds, bts + bts_size_in_bytes);
-        set_bts_interrupt_threshold(ds, bts + bts_size_in_bytes + 1);
-        *dsp = ds;
+        *record = (const void *)idx;
-        return 0;
+        error = ds_cfg.sizeof_rec[qual];
+ out:
+        ds_put_context(context);
+        return error;
 }
-int ds_free(void **dsp)
+int ds_access_bts(struct task_struct *task, size_t index, const void **record)
 {
-        if (*dsp) {
+        return ds_access(task, index, record, ds_bts);
-                kfree((void *)get_bts_buffer_base(*dsp));
-                kfree(*dsp);
-                *dsp = NULL;
-        }
-        return 0;
 }
-int ds_get_bts_size(void *ds)
+int ds_access_pebs(struct task_struct *task, size_t index, const void **record)
 {
-        int size_in_bytes;
+        return ds_access(task, index, record, ds_pebs);
-        if (!ds_cfg.sizeof_ds || !ds_cfg.sizeof_bts)
-                return -EOPNOTSUPP;
-        if (!ds)
-                return 0;
-        size_in_bytes =
-                get_bts_absolute_maximum(ds) -
-                get_bts_buffer_base(ds);
-        return size_in_bytes;
 }
-int ds_get_bts_end(void *ds)
+static int ds_write(struct task_struct *task, const void *record, size_t size,
+                    enum ds_qualifier qual, int force)
 {
-        int size_in_bytes = ds_get_bts_size(ds);
+        struct ds_context *context;
+        int error;
-        if (size_in_bytes <= 0)
-                return size_in_bytes;
-        return size_in_bytes / ds_cfg.sizeof_bts;
+        if (!record)
-}
+                return -EINVAL;
-int ds_get_bts_index(void *ds)
+        error = -EPERM;
-{
+        context = ds_get_context(task);
-        int index_offset_in_bytes;
+        if (!context)
+                goto out;
-        if (!ds_cfg.sizeof_ds || !ds_cfg.sizeof_bts)
+        if (!force) {
-                return -EOPNOTSUPP;
+                error = ds_validate_access(context, qual);
+                if (error < 0)
+                        goto out;
+        }
-        index_offset_in_bytes =
+        error = 0;
-                get_bts_index(ds) -
+        while (size) {
-                get_bts_buffer_base(ds);
+                unsigned long base, index, end, write_end, int_th;
+                unsigned long write_size, adj_write_size;
+                /*
+                 * write as much as possible without producing an
+                 * overflow interrupt.
+                 *
+                 * interrupt_threshold must either be
+                 * - bigger than absolute_maximum or
+                 * - point to a record between buffer_base and absolute_maximum
+                 *
+                 * index points to a valid record.
+                 */
+                base   = ds_get(context->ds, qual, ds_buffer_base);
+                index  = ds_get(context->ds, qual, ds_index);
+                end    = ds_get(context->ds, qual, ds_absolute_maximum);
+                int_th = ds_get(context->ds, qual, ds_interrupt_threshold);
+                write_end = min(end, int_th);
+                /* if we are already beyond the interrupt threshold,
+                 * we fill the entire buffer */
+                if (write_end <= index)
+                        write_end = end;
+                if (write_end <= index)
+                        goto out;
+                write_size = min((unsigned long) size, write_end - index);
+                memcpy((void *)index, record, write_size);
+                record = (const char *)record + write_size;
+                size  -= write_size;
+                error += write_size;
+                adj_write_size = write_size / ds_cfg.sizeof_rec[qual];
+                adj_write_size *= ds_cfg.sizeof_rec[qual];
+                /* zero out trailing bytes */
+                memset((char *)index + write_size, 0,
+                       adj_write_size - write_size);
+                index += adj_write_size;
+                if (index >= end)
+                        index = base;
+                ds_set(context->ds, qual, ds_index, index);
+                if (index >= int_th)
+                        ds_overflow(task, context, qual);
+        }
-        return index_offset_in_bytes / ds_cfg.sizeof_bts;
+ out:
+        ds_put_context(context);
+        return error;
 }
-int ds_set_overflow(void *ds, int method)
+int ds_write_bts(struct task_struct *task, const void *record, size_t size)
 {
-        switch (method) {
+        return ds_write(task, record, size, ds_bts, /* force = */ 0);
-        case DS_O_SIGNAL:
-                return -EOPNOTSUPP;
-        case DS_O_WRAP:
-                return 0;
-        default:
-                return -EINVAL;
-        }
 }
-int ds_get_overflow(void *ds)
+int ds_write_pebs(struct task_struct *task, const void *record, size_t size)
 {
-        return DS_O_WRAP;
+        return ds_write(task, record, size, ds_pebs, /* force = */ 0);
 }
-int ds_clear(void *ds)
+int ds_unchecked_write_bts(struct task_struct *task,
+                           const void *record, size_t size)
 {
-        int bts_size = ds_get_bts_size(ds);
+        return ds_write(task, record, size, ds_bts, /* force = */ 1);
-        unsigned long bts_base;
-        if (bts_size <= 0)
-                return bts_size;
-        bts_base = get_bts_buffer_base(ds);
-        memset((void *)bts_base, 0, bts_size);
-        set_bts_index(ds, bts_base);
-        return 0;
 }
-int ds_read_bts(void *ds, int index, struct bts_struct *out)
+int ds_unchecked_write_pebs(struct task_struct *task,
+                            const void *record, size_t size)
 {
-        void *bts;
+        return ds_write(task, record, size, ds_pebs, /* force = */ 1);
+}
-        if (!ds_cfg.sizeof_ds || !ds_cfg.sizeof_bts)
+static int ds_reset_or_clear(struct task_struct *task,
-                return -EOPNOTSUPP;
+                             enum ds_qualifier qual, int clear)
+{
+        struct ds_context *context;
+        unsigned long base, end;
+        int error;
-        if (index < 0)
+        context = ds_get_context(task);
-                return -EINVAL;
+        error = ds_validate_access(context, qual);
+        if (error < 0)
+                goto out;
-        if (index >= ds_get_bts_size(ds))
+        base = ds_get(context->ds, qual, ds_buffer_base);
-                return -EINVAL;
+        end  = ds_get(context->ds, qual, ds_absolute_maximum);
-        bts = (void *)(get_bts_buffer_base(ds) + (index * ds_cfg.sizeof_bts));
+        if (clear)
+                memset((void *)base, 0, end - base);
-        memset(out, 0, sizeof(*out));
+        ds_set(context->ds, qual, ds_index, base);
-        if (get_from_ip(bts) == BTS_ESCAPE_ADDRESS) {
-                out->qualifier       = get_info_type(bts);
-                out->variant.jiffies = get_info_data(bts);
-        } else {
-                out->qualifier = BTS_BRANCH;
-                out->variant.lbr.from_ip = get_from_ip(bts);
-                out->variant.lbr.to_ip   = get_to_ip(bts);
-        }
-        return sizeof(*out);;
+        error = 0;
+ out:
+        ds_put_context(context);
+        return error;
 }
-int ds_write_bts(void *ds, const struct bts_struct *in)
+int ds_reset_bts(struct task_struct *task)
 {
-        unsigned long bts;
+        return ds_reset_or_clear(task, ds_bts, /* clear = */ 0);
+}
-        if (!ds_cfg.sizeof_ds || !ds_cfg.sizeof_bts)
-                return -EOPNOTSUPP;
-        if (ds_get_bts_size(ds) <= 0)
-                return -ENXIO;
-        bts = get_bts_index(ds);
+int ds_reset_pebs(struct task_struct *task)
+{
+        return ds_reset_or_clear(task, ds_pebs, /* clear = */ 0);
+}
-        memset((void *)bts, 0, ds_cfg.sizeof_bts);
+int ds_clear_bts(struct task_struct *task)
-        switch (in->qualifier) {
+{
-        case BTS_INVALID:
+        return ds_reset_or_clear(task, ds_bts, /* clear = */ 1);
-                break;
+}
-        case BTS_BRANCH:
+int ds_clear_pebs(struct task_struct *task)
-                set_from_ip((void *)bts, in->variant.lbr.from_ip);
+{
-                set_to_ip((void *)bts, in->variant.lbr.to_ip);
+        return ds_reset_or_clear(task, ds_pebs, /* clear = */ 1);
-                break;
+}
-        case BTS_TASK_ARRIVES:
+int ds_get_pebs_reset(struct task_struct *task, u64 *value)
-        case BTS_TASK_DEPARTS:
+{
-                set_from_ip((void *)bts, BTS_ESCAPE_ADDRESS);
+        struct ds_context *context;
-                set_info_type((void *)bts, in->qualifier);
+        int error;
-                set_info_data((void *)bts, in->variant.jiffies);
-                break;
-        default:
+        if (!value)
                return -EINVAL;
-        }
-        bts = bts + ds_cfg.sizeof_bts;
+        context = ds_get_context(task);
-        if (bts >= get_bts_absolute_maximum(ds))
+        error = ds_validate_access(context, ds_pebs);
-                bts = get_bts_buffer_base(ds);
+        if (error < 0)
-        set_bts_index(ds, bts);
+                goto out;
-        return ds_cfg.sizeof_bts;
+        *value = *(u64 *)(context->ds + (ds_cfg.sizeof_field * 8));
+        error = 0;
+ out:
+        ds_put_context(context);
+        return error;
 }
-unsigned long ds_debugctl_mask(void)
+int ds_set_pebs_reset(struct task_struct *task, u64 value)
 {
-        return ds_cfg.debugctl_mask;
+        struct ds_context *context;
-}
+        int error;
-#ifdef __i386__
+        context = ds_get_context(task);
-static const struct ds_configuration ds_cfg_netburst = {
+        error = ds_validate_access(context, ds_pebs);
-        .sizeof_ds = 9 * 4,
+        if (error < 0)
-        .bts_buffer_base = { 0, 4 },
+                goto out;
-        .bts_index = { 4, 4 },
-        .bts_absolute_maximum = { 8, 4 },
-        .bts_interrupt_threshold = { 12, 4 },
-        .sizeof_bts = 3 * 4,
-        .from_ip = { 0, 4 },
-        .to_ip = { 4, 4 },
-        .info_type = { 4, 1 },
-        .info_data = { 8, 4 },
-        .debugctl_mask = (1<<2)|(1<<3)
-};
-static const struct ds_configuration ds_cfg_pentium_m = {
+        *(u64 *)(context->ds + (ds_cfg.sizeof_field * 8)) = value;
-        .sizeof_ds = 9 * 4,
-        .bts_buffer_base = { 0, 4 },
+        error = 0;
-        .bts_index = { 4, 4 },
+ out:
-        .bts_absolute_maximum = { 8, 4 },
+        ds_put_context(context);
-        .bts_interrupt_threshold = { 12, 4 },
+        return error;
-        .sizeof_bts = 3 * 4,
+}
-        .from_ip = { 0, 4 },
-        .to_ip = { 4, 4 },
+static const struct ds_configuration ds_cfg_var = {
-        .info_type = { 4, 1 },
+        .sizeof_ds    = sizeof(long) * 12,
-        .info_data = { 8, 4 },
+        .sizeof_field = sizeof(long),
-        .debugctl_mask = (1<<6)|(1<<7)
+        .sizeof_rec[ds_bts]   = sizeof(long) * 3,
+        .sizeof_rec[ds_pebs]  = sizeof(long) * 10
 };
-#endif /* _i386_ */
+static const struct ds_configuration ds_cfg_64 = {
+        .sizeof_ds    = 8 * 12,
-static const struct ds_configuration ds_cfg_core2 = {
+        .sizeof_field = 8,
-        .sizeof_ds = 9 * 8,
+        .sizeof_rec[ds_bts]   = 8 * 3,
-        .bts_buffer_base = { 0, 8 },
+        .sizeof_rec[ds_pebs]  = 8 * 10
-        .bts_index = { 8, 8 },
-        .bts_absolute_maximum = { 16, 8 },
-        .bts_interrupt_threshold = { 24, 8 },
-        .sizeof_bts = 3 * 8,
-        .from_ip = { 0, 8 },
-        .to_ip = { 8, 8 },
-        .info_type = { 8, 1 },
-        .info_data = { 16, 8 },
-        .debugctl_mask = (1<<6)|(1<<7)|(1<<9)
 };
 static inline void
@@ -429,14 +821,13 @@ void __cpuinit ds_init_intel(struct cpuinfo_x86 *c)
        switch (c->x86) {
        case 0x6:
                switch (c->x86_model) {
-#ifdef __i386__
                case 0xD:
                case 0xE: /* Pentium M */
-                        ds_configure(&ds_cfg_pentium_m);
+                        ds_configure(&ds_cfg_var);
                        break;
-#endif /* _i386_ */
                case 0xF: /* Core2 */
-                        ds_configure(&ds_cfg_core2);
+                case 0x1C: /* Atom */
+                        ds_configure(&ds_cfg_64);
                        break;
                default:
                        /* sorry, don't know about them */
@@ -445,13 +836,11 @@ void __cpuinit ds_init_intel(struct cpuinfo_x86 *c)
                break;
        case 0xF:
                switch (c->x86_model) {
-#ifdef __i386__
                case 0x0:
                case 0x1:
                case 0x2: /* Netburst */
-                        ds_configure(&ds_cfg_netburst);
+                        ds_configure(&ds_cfg_var);
                        break;
-#endif /* _i386_ */
                default:
                        /* sorry, don't know about them */
                        break;
@@ -462,3 +851,14 @@ void __cpuinit ds_init_intel(struct cpuinfo_x86 *c)
                break;
        }
 }
+void ds_free(struct ds_context *context)
+{
+        /* This is called when the task owning the parameter context
+         * is dying. There should not be any user of that context left
+         * to disturb us, anymore. */
+        unsigned long leftovers = context->count;
+        while (leftovers--)
+                ds_put_context(context);
+}
+#endif /* CONFIG_X86_DS */
diff --git a/arch/x86/kernel/efi.c b/arch/x86/kernel/efi.c
index 06cc8d4254b1..945a31cdd81f 100644
--- a/arch/x86/kernel/efi.c
+++ b/arch/x86/kernel/efi.c
@@ -414,9 +414,11 @@ void __init efi_init(void)
        if (memmap.map == NULL)
                printk(KERN_ERR "Could not map the EFI memory map!\n");
        memmap.map_end = memmap.map + (memmap.nr_map * memmap.desc_size);
        if (memmap.desc_size != sizeof(efi_memory_desc_t))
-                printk(KERN_WARNING "Kernel-defined memdesc"
+                printk(KERN_WARNING
-                       "doesn't match the one from EFI!\n");
+                  "Kernel-defined memdesc doesn't match the one from EFI!\n");
        if (add_efi_memmap)
                do_add_efi_memmap();
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index 89434d439605..cf3a0b2d0059 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -275,9 +275,9 @@ ENTRY(native_usergs_sysret64)
 ENTRY(ret_from_fork)
        CFI_DEFAULT_STACK
        push kernel_eflags(%rip)
-        CFI_ADJUST_CFA_OFFSET 4
+        CFI_ADJUST_CFA_OFFSET 8
        popf                            # reset kernel eflags
-        CFI_ADJUST_CFA_OFFSET -4
+        CFI_ADJUST_CFA_OFFSET -8
        call schedule_tail
        GET_THREAD_INFO(%rcx)
        testl $(_TIF_SYSCALL_TRACE|_TIF_SYSCALL_AUDIT),TI_flags(%rcx)
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index 9bfc4d72fb2e..d16084f90649 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -108,12 +108,11 @@ void __init x86_64_start_kernel(char * real_mode_data)
        }
        load_idt((const struct desc_ptr *)&idt_descr);
-        early_printk("Kernel alive\n");
+        if (console_loglevel == 10)
+                early_printk("Kernel alive\n");
        x86_64_init_pda();
-        early_printk("Kernel really alive\n");
        x86_64_start_reservations(real_mode_data);
 }
diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
index 50e5e4a31c85..191914302744 100644
--- a/arch/x86/kernel/ioport.c
+++ b/arch/x86/kernel/ioport.c
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/thread_info.h>
 #include <linux/syscalls.h>
+#include <asm/syscalls.h>
 /* Set EXTENT bits starting at BASE in BITMAP to value TURN_ON. */
 static void set_bitmap(unsigned long *bitmap, unsigned int base,
diff --git a/arch/x86/kernel/ipi.c b/arch/x86/kernel/ipi.c
index 3f7537b669d3..f1c688e46f35 100644
--- a/arch/x86/kernel/ipi.c
+++ b/arch/x86/kernel/ipi.c
@@ -20,6 +20,8 @@
 #ifdef CONFIG_X86_32
 #include <mach_apic.h>
+#include <mach_ipi.h>
 /*
 * the following functions deal with sending IPIs between CPUs.
 *
@@ -147,7 +149,6 @@ void send_IPI_mask_sequence(cpumask_t mask, int vector)
 }
 /* must come after the send_IPI functions above for inlining */
-#include <mach_ipi.h>
 static int convert_apicid_to_cpu(int apic_id)
 {
        int i;
diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
index 1cf8c1fcc088..b71e02d42f4f 100644
--- a/arch/x86/kernel/irq_32.c
+++ b/arch/x86/kernel/irq_32.c
@@ -325,7 +325,7 @@ skip:
                for_each_online_cpu(j)
                        seq_printf(p, "%10u ",
                                per_cpu(irq_stat,j).irq_call_count);
-                seq_printf(p, "  function call interrupts\n");
+                seq_printf(p, "  Function call interrupts\n");
                seq_printf(p, "TLB: ");
                for_each_online_cpu(j)
                        seq_printf(p, "%10u ",
diff --git a/arch/x86/kernel/irq_64.c b/arch/x86/kernel/irq_64.c
index 1f78b238d8d2..f065fe9071b9 100644
--- a/arch/x86/kernel/irq_64.c
+++ b/arch/x86/kernel/irq_64.c
@@ -129,7 +129,7 @@ skip:
                seq_printf(p, "CAL: ");
                for_each_online_cpu(j)
                        seq_printf(p, "%10u ", cpu_pda(j)->irq_call_count);
-                seq_printf(p, "  function call interrupts\n");
+                seq_printf(p, "  Function call interrupts\n");
                seq_printf(p, "TLB: ");
                for_each_online_cpu(j)
                        seq_printf(p, "%10u ", cpu_pda(j)->irq_tlb_count);
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 8b7a3cf37d2b..478bca986eca 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -178,7 +178,7 @@ static void kvm_flush_tlb(void)
        kvm_deferred_mmu_op(&ftlb, sizeof ftlb);
 }
-static void kvm_release_pt(u32 pfn)
+static void kvm_release_pt(unsigned long pfn)
 {
        struct kvm_mmu_op_release_pt rpt = {
                .header.op = KVM_MMU_OP_RELEASE_PT,
diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
index b68e21f06f4f..0ed5f939b905 100644
--- a/arch/x86/kernel/ldt.c
+++ b/arch/x86/kernel/ldt.c
@@ -18,6 +18,7 @@
 #include <asm/ldt.h>
 #include <asm/desc.h>
 #include <asm/mmu_context.h>
+#include <asm/syscalls.h>
 #ifdef CONFIG_SMP
 static void flush_ldt(void *current_mm)
diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
index abb78a2cc4ad..2c97f07f1c2c 100644
--- a/arch/x86/kernel/nmi.c
+++ b/arch/x86/kernel/nmi.c
@@ -299,6 +299,15 @@ void acpi_nmi_disable(void)
                on_each_cpu(__acpi_nmi_disable, NULL, 1);
 }
+/*
+ * This function is called as soon the LAPIC NMI watchdog driver has everything
+ * in place and it's ready to check if the NMIs belong to the NMI watchdog
+ */
+void cpu_nmi_set_wd_enabled(void)
+{
+        __get_cpu_var(wd_enabled) = 1;
+}
 void setup_apic_nmi_watchdog(void *unused)
 {
        if (__get_cpu_var(wd_enabled))
@@ -311,8 +320,6 @@ void setup_apic_nmi_watchdog(void *unused)
        switch (nmi_watchdog) {
        case NMI_LOCAL_APIC:
-                 /* enable it before to avoid race with handler */
-                __get_cpu_var(wd_enabled) = 1;
                if (lapic_watchdog_init(nmi_hz) < 0) {
                        __get_cpu_var(wd_enabled) = 0;
                        return;
diff --git a/arch/x86/kernel/olpc.c b/arch/x86/kernel/olpc.c
index 3e6672274807..7a13fac63a1f 100644
--- a/arch/x86/kernel/olpc.c
+++ b/arch/x86/kernel/olpc.c
@@ -190,12 +190,12 @@ EXPORT_SYMBOL_GPL(olpc_ec_cmd);
 static void __init platform_detect(void)
 {
        size_t propsize;
-        u32 rev;
+        __be32 rev;
        if (ofw("getprop", 4, 1, NULL, "board-revision-int", &rev, 4,
                        &propsize) || propsize != 4) {
                printk(KERN_ERR "ofw: getprop call failed!\n");
-                rev = 0;
+                rev = cpu_to_be32(0);
        }
        olpc_platform_info.boardrev = be32_to_cpu(rev);
 }
@@ -203,7 +203,7 @@ static void __init platform_detect(void)
 static void __init platform_detect(void)
 {
        /* stopgap until OFW support is added to the kernel */
-        olpc_platform_info.boardrev = be32_to_cpu(0xc2);
+        olpc_platform_info.boardrev = 0xc2;
 }
 #endif
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index 300da17e61cb..e2f43768723a 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -330,6 +330,7 @@ struct pv_cpu_ops pv_cpu_ops = {
 #endif
        .wbinvd = native_wbinvd,
        .read_msr = native_read_msr_safe,
+        .read_msr_amd = native_read_msr_amd_safe,
        .write_msr = native_write_msr_safe,
        .read_tsc = native_read_tsc,
        .read_pmc = native_read_pmc,
diff --git a/arch/x86/kernel/paravirt_patch_32.c b/arch/x86/kernel/paravirt_patch_32.c
index 58262218781b..9fe644f4861d 100644
--- a/arch/x86/kernel/paravirt_patch_32.c
+++ b/arch/x86/kernel/paravirt_patch_32.c
@@ -23,7 +23,7 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
                        start = start_##ops##_##x;              \
                        end = end_##ops##_##x;                  \
                        goto patch_site
-        switch(type) {
+        switch (type) {
                PATCH_SITE(pv_irq_ops, irq_disable);
                PATCH_SITE(pv_irq_ops, irq_enable);
                PATCH_SITE(pv_irq_ops, restore_fl);
diff --git a/arch/x86/kernel/pci-dma.c b/arch/x86/kernel/pci-dma.c
index 87d4d6964ec2..f704cb51ff82 100644
--- a/arch/x86/kernel/pci-dma.c
+++ b/arch/x86/kernel/pci-dma.c
@@ -82,7 +82,7 @@ void __init dma32_reserve_bootmem(void)
         * using 512M as goal
         */
        align = 64ULL<<20;
-        size = round_up(dma32_bootmem_size, align);
+        size = roundup(dma32_bootmem_size, align);
        dma32_bootmem_ptr = __alloc_bootmem_nopanic(size, align,
                                 512ULL<<20);
        if (dma32_bootmem_ptr)
diff --git a/arch/x86/kernel/pci-gart_64.c b/arch/x86/kernel/pci-gart_64.c
index 49285f8fd4d5..1a895a582534 100644
--- a/arch/x86/kernel/pci-gart_64.c
+++ b/arch/x86/kernel/pci-gart_64.c
@@ -82,7 +82,8 @@ AGPEXTERN __u32 *agp_gatt_table;
 static unsigned long next_bit;  /* protected by iommu_bitmap_lock */
 static int need_flush;          /* global flush state. set for each gart wrap */
-static unsigned long alloc_iommu(struct device *dev, int size)
+static unsigned long alloc_iommu(struct device *dev, int size,
+                                 unsigned long align_mask)
 {
        unsigned long offset, flags;
        unsigned long boundary_size;
@@ -90,16 +91,17 @@ static unsigned long alloc_iommu(struct device *dev, int size)
        base_index = ALIGN(iommu_bus_base & dma_get_seg_boundary(dev),
                           PAGE_SIZE) >> PAGE_SHIFT;
-        boundary_size = ALIGN(dma_get_seg_boundary(dev) + 1,
+        boundary_size = ALIGN((unsigned long long)dma_get_seg_boundary(dev) + 1,
                              PAGE_SIZE) >> PAGE_SHIFT;
        spin_lock_irqsave(&iommu_bitmap_lock, flags);
        offset = iommu_area_alloc(iommu_gart_bitmap, iommu_pages, next_bit,
-                                  size, base_index, boundary_size, 0);
+                                  size, base_index, boundary_size, align_mask);
        if (offset == -1) {
                need_flush = 1;
                offset = iommu_area_alloc(iommu_gart_bitmap, iommu_pages, 0,
-                                          size, base_index, boundary_size, 0);
+                                          size, base_index, boundary_size,
+                                          align_mask);
        }
        if (offset != -1) {
                next_bit = offset+size;
@@ -236,10 +238,10 @@ nonforced_iommu(struct device *dev, unsigned long addr, size_t size)
 * Caller needs to check if the iommu is needed and flush.
 */
 static dma_addr_t dma_map_area(struct device *dev, dma_addr_t phys_mem,
-                                size_t size, int dir)
+                                size_t size, int dir, unsigned long align_mask)
 {
        unsigned long npages = iommu_num_pages(phys_mem, size);
-        unsigned long iommu_page = alloc_iommu(dev, npages);
+        unsigned long iommu_page = alloc_iommu(dev, npages, align_mask);
        int i;
        if (iommu_page == -1) {
@@ -262,7 +264,11 @@ static dma_addr_t dma_map_area(struct device *dev, dma_addr_t phys_mem,
 static dma_addr_t
 gart_map_simple(struct device *dev, phys_addr_t paddr, size_t size, int dir)
 {
-        dma_addr_t map = dma_map_area(dev, paddr, size, dir);
+        dma_addr_t map;
+        unsigned long align_mask;
+        align_mask = (1UL << get_order(size)) - 1;
+        map = dma_map_area(dev, paddr, size, dir, align_mask);
        flush_gart();
@@ -281,7 +287,8 @@ gart_map_single(struct device *dev, phys_addr_t paddr, size_t size, int dir)
        if (!need_iommu(dev, paddr, size))
                return paddr;
-        bus = gart_map_simple(dev, paddr, size, dir);
+        bus = dma_map_area(dev, paddr, size, dir, 0);
+        flush_gart();
        return bus;
 }
@@ -340,7 +347,7 @@ static int dma_map_sg_nonforce(struct device *dev, struct scatterlist *sg,
                unsigned long addr = sg_phys(s);
                if (nonforced_iommu(dev, addr, s->length)) {
-                        addr = dma_map_area(dev, addr, s->length, dir);
+                        addr = dma_map_area(dev, addr, s->length, dir, 0);
                        if (addr == bad_dma_address) {
                                if (i > 0)
                                        gart_unmap_sg(dev, sg, i, dir);
@@ -362,7 +369,7 @@ static int __dma_map_cont(struct device *dev, struct scatterlist *start,
                          int nelems, struct scatterlist *sout,
                          unsigned long pages)
 {
-        unsigned long iommu_start = alloc_iommu(dev, pages);
+        unsigned long iommu_start = alloc_iommu(dev, pages, 0);
        unsigned long iommu_page = iommu_start;
        struct scatterlist *s;
        int i;
@@ -626,7 +633,6 @@ static __init int init_k8_gatt(struct agp_kern_info *info)
        struct pci_dev *dev;
        void *gatt;
        int i, error;
-        unsigned long start_pfn, end_pfn;
        printk(KERN_INFO "PCI-DMA: Disabling AGP.\n");
        aper_size = aper_base = info->aper_size = 0;
@@ -672,12 +678,6 @@ static __init int init_k8_gatt(struct agp_kern_info *info)
        printk(KERN_INFO "PCI-DMA: aperture base @ %x size %u KB\n",
               aper_base, aper_size>>10);
-        /* need to map that range */
-        end_pfn = (aper_base>>PAGE_SHIFT) + (aper_size>>PAGE_SHIFT);
-        if (end_pfn > max_low_pfn_mapped) {
-                start_pfn = (aper_base>>PAGE_SHIFT);
-                init_memory_mapping(start_pfn<<PAGE_SHIFT, end_pfn<<PAGE_SHIFT);
-        }
        return 0;
 nommu:
@@ -727,7 +727,8 @@ void __init gart_iommu_init(void)
 {
        struct agp_kern_info info;
        unsigned long iommu_start;
-        unsigned long aper_size;
+        unsigned long aper_base, aper_size;
+        unsigned long start_pfn, end_pfn;
        unsigned long scratch;
        long i;
@@ -765,8 +766,16 @@ void __init gart_iommu_init(void)
                return;
        }
+        /* need to map that range */
+        aper_size = info.aper_size << 20;
+        aper_base = info.aper_base;
+        end_pfn = (aper_base>>PAGE_SHIFT) + (aper_size>>PAGE_SHIFT);
+        if (end_pfn > max_low_pfn_mapped) {
+                start_pfn = (aper_base>>PAGE_SHIFT);
+                init_memory_mapping(start_pfn<<PAGE_SHIFT, end_pfn<<PAGE_SHIFT);
+        }
        printk(KERN_INFO "PCI-DMA: using GART IOMMU.\n");
-        aper_size = info.aper_size * 1024 * 1024;
        iommu_size = check_iommu_size(info.aper_base, aper_size);
        iommu_pages = iommu_size >> PAGE_SHIFT;
diff --git a/arch/x86/kernel/pcspeaker.c b/arch/x86/kernel/pcspeaker.c
index bc1f2d3ea277..a311ffcaad16 100644
--- a/arch/x86/kernel/pcspeaker.c
+++ b/arch/x86/kernel/pcspeaker.c
@@ -1,20 +1,13 @@
 #include <linux/platform_device.h>
-#include <linux/errno.h>
+#include <linux/err.h>
 #include <linux/init.h>
 static __init int add_pcspkr(void)
 {
        struct platform_device *pd;
-        int ret;
-        pd = platform_device_alloc("pcspkr", -1);
+        pd = platform_device_register_simple("pcspkr", -1, NULL, 0);
-        if (!pd)
-                return -ENOMEM;
-        ret = platform_device_add(pd);
+        return IS_ERR(pd) ? PTR_ERR(pd) : 0;
-        if (ret)
-                platform_device_put(pd);
-        return ret;
 }
 device_initcall(add_pcspkr);
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index 876e91890777..ec7a2ba9bce8 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -185,7 +185,8 @@ static void mwait_idle(void)
 static void poll_idle(void)
 {
        local_irq_enable();
-        cpu_relax();
+        while (!need_resched())
+                cpu_relax();
 }
 /*
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index 31f40b24bf5d..205188db9626 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -37,6 +37,7 @@
 #include <linux/tick.h>
 #include <linux/percpu.h>
 #include <linux/prctl.h>
+#include <linux/dmi.h>
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
@@ -56,6 +57,8 @@
 #include <asm/cpu.h>
 #include <asm/kdebug.h>
 #include <asm/idle.h>
+#include <asm/syscalls.h>
+#include <asm/smp.h>
 asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
@@ -161,6 +164,7 @@ void __show_registers(struct pt_regs *regs, int all)
        unsigned long d0, d1, d2, d3, d6, d7;
        unsigned long sp;
        unsigned short ss, gs;
+        const char *board;
        if (user_mode_vm(regs)) {
                sp = regs->sp;
@@ -173,11 +177,15 @@ void __show_registers(struct pt_regs *regs, int all)
        }
        printk("\n");
-        printk("Pid: %d, comm: %s %s (%s %.*s)\n",
+        board = dmi_get_system_info(DMI_PRODUCT_NAME);
+        if (!board)
+                board = "";
+        printk("Pid: %d, comm: %s %s (%s %.*s) %s\n",
                        task_pid_nr(current), current->comm,
                        print_tainted(), init_utsname()->release,
                        (int)strcspn(init_utsname()->version, " "),
-                        init_utsname()->version);
+                        init_utsname()->version, board);
        printk("EIP: %04x:[<%08lx>] EFLAGS: %08lx CPU: %d\n",
                        (u16)regs->cs, regs->ip, regs->flags,
@@ -277,6 +285,14 @@ void exit_thread(void)
                tss->x86_tss.io_bitmap_base = INVALID_IO_BITMAP_OFFSET;
                put_cpu();
        }
+#ifdef CONFIG_X86_DS
+        /* Free any DS contexts that have not been properly released. */
+        if (unlikely(current->thread.ds_ctx)) {
+                /* we clear debugctl to make sure DS is not used. */
+                update_debugctlmsr(0);
+                ds_free(current->thread.ds_ctx);
+        }
+#endif /* CONFIG_X86_DS */
 }
 void flush_thread(void)
@@ -438,6 +454,35 @@ int set_tsc_mode(unsigned int val)
        return 0;
 }
+#ifdef CONFIG_X86_DS
+static int update_debugctl(struct thread_struct *prev,
+                        struct thread_struct *next, unsigned long debugctl)
+{
+        unsigned long ds_prev = 0;
+        unsigned long ds_next = 0;
+        if (prev->ds_ctx)
+                ds_prev = (unsigned long)prev->ds_ctx->ds;
+        if (next->ds_ctx)
+                ds_next = (unsigned long)next->ds_ctx->ds;
+        if (ds_next != ds_prev) {
+                /* we clear debugctl to make sure DS
+                 * is not in use when we change it */
+                debugctl = 0;
+                update_debugctlmsr(0);
+                wrmsr(MSR_IA32_DS_AREA, ds_next, 0);
+        }
+        return debugctl;
+}
+#else
+static int update_debugctl(struct thread_struct *prev,
+                        struct thread_struct *next, unsigned long debugctl)
+{
+        return debugctl;
+}
+#endif /* CONFIG_X86_DS */
 static noinline void
 __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
                 struct tss_struct *tss)
@@ -448,14 +493,7 @@ __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
        prev = &prev_p->thread;
        next = &next_p->thread;
-        debugctl = prev->debugctlmsr;
+        debugctl = update_debugctl(prev, next, prev->debugctlmsr);
-        if (next->ds_area_msr != prev->ds_area_msr) {
-                /* we clear debugctl to make sure DS
-                 * is not in use when we change it */
-                debugctl = 0;
-                update_debugctlmsr(0);
-                wrmsr(MSR_IA32_DS_AREA, next->ds_area_msr, 0);
-        }
        if (next->debugctlmsr != debugctl)
                update_debugctlmsr(next->debugctlmsr);
@@ -479,13 +517,13 @@ __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p,
                        hard_enable_TSC();
        }
-#ifdef X86_BTS
+#ifdef CONFIG_X86_PTRACE_BTS
        if (test_tsk_thread_flag(prev_p, TIF_BTS_TRACE_TS))
                ptrace_bts_take_timestamp(prev_p, BTS_TASK_DEPARTS);
        if (test_tsk_thread_flag(next_p, TIF_BTS_TRACE_TS))
                ptrace_bts_take_timestamp(next_p, BTS_TASK_ARRIVES);
-#endif
+#endif /* CONFIG_X86_PTRACE_BTS */
        if (!test_tsk_thread_flag(next_p, TIF_IO_BITMAP)) {
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index e12e0e4dd256..2a8ccb9238b4 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -37,11 +37,11 @@
 #include <linux/kdebug.h>
 #include <linux/tick.h>
 #include <linux/prctl.h>
+#include <linux/uaccess.h>
+#include <linux/io.h>
-#include <asm/uaccess.h>
 #include <asm/pgtable.h>
 #include <asm/system.h>
-#include <asm/io.h>
 #include <asm/processor.h>
 #include <asm/i387.h>
 #include <asm/mmu_context.h>
@@ -51,6 +51,7 @@
 #include <asm/proto.h>
 #include <asm/ia32.h>
 #include <asm/idle.h>
+#include <asm/syscalls.h>
 asmlinkage extern void ret_from_fork(void);
@@ -88,7 +89,7 @@ void exit_idle(void)
 #ifdef CONFIG_HOTPLUG_CPU
 DECLARE_PER_CPU(int, cpu_state);
-#include <asm/nmi.h>
+#include <linux/nmi.h>
 /* We halt the CPU with physical CPU hotplug */
 static inline void play_dead(void)
 {
@@ -153,7 +154,7 @@ void cpu_idle(void)
 }
 /* Prints also some state that isn't saved in the pt_regs */
-void __show_regs(struct pt_regs * regs)
+void __show_regs(struct pt_regs *regs)
 {
        unsigned long cr0 = 0L, cr2 = 0L, cr3 = 0L, cr4 = 0L, fs, gs, shadowgs;
        unsigned long d0, d1, d2, d3, d6, d7;
@@ -162,59 +163,61 @@ void __show_regs(struct pt_regs * regs)
        printk("\n");
        print_modules();
-        printk("Pid: %d, comm: %.20s %s %s %.*s\n",
+        printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s\n",
                current->pid, current->comm, print_tainted(),
                init_utsname()->release,
                (int)strcspn(init_utsname()->version, " "),
                init_utsname()->version);
-        printk("RIP: %04lx:[<%016lx>] ", regs->cs & 0xffff, regs->ip);
+        printk(KERN_INFO "RIP: %04lx:[<%016lx>] ", regs->cs & 0xffff, regs->ip);
        printk_address(regs->ip, 1);
-        printk("RSP: %04lx:%016lx  EFLAGS: %08lx\n", regs->ss, regs->sp,
+        printk(KERN_INFO "RSP: %04lx:%016lx  EFLAGS: %08lx\n", regs->ss,
-                regs->flags);
+                        regs->sp, regs->flags);
-        printk("RAX: %016lx RBX: %016lx RCX: %016lx\n",
+        printk(KERN_INFO "RAX: %016lx RBX: %016lx RCX: %016lx\n",
               regs->ax, regs->bx, regs->cx);
-        printk("RDX: %016lx RSI: %016lx RDI: %016lx\n",
+        printk(KERN_INFO "RDX: %016lx RSI: %016lx RDI: %016lx\n",
               regs->dx, regs->si, regs->di);
-        printk("RBP: %016lx R08: %016lx R09: %016lx\n",
+        printk(KERN_INFO "RBP: %016lx R08: %016lx R09: %016lx\n",
               regs->bp, regs->r8, regs->r9);
-        printk("R10: %016lx R11: %016lx R12: %016lx\n",
+        printk(KERN_INFO "R10: %016lx R11: %016lx R12: %016lx\n",
-               regs->r10, regs->r11, regs->r12); 
+               regs->r10, regs->r11, regs->r12);
-        printk("R13: %016lx R14: %016lx R15: %016lx\n",
+        printk(KERN_INFO "R13: %016lx R14: %016lx R15: %016lx\n",
-               regs->r13, regs->r14, regs->r15); 
+               regs->r13, regs->r14, regs->r15);
-        asm("movl %%ds,%0" : "=r" (ds)); 
+        asm("movl %%ds,%0" : "=r" (ds));
-        asm("movl %%cs,%0" : "=r" (cs)); 
+        asm("movl %%cs,%0" : "=r" (cs));
-        asm("movl %%es,%0" : "=r" (es)); 
+        asm("movl %%es,%0" : "=r" (es));
        asm("movl %%fs,%0" : "=r" (fsindex));
        asm("movl %%gs,%0" : "=r" (gsindex));
        rdmsrl(MSR_FS_BASE, fs);
-        rdmsrl(MSR_GS_BASE, gs); 
+        rdmsrl(MSR_GS_BASE, gs);
-        rdmsrl(MSR_KERNEL_GS_BASE, shadowgs); 
+        rdmsrl(MSR_KERNEL_GS_BASE, shadowgs);
        cr0 = read_cr0();
        cr2 = read_cr2();
        cr3 = read_cr3();
        cr4 = read_cr4();
-        printk("FS:  %016lx(%04x) GS:%016lx(%04x) knlGS:%016lx\n", 
+        printk(KERN_INFO "FS:  %016lx(%04x) GS:%016lx(%04x) knlGS:%016lx\n",
-               fs,fsindex,gs,gsindex,shadowgs); 
+               fs, fsindex, gs, gsindex, shadowgs);
-        printk("CS:  %04x DS: %04x ES: %04x CR0: %016lx\n", cs, ds, es, cr0); 
+        printk(KERN_INFO "CS:  %04x DS: %04x ES: %04x CR0: %016lx\n", cs, ds,
-        printk("CR2: %016lx CR3: %016lx CR4: %016lx\n", cr2, cr3, cr4);
+                        es, cr0);
+        printk(KERN_INFO "CR2: %016lx CR3: %016lx CR4: %016lx\n", cr2, cr3,
+                        cr4);
        get_debugreg(d0, 0);
        get_debugreg(d1, 1);
        get_debugreg(d2, 2);
-        printk("DR0: %016lx DR1: %016lx DR2: %016lx\n", d0, d1, d2);
+        printk(KERN_INFO "DR0: %016lx DR1: %016lx DR2: %016lx\n", d0, d1, d2);
        get_debugreg(d3, 3);
        get_debugreg(d6, 6);
        get_debugreg(d7, 7);
-        printk("DR3: %016lx DR6: %016lx DR7: %016lx\n", d3, d6, d7);
+        printk(KERN_INFO "DR3: %016lx DR6: %016lx DR7: %016lx\n", d3, d6, d7);
 }
 void show_regs(struct pt_regs *regs)
 {
-        printk("CPU %d:", smp_processor_id());
+        printk(KERN_INFO "CPU %d:", smp_processor_id());
        __show_regs(regs);
        show_trace(NULL, regs, (void *)(regs + 1), regs->bp);
 }
@@ -240,6 +243,14 @@ void exit_thread(void)
                t->io_bitmap_max = 0;
                put_cpu();
        }
+#ifdef CONFIG_X86_DS
+        /* Free any DS contexts that have not been properly released. */
+        if (unlikely(t->ds_ctx)) {
+                /* we clear debugctl to make sure DS is not used. */
+                update_debugctlmsr(0);
+                ds_free(t->ds_ctx);
+        }
+#endif /* CONFIG_X86_DS */
 }
 void flush_thread(void)
@@ -315,10 +326,10 @@ void prepare_to_copy(struct task_struct *tsk)
 int copy_thread(int nr, unsigned long clone_flags, unsigned long sp,
                unsigned long unused,
-        struct task_struct * p, struct pt_regs * regs)
+        struct task_struct *p, struct pt_regs *regs)
 {
        int err;
-        struct pt_regs * childregs;
+        struct pt_regs *childregs;
        struct task_struct *me = current;
        childregs = ((struct pt_regs *)
@@ -363,10 +374,10 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long sp,
                if (test_thread_flag(TIF_IA32))
                        err = do_set_thread_area(p, -1,
                                (struct user_desc __user *)childregs->si, 0);
-                else                    
+                else
-#endif   
+#endif
-                        err = do_arch_prctl(p, ARCH_SET_FS, childregs->r8); 
+                        err = do_arch_prctl(p, ARCH_SET_FS, childregs->r8);
-                if (err) 
+                if (err)
                        goto out;
        }
        err = 0;
@@ -473,13 +484,27 @@ static inline void __switch_to_xtra(struct task_struct *prev_p,
        next = &next_p->thread;
        debugctl = prev->debugctlmsr;
-        if (next->ds_area_msr != prev->ds_area_msr) {
-                /* we clear debugctl to make sure DS
+#ifdef CONFIG_X86_DS
-                 * is not in use when we change it */
+        {
-                debugctl = 0;
+                unsigned long ds_prev = 0, ds_next = 0;
-                update_debugctlmsr(0);
-                wrmsrl(MSR_IA32_DS_AREA, next->ds_area_msr);
+                if (prev->ds_ctx)
+                        ds_prev = (unsigned long)prev->ds_ctx->ds;
+                if (next->ds_ctx)
+                        ds_next = (unsigned long)next->ds_ctx->ds;
+                if (ds_next != ds_prev) {
+                        /*
+                         * We clear debugctl to make sure DS
+                         * is not in use when we change it:
+                         */
+                        debugctl = 0;
+                        update_debugctlmsr(0);
+                        wrmsrl(MSR_IA32_DS_AREA, ds_next);
+                }
        }
+#endif /* CONFIG_X86_DS */
        if (next->debugctlmsr != debugctl)
                update_debugctlmsr(next->debugctlmsr);
@@ -517,13 +542,13 @@ static inline void __switch_to_xtra(struct task_struct *prev_p,
                memset(tss->io_bitmap, 0xff, prev->io_bitmap_max);
        }
-#ifdef X86_BTS
+#ifdef CONFIG_X86_PTRACE_BTS
        if (test_tsk_thread_flag(prev_p, TIF_BTS_TRACE_TS))
                ptrace_bts_take_timestamp(prev_p, BTS_TASK_DEPARTS);
        if (test_tsk_thread_flag(next_p, TIF_BTS_TRACE_TS))
                ptrace_bts_take_timestamp(next_p, BTS_TASK_ARRIVES);
-#endif
+#endif /* CONFIG_X86_PTRACE_BTS */
 }
 /*
@@ -545,7 +570,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
        unsigned fsindex, gsindex;
        /* we're going to use this soon, after a few expensive things */
-        if (next_p->fpu_counter>5)
+        if (next_p->fpu_counter > 5)
                prefetch(next->xstate);
        /*
@@ -553,13 +578,13 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         */
        load_sp0(tss, next);
-        /* 
+        /*
         * Switch DS and ES.
         * This won't pick up thread selector changes, but I guess that is ok.
         */
        savesegment(es, prev->es);
        if (unlikely(next->es | prev->es))
-                loadsegment(es, next->es); 
+                loadsegment(es, next->es);
        savesegment(ds, prev->ds);
        if (unlikely(next->ds | prev->ds))
@@ -585,7 +610,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         */
        arch_leave_lazy_cpu_mode();
-        /* 
+        /*
         * Switch FS and GS.
         *
         * Segment register != 0 always requires a reload.  Also
@@ -594,13 +619,13 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         */
        if (unlikely(fsindex | next->fsindex | prev->fs)) {
                loadsegment(fs, next->fsindex);
-                /* 
+                /*
                 * Check if the user used a selector != 0; if yes
                 *  clear 64bit base, since overloaded base is always
                 *  mapped to the Null selector
                 */
                if (fsindex)
-                        prev->fs = 0;                           
+                        prev->fs = 0;
        }
        /* when next process has a 64bit base use it */
        if (next->fs)
@@ -610,7 +635,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
        if (unlikely(gsindex | next->gsindex | prev->gs)) {
                load_gs_index(next->gsindex);
                if (gsindex)
-                        prev->gs = 0;                           
+                        prev->gs = 0;
        }
        if (next->gs)
                wrmsrl(MSR_KERNEL_GS_BASE, next->gs);
@@ -619,12 +644,12 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
        /* Must be after DS reload */
        unlazy_fpu(prev_p);
-        /* 
+        /*
         * Switch the PDA and FPU contexts.
         */
        prev->usersp = read_pda(oldrsp);
        write_pda(oldrsp, next->usersp);
-        write_pda(pcurrent, next_p); 
+        write_pda(pcurrent, next_p);
        write_pda(kernelstack,
                  (unsigned long)task_stack_page(next_p) +
@@ -665,7 +690,7 @@ long sys_execve(char __user *name, char __user * __user *argv,
                char __user * __user *envp, struct pt_regs *regs)
 {
        long error;
-        char * filename;
+        char *filename;
        filename = getname(name);
        error = PTR_ERR(filename);
@@ -723,55 +748,55 @@ asmlinkage long sys_vfork(struct pt_regs *regs)
 unsigned long get_wchan(struct task_struct *p)
 {
        unsigned long stack;
-        u64 fp,ip;
+        u64 fp, ip;
        int count = 0;
-        if (!p || p == current || p->state==TASK_RUNNING)
+        if (!p || p == current || p->state == TASK_RUNNING)
-                return 0; 
+                return 0;
        stack = (unsigned long)task_stack_page(p);
        if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE)
                return 0;
        fp = *(u64 *)(p->thread.sp);
-        do { 
+        do {
                if (fp < (unsigned long)stack ||
                    fp > (unsigned long)stack+THREAD_SIZE)
-                        return 0; 
+                        return 0;
                ip = *(u64 *)(fp+8);
                if (!in_sched_functions(ip))
                        return ip;
-                fp = *(u64 *)fp; 
+                fp = *(u64 *)fp;
-        } while (count++ < 16); 
+        } while (count++ < 16);
        return 0;
 }
 long do_arch_prctl(struct task_struct *task, int code, unsigned long addr)
-{ 
+{
-        int ret = 0; 
+        int ret = 0;
        int doit = task == current;
        int cpu;
-        switch (code) { 
+        switch (code) {
        case ARCH_SET_GS:
                if (addr >= TASK_SIZE_OF(task))
-                        return -EPERM; 
+                        return -EPERM;
                cpu = get_cpu();
-                /* handle small bases via the GDT because that's faster to 
+                /* handle small bases via the GDT because that's faster to
                   switch. */
-                if (addr <= 0xffffffff) {  
+                if (addr <= 0xffffffff) {
-                        set_32bit_tls(task, GS_TLS, addr); 
+                        set_32bit_tls(task, GS_TLS, addr);
-                        if (doit) { 
+                        if (doit) {
                                load_TLS(&task->thread, cpu);
-                                load_gs_index(GS_TLS_SEL); 
+                                load_gs_index(GS_TLS_SEL);
                        }
-                        task->thread.gsindex = GS_TLS_SEL; 
+                        task->thread.gsindex = GS_TLS_SEL;
                        task->thread.gs = 0;
-                } else { 
+                } else {
                        task->thread.gsindex = 0;
                        task->thread.gs = addr;
                        if (doit) {
                                load_gs_index(0);
                                ret = checking_wrmsrl(MSR_KERNEL_GS_BASE, addr);
-                        } 
+                        }
                }
                put_cpu();
                break;
@@ -825,8 +850,7 @@ long do_arch_prctl(struct task_struct *task, int code, unsigned long addr)
                                rdmsrl(MSR_KERNEL_GS_BASE, base);
                        else
                                base = task->thread.gs;
-                }
+                } else
-                else
                        base = task->thread.gs;
                ret = put_user(base, (unsigned long __user *)addr);
                break;
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index e37dccce85db..e375b658efc3 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -14,6 +14,7 @@
 #include <linux/errno.h>
 #include <linux/ptrace.h>
 #include <linux/regset.h>
+#include <linux/tracehook.h>
 #include <linux/user.h>
 #include <linux/elf.h>
 #include <linux/security.h>
@@ -69,7 +70,7 @@ static inline bool invalid_selector(u16 value)
 #define FLAG_MASK               FLAG_MASK_32
-static long *pt_regs_access(struct pt_regs *regs, unsigned long regno)
+static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long regno)
 {
        BUILD_BUG_ON(offsetof(struct pt_regs, bx) != 0);
        regno >>= 2;
@@ -554,45 +555,115 @@ static int ptrace_set_debugreg(struct task_struct *child,
        return 0;
 }
-#ifdef X86_BTS
+#ifdef CONFIG_X86_PTRACE_BTS
+/*
+ * The configuration for a particular BTS hardware implementation.
+ */
+struct bts_configuration {
+        /* the size of a BTS record in bytes; at most BTS_MAX_RECORD_SIZE */
+        unsigned char  sizeof_bts;
+        /* the size of a field in the BTS record in bytes */
+        unsigned char  sizeof_field;
+        /* a bitmask to enable/disable BTS in DEBUGCTL MSR */
+        unsigned long debugctl_mask;
+};
+static struct bts_configuration bts_cfg;
+#define BTS_MAX_RECORD_SIZE (8 * 3)
+/*
+ * Branch Trace Store (BTS) uses the following format. Different
+ * architectures vary in the size of those fields.
+ * - source linear address
+ * - destination linear address
+ * - flags
+ *
+ * Later architectures use 64bit pointers throughout, whereas earlier
+ * architectures use 32bit pointers in 32bit mode.
+ *
+ * We compute the base address for the first 8 fields based on:
+ * - the field size stored in the DS configuration
+ * - the relative field position
+ *
+ * In order to store additional information in the BTS buffer, we use
+ * a special source address to indicate that the record requires
+ * special interpretation.
+ *
+ * Netburst indicated via a bit in the flags field whether the branch
+ * was predicted; this is ignored.
+ */
+enum bts_field {
+        bts_from = 0,
+        bts_to,
+        bts_flags,
+        bts_escape = (unsigned long)-1,
+        bts_qual = bts_to,
+        bts_jiffies = bts_flags
+};
+static inline unsigned long bts_get(const char *base, enum bts_field field)
+{
+        base += (bts_cfg.sizeof_field * field);
+        return *(unsigned long *)base;
+}
-static int ptrace_bts_get_size(struct task_struct *child)
+static inline void bts_set(char *base, enum bts_field field, unsigned long val)
 {
-        if (!child->thread.ds_area_msr)
+        base += (bts_cfg.sizeof_field * field);;
-                return -ENXIO;
+        (*(unsigned long *)base) = val;
+}
-        return ds_get_bts_index((void *)child->thread.ds_area_msr);
+/*
+ * Translate a BTS record from the raw format into the bts_struct format
+ *
+ * out (out): bts_struct interpretation
+ * raw: raw BTS record
+ */
+static void ptrace_bts_translate_record(struct bts_struct *out, const void *raw)
+{
+        memset(out, 0, sizeof(*out));
+        if (bts_get(raw, bts_from) == bts_escape) {
+                out->qualifier       = bts_get(raw, bts_qual);
+                out->variant.jiffies = bts_get(raw, bts_jiffies);
+        } else {
+                out->qualifier = BTS_BRANCH;
+                out->variant.lbr.from_ip = bts_get(raw, bts_from);
+                out->variant.lbr.to_ip   = bts_get(raw, bts_to);
+        }
 }
-static int ptrace_bts_read_record(struct task_struct *child,
+static int ptrace_bts_read_record(struct task_struct *child, size_t index,
-                                  long index,
                                  struct bts_struct __user *out)
 {
        struct bts_struct ret;
-        int retval;
+        const void *bts_record;
-        int bts_end;
+        size_t bts_index, bts_end;
-        int bts_index;
+        int error;
-        if (!child->thread.ds_area_msr)
-                return -ENXIO;
-        if (index < 0)
+        error = ds_get_bts_end(child, &bts_end);
-                return -EINVAL;
+        if (error < 0)
+                return error;
-        bts_end = ds_get_bts_end((void *)child->thread.ds_area_msr);
        if (bts_end <= index)
                return -EINVAL;
+        error = ds_get_bts_index(child, &bts_index);
+        if (error < 0)
+                return error;
        /* translate the ptrace bts index into the ds bts index */
-        bts_index = ds_get_bts_index((void *)child->thread.ds_area_msr);
+        bts_index += bts_end - (index + 1);
-        bts_index -= (index + 1);
+        if (bts_end <= bts_index)
-        if (bts_index < 0)
+                bts_index -= bts_end;
-                bts_index += bts_end;
-        retval = ds_read_bts((void *)child->thread.ds_area_msr,
+        error = ds_access_bts(child, bts_index, &bts_record);
-                             bts_index, &ret);
+        if (error < 0)
-        if (retval < 0)
+                return error;
-                return retval;
+        ptrace_bts_translate_record(&ret, bts_record);
        if (copy_to_user(out, &ret, sizeof(ret)))
                return -EFAULT;
@@ -600,101 +671,106 @@ static int ptrace_bts_read_record(struct task_struct *child,
        return sizeof(ret);
 }
-static int ptrace_bts_clear(struct task_struct *child)
-{
-        if (!child->thread.ds_area_msr)
-                return -ENXIO;
-        return ds_clear((void *)child->thread.ds_area_msr);
-}
 static int ptrace_bts_drain(struct task_struct *child,
                            long size,
                            struct bts_struct __user *out)
 {
-        int end, i;
+        struct bts_struct ret;
-        void *ds = (void *)child->thread.ds_area_msr;
+        const unsigned char *raw;
+        size_t end, i;
-        if (!ds)
+        int error;
-                return -ENXIO;
-        end = ds_get_bts_index(ds);
+        error = ds_get_bts_index(child, &end);
-        if (end <= 0)
+        if (error < 0)
-                return end;
+                return error;
        if (size < (end * sizeof(struct bts_struct)))
                return -EIO;
-        for (i = 0; i < end; i++, out++) {
+        error = ds_access_bts(child, 0, (const void **)&raw);
-                struct bts_struct ret;
+        if (error < 0)
-                int retval;
+                return error;
-                retval = ds_read_bts(ds, i, &ret);
+        for (i = 0; i < end; i++, out++, raw += bts_cfg.sizeof_bts) {
-                if (retval < 0)
+                ptrace_bts_translate_record(&ret, raw);
-                        return retval;
                if (copy_to_user(out, &ret, sizeof(ret)))
                        return -EFAULT;
        }
-        ds_clear(ds);
+        error = ds_clear_bts(child);
+        if (error < 0)
+                return error;
        return end;
 }
+static void ptrace_bts_ovfl(struct task_struct *child)
+{
+        send_sig(child->thread.bts_ovfl_signal, child, 0);
+}
 static int ptrace_bts_config(struct task_struct *child,
                             long cfg_size,
                             const struct ptrace_bts_config __user *ucfg)
 {
        struct ptrace_bts_config cfg;
-        int bts_size, ret = 0;
+        int error = 0;
-        void *ds;
+        error = -EOPNOTSUPP;
+        if (!bts_cfg.sizeof_bts)
+                goto errout;
+        error = -EIO;
        if (cfg_size < sizeof(cfg))
-                return -EIO;
+                goto errout;
+        error = -EFAULT;
        if (copy_from_user(&cfg, ucfg, sizeof(cfg)))
-                return -EFAULT;
+                goto errout;
-        if ((int)cfg.size < 0)
+        error = -EINVAL;
-                return -EINVAL;
+        if ((cfg.flags & PTRACE_BTS_O_SIGNAL) &&
+            !(cfg.flags & PTRACE_BTS_O_ALLOC))
+                goto errout;
-        bts_size = 0;
+        if (cfg.flags & PTRACE_BTS_O_ALLOC) {
-        ds = (void *)child->thread.ds_area_msr;
+                ds_ovfl_callback_t ovfl = NULL;
-        if (ds) {
+                unsigned int sig = 0;
-                bts_size = ds_get_bts_size(ds);
-                if (bts_size < 0)
+                /* we ignore the error in case we were not tracing child */
-                        return bts_size;
+                (void)ds_release_bts(child);
-        }
-        cfg.size = PAGE_ALIGN(cfg.size);
-        if (bts_size != cfg.size) {
+                if (cfg.flags & PTRACE_BTS_O_SIGNAL) {
-                ret = ptrace_bts_realloc(child, cfg.size,
+                        if (!cfg.signal)
-                                         cfg.flags & PTRACE_BTS_O_CUT_SIZE);
+                                goto errout;
-                if (ret < 0)
+                        sig  = cfg.signal;
+                        ovfl = ptrace_bts_ovfl;
+                }
+                error = ds_request_bts(child, /* base = */ NULL, cfg.size, ovfl);
+                if (error < 0)
                        goto errout;
-                ds = (void *)child->thread.ds_area_msr;
+                child->thread.bts_ovfl_signal = sig;
        }
-        if (cfg.flags & PTRACE_BTS_O_SIGNAL)
+        error = -EINVAL;
-                ret = ds_set_overflow(ds, DS_O_SIGNAL);
+        if (!child->thread.ds_ctx && cfg.flags)
-        else
-                ret = ds_set_overflow(ds, DS_O_WRAP);
-        if (ret < 0)
                goto errout;
        if (cfg.flags & PTRACE_BTS_O_TRACE)
-                child->thread.debugctlmsr |= ds_debugctl_mask();
+                child->thread.debugctlmsr |= bts_cfg.debugctl_mask;
        else
-                child->thread.debugctlmsr &= ~ds_debugctl_mask();
+                child->thread.debugctlmsr &= ~bts_cfg.debugctl_mask;
        if (cfg.flags & PTRACE_BTS_O_SCHED)
                set_tsk_thread_flag(child, TIF_BTS_TRACE_TS);
        else
                clear_tsk_thread_flag(child, TIF_BTS_TRACE_TS);
-        ret = sizeof(cfg);
+        error = sizeof(cfg);
 out:
        if (child->thread.debugctlmsr)
@@ -702,10 +778,10 @@ out:
        else
                clear_tsk_thread_flag(child, TIF_DEBUGCTLMSR);
-        return ret;
+        return error;
 errout:
-        child->thread.debugctlmsr &= ~ds_debugctl_mask();
+        child->thread.debugctlmsr &= ~bts_cfg.debugctl_mask;
        clear_tsk_thread_flag(child, TIF_BTS_TRACE_TS);
        goto out;
 }
@@ -714,29 +790,40 @@ static int ptrace_bts_status(struct task_struct *child,
                             long cfg_size,
                             struct ptrace_bts_config __user *ucfg)
 {
-        void *ds = (void *)child->thread.ds_area_msr;
        struct ptrace_bts_config cfg;
+        size_t end;
+        const void *base, *max;
+        int error;
        if (cfg_size < sizeof(cfg))
                return -EIO;
-        memset(&cfg, 0, sizeof(cfg));
+        error = ds_get_bts_end(child, &end);
+        if (error < 0)
+                return error;
-        if (ds) {
+        error = ds_access_bts(child, /* index = */ 0, &base);
-                cfg.size = ds_get_bts_size(ds);
+        if (error < 0)
+                return error;
-                if (ds_get_overflow(ds) == DS_O_SIGNAL)
+        error = ds_access_bts(child, /* index = */ end, &max);
-                        cfg.flags |= PTRACE_BTS_O_SIGNAL;
+        if (error < 0)
+                return error;
-                if (test_tsk_thread_flag(child, TIF_DEBUGCTLMSR) &&
+        memset(&cfg, 0, sizeof(cfg));
-                    child->thread.debugctlmsr & ds_debugctl_mask())
+        cfg.size = (max - base);
-                        cfg.flags |= PTRACE_BTS_O_TRACE;
+        cfg.signal = child->thread.bts_ovfl_signal;
+        cfg.bts_size = sizeof(struct bts_struct);
-                if (test_tsk_thread_flag(child, TIF_BTS_TRACE_TS))
+        if (cfg.signal)
-                        cfg.flags |= PTRACE_BTS_O_SCHED;
+                cfg.flags |= PTRACE_BTS_O_SIGNAL;
-        }
-        cfg.bts_size = sizeof(struct bts_struct);
+        if (test_tsk_thread_flag(child, TIF_DEBUGCTLMSR) &&
+            child->thread.debugctlmsr & bts_cfg.debugctl_mask)
+                cfg.flags |= PTRACE_BTS_O_TRACE;
+        if (test_tsk_thread_flag(child, TIF_BTS_TRACE_TS))
+                cfg.flags |= PTRACE_BTS_O_SCHED;
        if (copy_to_user(ucfg, &cfg, sizeof(cfg)))
                return -EFAULT;
@@ -744,89 +831,38 @@ static int ptrace_bts_status(struct task_struct *child,
        return sizeof(cfg);
 }
 static int ptrace_bts_write_record(struct task_struct *child,
                                   const struct bts_struct *in)
 {
-        int retval;
+        unsigned char bts_record[BTS_MAX_RECORD_SIZE];
-        if (!child->thread.ds_area_msr)
+        BUG_ON(BTS_MAX_RECORD_SIZE < bts_cfg.sizeof_bts);
-                return -ENXIO;
-        retval = ds_write_bts((void *)child->thread.ds_area_msr, in);
+        memset(bts_record, 0, bts_cfg.sizeof_bts);
-        if (retval)
+        switch (in->qualifier) {
-                return retval;
+        case BTS_INVALID:
+                break;
-        return sizeof(*in);
+        case BTS_BRANCH:
-}
+                bts_set(bts_record, bts_from, in->variant.lbr.from_ip);
+                bts_set(bts_record, bts_to,   in->variant.lbr.to_ip);
+                break;
-static int ptrace_bts_realloc(struct task_struct *child,
+        case BTS_TASK_ARRIVES:
-                              int size, int reduce_size)
+        case BTS_TASK_DEPARTS:
-{
+                bts_set(bts_record, bts_from,    bts_escape);
-        unsigned long rlim, vm;
+                bts_set(bts_record, bts_qual,    in->qualifier);
-        int ret, old_size;
+                bts_set(bts_record, bts_jiffies, in->variant.jiffies);
+                break;
-        if (size < 0)
+        default:
                return -EINVAL;
-        old_size = ds_get_bts_size((void *)child->thread.ds_area_msr);
-        if (old_size < 0)
-                return old_size;
-        ret = ds_free((void **)&child->thread.ds_area_msr);
-        if (ret < 0)
-                goto out;
-        size >>= PAGE_SHIFT;
-        old_size >>= PAGE_SHIFT;
-        current->mm->total_vm  -= old_size;
-        current->mm->locked_vm -= old_size;
-        if (size == 0)
-                goto out;
-        rlim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
-        vm = current->mm->total_vm  + size;
-        if (rlim < vm) {
-                ret = -ENOMEM;
-                if (!reduce_size)
-                        goto out;
-                size = rlim - current->mm->total_vm;
-                if (size <= 0)
-                        goto out;
-        }
-        rlim = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
-        vm = current->mm->locked_vm  + size;
-        if (rlim < vm) {
-                ret = -ENOMEM;
-                if (!reduce_size)
-                        goto out;
-                size = rlim - current->mm->locked_vm;
-                if (size <= 0)
-                        goto out;
        }
-        ret = ds_allocate((void **)&child->thread.ds_area_msr,
+        /* The writing task will be the switched-to task on a context
-                          size << PAGE_SHIFT);
+         * switch. It needs to write into the switched-from task's BTS
-        if (ret < 0)
+         * buffer. */
-                goto out;
+        return ds_unchecked_write_bts(child, bts_record, bts_cfg.sizeof_bts);
-        current->mm->total_vm  += size;
-        current->mm->locked_vm += size;
-out:
-        if (child->thread.ds_area_msr)
-                set_tsk_thread_flag(child, TIF_DS_AREA_MSR);
-        else
-                clear_tsk_thread_flag(child, TIF_DS_AREA_MSR);
-        return ret;
 }
 void ptrace_bts_take_timestamp(struct task_struct *tsk,
@@ -839,7 +875,66 @@ void ptrace_bts_take_timestamp(struct task_struct *tsk,
        ptrace_bts_write_record(tsk, &rec);
 }
-#endif /* X86_BTS */
+static const struct bts_configuration bts_cfg_netburst = {
+        .sizeof_bts    = sizeof(long) * 3,
+        .sizeof_field  = sizeof(long),
+        .debugctl_mask = (1<<2)|(1<<3)|(1<<5)
+};
+static const struct bts_configuration bts_cfg_pentium_m = {
+        .sizeof_bts    = sizeof(long) * 3,
+        .sizeof_field  = sizeof(long),
+        .debugctl_mask = (1<<6)|(1<<7)
+};
+static const struct bts_configuration bts_cfg_core2 = {
+        .sizeof_bts    = 8 * 3,
+        .sizeof_field  = 8,
+        .debugctl_mask = (1<<6)|(1<<7)|(1<<9)
+};
+static inline void bts_configure(const struct bts_configuration *cfg)
+{
+        bts_cfg = *cfg;
+}
+void __cpuinit ptrace_bts_init_intel(struct cpuinfo_x86 *c)
+{
+        switch (c->x86) {
+        case 0x6:
+                switch (c->x86_model) {
+                case 0xD:
+                case 0xE: /* Pentium M */
+                        bts_configure(&bts_cfg_pentium_m);
+                        break;
+                case 0xF: /* Core2 */
+        case 0x1C: /* Atom */
+                        bts_configure(&bts_cfg_core2);
+                        break;
+                default:
+                        /* sorry, don't know about them */
+                        break;
+                }
+                break;
+        case 0xF:
+                switch (c->x86_model) {
+                case 0x0:
+                case 0x1:
+                case 0x2: /* Netburst */
+                        bts_configure(&bts_cfg_netburst);
+                        break;
+                default:
+                        /* sorry, don't know about them */
+                        break;
+                }
+                break;
+        default:
+                /* sorry, don't know about them */
+                break;
+        }
+}
+#endif /* CONFIG_X86_PTRACE_BTS */
 /*
 * Called by kernel/ptrace.c when detaching..
@@ -852,15 +947,15 @@ void ptrace_disable(struct task_struct *child)
 #ifdef TIF_SYSCALL_EMU
        clear_tsk_thread_flag(child, TIF_SYSCALL_EMU);
 #endif
-        if (child->thread.ds_area_msr) {
+#ifdef CONFIG_X86_PTRACE_BTS
-#ifdef X86_BTS
+        (void)ds_release_bts(child);
-                ptrace_bts_realloc(child, 0, 0);
-#endif
+        child->thread.debugctlmsr &= ~bts_cfg.debugctl_mask;
-                child->thread.debugctlmsr &= ~ds_debugctl_mask();
+        if (!child->thread.debugctlmsr)
-                if (!child->thread.debugctlmsr)
+                clear_tsk_thread_flag(child, TIF_DEBUGCTLMSR);
-                        clear_tsk_thread_flag(child, TIF_DEBUGCTLMSR);
-                clear_tsk_thread_flag(child, TIF_BTS_TRACE_TS);
+        clear_tsk_thread_flag(child, TIF_BTS_TRACE_TS);
-        }
+#endif /* CONFIG_X86_PTRACE_BTS */
 }
 #if defined CONFIG_X86_32 || defined CONFIG_IA32_EMULATION
@@ -980,7 +1075,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
        /*
         * These bits need more cooking - not enabled yet:
         */
-#ifdef X86_BTS
+#ifdef CONFIG_X86_PTRACE_BTS
        case PTRACE_BTS_CONFIG:
                ret = ptrace_bts_config
                        (child, data, (struct ptrace_bts_config __user *)addr);
@@ -992,7 +1087,7 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                break;
        case PTRACE_BTS_SIZE:
-                ret = ptrace_bts_get_size(child);
+                ret = ds_get_bts_index(child, /* pos = */ NULL);
                break;
        case PTRACE_BTS_GET:
@@ -1001,14 +1096,14 @@ long arch_ptrace(struct task_struct *child, long request, long addr, long data)
                break;
        case PTRACE_BTS_CLEAR:
-                ret = ptrace_bts_clear(child);
+                ret = ds_clear_bts(child);
                break;
        case PTRACE_BTS_DRAIN:
                ret = ptrace_bts_drain
                        (child, data, (struct bts_struct __user *) addr);
                break;
-#endif
+#endif /* CONFIG_X86_PTRACE_BTS */
        default:
                ret = ptrace_request(child, request, addr, data);
@@ -1375,30 +1470,6 @@ void send_sigtrap(struct task_struct *tsk, struct pt_regs *regs, int error_code)
        force_sig_info(SIGTRAP, &info, tsk);
 }
-static void syscall_trace(struct pt_regs *regs)
-{
-        if (!(current->ptrace & PT_PTRACED))
-                return;
-#if 0
-        printk("trace %s ip %lx sp %lx ax %d origrax %d caller %lx tiflags %x ptrace %x\n",
-               current->comm,
-               regs->ip, regs->sp, regs->ax, regs->orig_ax, __builtin_return_address(0),
-               current_thread_info()->flags, current->ptrace);
-#endif
-        ptrace_notify(SIGTRAP | ((current->ptrace & PT_TRACESYSGOOD)
-                                ? 0x80 : 0));
-        /*
-         * this isn't the same as continuing with a signal, but it will do
-         * for normal use.  strace only continues with a signal if the
-         * stopping signal is not SIGTRAP.  -brl
-         */
-        if (current->exit_code) {
-                send_sig(current->exit_code, current, 1);
-                current->exit_code = 0;
-        }
-}
 #ifdef CONFIG_X86_32
 # define IS_IA32        1
@@ -1432,8 +1503,9 @@ asmregparm long syscall_trace_enter(struct pt_regs *regs)
        if (unlikely(test_thread_flag(TIF_SYSCALL_EMU)))
                ret = -1L;
-        if (ret || test_thread_flag(TIF_SYSCALL_TRACE))
+        if ((ret || test_thread_flag(TIF_SYSCALL_TRACE)) &&
-                syscall_trace(regs);
+            tracehook_report_syscall_entry(regs))
+                ret = -1L;
        if (unlikely(current->audit_context)) {
                if (IS_IA32)
@@ -1459,7 +1531,7 @@ asmregparm void syscall_trace_leave(struct pt_regs *regs)
                audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
        if (test_thread_flag(TIF_SYSCALL_TRACE))
-                syscall_trace(regs);
+                tracehook_report_syscall_exit(regs, 0);
        /*
         * If TIF_SYSCALL_EMU is set, we only get here because of
@@ -1475,6 +1547,6 @@ asmregparm void syscall_trace_leave(struct pt_regs *regs)
         * system call instruction.
         */
        if (test_thread_flag(TIF_SINGLESTEP) &&
-            (current->ptrace & PT_PTRACED))
+            tracehook_consider_fatal_signal(current, SIGTRAP, SIG_DFL))
                send_sigtrap(current, regs, 0);
 }
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 724adfc63cb9..f4c93f1cfc19 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -29,7 +29,11 @@ EXPORT_SYMBOL(pm_power_off);
 static const struct desc_ptr no_idt = {};
 static int reboot_mode;
-enum reboot_type reboot_type = BOOT_KBD;
+/*
+ * Keyboard reset and triple fault may result in INIT, not RESET, which
+ * doesn't work when we're in vmx root mode.  Try ACPI first.
+ */
+enum reboot_type reboot_type = BOOT_ACPI;
 int reboot_force;
 #if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 9838f2539dfc..141efab52400 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -223,6 +223,9 @@ unsigned long saved_video_mode;
 #define RAMDISK_LOAD_FLAG               0x4000
 static char __initdata command_line[COMMAND_LINE_SIZE];
+#ifdef CONFIG_CMDLINE_BOOL
+static char __initdata builtin_cmdline[COMMAND_LINE_SIZE] = CONFIG_CMDLINE;
+#endif
 #if defined(CONFIG_EDD) || defined(CONFIG_EDD_MODULE)
 struct edd edd;
@@ -665,6 +668,19 @@ void __init setup_arch(char **cmdline_p)
        bss_resource.start = virt_to_phys(&__bss_start);
        bss_resource.end = virt_to_phys(&__bss_stop)-1;
+#ifdef CONFIG_CMDLINE_BOOL
+#ifdef CONFIG_CMDLINE_OVERRIDE
+        strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
+#else
+        if (builtin_cmdline[0]) {
+                /* append boot loader cmdline to builtin */
+                strlcat(builtin_cmdline, " ", COMMAND_LINE_SIZE);
+                strlcat(builtin_cmdline, boot_command_line, COMMAND_LINE_SIZE);
+                strlcpy(boot_command_line, builtin_cmdline, COMMAND_LINE_SIZE);
+        }
+#endif
+#endif
        strlcpy(command_line, boot_command_line, COMMAND_LINE_SIZE);
        *cmdline_p = command_line;
diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
index 76e305e064f9..0e67f72d9316 100644
--- a/arch/x86/kernel/setup_percpu.c
+++ b/arch/x86/kernel/setup_percpu.c
@@ -162,9 +162,16 @@ void __init setup_per_cpu_areas(void)
                        printk(KERN_INFO
                               "cpu %d has no node %d or node-local memory\n",
                                cpu, node);
+                        if (ptr)
+                                printk(KERN_DEBUG "per cpu data for cpu%d at %016lx\n",
+                                         cpu, __pa(ptr));
                }
-                else
+                else {
                        ptr = alloc_bootmem_pages_node(NODE_DATA(node), size);
+                        if (ptr)
+                                printk(KERN_DEBUG "per cpu data for cpu%d on node%d at %016lx\n",
+                                         cpu, node, __pa(ptr));
+                }
 #endif
                per_cpu_offset(cpu) = ptr - __per_cpu_start;
                memcpy(ptr, __per_cpu_start, __per_cpu_end - __per_cpu_start);
diff --git a/arch/x86/kernel/sigframe.h b/arch/x86/kernel/sigframe.h
index 72bbb519d2dc..8b4956e800ac 100644
--- a/arch/x86/kernel/sigframe.h
+++ b/arch/x86/kernel/sigframe.h
@@ -24,4 +24,9 @@ struct rt_sigframe {
        struct ucontext uc;
        struct siginfo info;
 };
+int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
+                sigset_t *set, struct pt_regs *regs);
+int ia32_setup_frame(int sig, struct k_sigaction *ka,
+                sigset_t *set, struct pt_regs *regs);
 #endif
diff --git a/arch/x86/kernel/signal_32.c b/arch/x86/kernel/signal_32.c
index 6fb5bcdd8933..2a2435d3037d 100644
--- a/arch/x86/kernel/signal_32.c
+++ b/arch/x86/kernel/signal_32.c
@@ -17,6 +17,7 @@
 #include <linux/errno.h>
 #include <linux/sched.h>
 #include <linux/wait.h>
+#include <linux/tracehook.h>
 #include <linux/elf.h>
 #include <linux/smp.h>
 #include <linux/mm.h>
@@ -26,6 +27,7 @@
 #include <asm/uaccess.h>
 #include <asm/i387.h>
 #include <asm/vdso.h>
+#include <asm/syscalls.h>
 #include "sigframe.h"
@@ -558,8 +560,6 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
         * handler too.
         */
        regs->flags &= ~X86_EFLAGS_TF;
-        if (test_thread_flag(TIF_SINGLESTEP))
-                ptrace_notify(SIGTRAP);
        spin_lock_irq(&current->sighand->siglock);
        sigorsets(&current->blocked, &current->blocked, &ka->sa.sa_mask);
@@ -568,6 +568,9 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
        recalc_sigpending();
        spin_unlock_irq(&current->sighand->siglock);
+        tracehook_signal_handler(sig, info, ka, regs,
+                                 test_thread_flag(TIF_SINGLESTEP));
        return 0;
 }
@@ -661,5 +664,10 @@ do_notify_resume(struct pt_regs *regs, void *unused, __u32 thread_info_flags)
        if (thread_info_flags & _TIF_SIGPENDING)
                do_signal(regs);
+        if (thread_info_flags & _TIF_NOTIFY_RESUME) {
+                clear_thread_flag(TIF_NOTIFY_RESUME);
+                tracehook_notify_resume(regs);
+        }
        clear_thread_flag(TIF_IRET);
 }
diff --git a/arch/x86/kernel/signal_64.c b/arch/x86/kernel/signal_64.c
index ca316b5b742c..694aa888bb19 100644
--- a/arch/x86/kernel/signal_64.c
+++ b/arch/x86/kernel/signal_64.c
@@ -15,17 +15,21 @@
 #include <linux/errno.h>
 #include <linux/wait.h>
 #include <linux/ptrace.h>
+#include <linux/tracehook.h>
 #include <linux/unistd.h>
 #include <linux/stddef.h>
 #include <linux/personality.h>
 #include <linux/compiler.h>
+#include <linux/uaccess.h>
 #include <asm/processor.h>
 #include <asm/ucontext.h>
-#include <asm/uaccess.h>
 #include <asm/i387.h>
 #include <asm/proto.h>
 #include <asm/ia32_unistd.h>
 #include <asm/mce.h>
+#include <asm/syscall.h>
+#include <asm/syscalls.h>
 #include "sigframe.h"
 #define _BLOCKABLE (~(sigmask(SIGKILL) | sigmask(SIGSTOP)))
@@ -41,11 +45,6 @@
 # define FIX_EFLAGS     __FIX_EFLAGS
 #endif
-int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
-               sigset_t *set, struct pt_regs * regs); 
-int ia32_setup_frame(int sig, struct k_sigaction *ka,
-            sigset_t *set, struct pt_regs * regs); 
 asmlinkage long
 sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
                struct pt_regs *regs)
@@ -128,7 +127,7 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc,
        /* Always make any pending restarted system calls return -EINTR */
        current_thread_info()->restart_block.fn = do_no_restart_syscall;
-#define COPY(x)         err |= __get_user(regs->x, &sc->x)
+#define COPY(x)         (err |= __get_user(regs->x, &sc->x))
        COPY(di); COPY(si); COPY(bp); COPY(sp); COPY(bx);
        COPY(dx); COPY(cx); COPY(ip);
@@ -158,7 +157,7 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc,
        }
        {
-                struct _fpstate __user * buf;
+                struct _fpstate __user *buf;
                err |= __get_user(buf, &sc->fpstate);
                if (buf) {
@@ -198,7 +197,7 @@ asmlinkage long sys_rt_sigreturn(struct pt_regs *regs)
        current->blocked = set;
        recalc_sigpending();
        spin_unlock_irq(&current->sighand->siglock);
-        
        if (restore_sigcontext(regs, &frame->uc.uc_mcontext, &ax))
                goto badframe;
@@ -208,16 +207,17 @@ asmlinkage long sys_rt_sigreturn(struct pt_regs *regs)
        return ax;
 badframe:
-        signal_fault(regs,frame,"sigreturn");
+        signal_fault(regs, frame, "sigreturn");
        return 0;
-}       
+}
 /*
 * Set up a signal frame.
 */
 static inline int
-setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs, unsigned long mask, struct task_struct *me)
+setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
+                unsigned long mask, struct task_struct *me)
 {
        int err = 0;
@@ -273,35 +273,35 @@ get_stack(struct k_sigaction *ka, struct pt_regs *regs, unsigned long size)
 }
 static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
-                           sigset_t *set, struct pt_regs * regs)
+                           sigset_t *set, struct pt_regs *regs)
 {
        struct rt_sigframe __user *frame;
-        struct _fpstate __user *fp = NULL; 
+        struct _fpstate __user *fp = NULL;
        int err = 0;
        struct task_struct *me = current;
        if (used_math()) {
-                fp = get_stack(ka, regs, sizeof(struct _fpstate)); 
+                fp = get_stack(ka, regs, sizeof(struct _fpstate));
                frame = (void __user *)round_down(
                        (unsigned long)fp - sizeof(struct rt_sigframe), 16) - 8;
                if (!access_ok(VERIFY_WRITE, fp, sizeof(struct _fpstate)))
                        goto give_sigsegv;
-                if (save_i387(fp) < 0) 
+                if (save_i387(fp) < 0)
-                        err |= -1; 
+                        err |= -1;
        } else
                frame = get_stack(ka, regs, sizeof(struct rt_sigframe)) - 8;
        if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
                goto give_sigsegv;
-        if (ka->sa.sa_flags & SA_SIGINFO) { 
+        if (ka->sa.sa_flags & SA_SIGINFO) {
                err |= copy_siginfo_to_user(&frame->info, info);
                if (err)
                        goto give_sigsegv;
        }
-                
        /* Create the ucontext.  */
        err |= __put_user(0, &frame->uc.uc_flags);
        err |= __put_user(0, &frame->uc.uc_link);
@@ -311,9 +311,9 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
        err |= __put_user(me->sas_ss_size, &frame->uc.uc_stack.ss_size);
        err |= setup_sigcontext(&frame->uc.uc_mcontext, regs, set->sig[0], me);
        err |= __put_user(fp, &frame->uc.uc_mcontext.fpstate);
-        if (sizeof(*set) == 16) { 
+        if (sizeof(*set) == 16) {
                __put_user(set->sig[0], &frame->uc.uc_sigmask.sig[0]);
-                __put_user(set->sig[1], &frame->uc.uc_sigmask.sig[1]); 
+                __put_user(set->sig[1], &frame->uc.uc_sigmask.sig[1]);
        } else
                err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
@@ -324,7 +324,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
                err |= __put_user(ka->sa.sa_restorer, &frame->pretcode);
        } else {
                /* could use a vstub here */
-                goto give_sigsegv; 
+                goto give_sigsegv;
        }
        if (err)
@@ -332,7 +332,7 @@ static int setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
        /* Set up registers for signal handler */
        regs->di = sig;
-        /* In case the signal handler was declared without prototypes */ 
+        /* In case the signal handler was declared without prototypes */
        regs->ax = 0;
        /* This also works for non SA_SIGINFO handlers because they expect the
@@ -355,37 +355,8 @@ give_sigsegv:
 }
 /*
- * Return -1L or the syscall number that @regs is executing.
- */
-static long current_syscall(struct pt_regs *regs)
-{
-        /*
-         * We always sign-extend a -1 value being set here,
-         * so this is always either -1L or a syscall number.
-         */
-        return regs->orig_ax;
-}
-/*
- * Return a value that is -EFOO if the system call in @regs->orig_ax
- * returned an error.  This only works for @regs from @current.
- */
-static long current_syscall_ret(struct pt_regs *regs)
-{
-#ifdef CONFIG_IA32_EMULATION
-        if (test_thread_flag(TIF_IA32))
-                /*
-                 * Sign-extend the value so (int)-EFOO becomes (long)-EFOO
-                 * and will match correctly in comparisons.
-                 */
-                return (int) regs->ax;
-#endif
-        return regs->ax;
-}
-/*
 * OK, we're invoking a handler
- */     
+ */
 static int
 handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
@@ -394,9 +365,9 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
        int ret;
        /* Are we from a system call? */
-        if (current_syscall(regs) >= 0) {
+        if (syscall_get_nr(current, regs) >= 0) {
                /* If so, check system call restarting.. */
-                switch (current_syscall_ret(regs)) {
+                switch (syscall_get_error(current, regs)) {
                case -ERESTART_RESTARTBLOCK:
                case -ERESTARTNOHAND:
                        regs->ax = -EINTR;
@@ -429,7 +400,7 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
                        ret = ia32_setup_rt_frame(sig, ka, info, oldset, regs);
                else
                        ret = ia32_setup_frame(sig, ka, oldset, regs);
-        } else 
+        } else
 #endif
        ret = setup_rt_frame(sig, ka, info, oldset, regs);
@@ -453,15 +424,16 @@ handle_signal(unsigned long sig, siginfo_t *info, struct k_sigaction *ka,
                 * handler too.
                 */
                regs->flags &= ~X86_EFLAGS_TF;
-                if (test_thread_flag(TIF_SINGLESTEP))
-                        ptrace_notify(SIGTRAP);
                spin_lock_irq(&current->sighand->siglock);
-                sigorsets(&current->blocked,&current->blocked,&ka->sa.sa_mask);
+                sigorsets(&current->blocked, &current->blocked, &ka->sa.sa_mask);
                if (!(ka->sa.sa_flags & SA_NODEFER))
-                        sigaddset(&current->blocked,sig);
+                        sigaddset(&current->blocked, sig);
                recalc_sigpending();
                spin_unlock_irq(&current->sighand->siglock);
+                tracehook_signal_handler(sig, info, ka, regs,
+                                         test_thread_flag(TIF_SINGLESTEP));
        }
        return ret;
@@ -518,9 +490,9 @@ static void do_signal(struct pt_regs *regs)
        }
        /* Did we come from a system call? */
-        if (current_syscall(regs) >= 0) {
+        if (syscall_get_nr(current, regs) >= 0) {
                /* Restart the system call - no handlers present */
-                switch (current_syscall_ret(regs)) {
+                switch (syscall_get_error(current, regs)) {
                case -ERESTARTNOHAND:
                case -ERESTARTSYS:
                case -ERESTARTNOINTR:
@@ -558,17 +530,23 @@ void do_notify_resume(struct pt_regs *regs, void *unused,
        /* deal with pending signal delivery */
        if (thread_info_flags & _TIF_SIGPENDING)
                do_signal(regs);
+        if (thread_info_flags & _TIF_NOTIFY_RESUME) {
+                clear_thread_flag(TIF_NOTIFY_RESUME);
+                tracehook_notify_resume(regs);
+        }
 }
 void signal_fault(struct pt_regs *regs, void __user *frame, char *where)
-{ 
+{
-        struct task_struct *me = current; 
+        struct task_struct *me = current;
        if (show_unhandled_signals && printk_ratelimit()) {
                printk("%s[%d] bad frame in %s frame:%p ip:%lx sp:%lx orax:%lx",
-               me->comm,me->pid,where,frame,regs->ip,regs->sp,regs->orig_ax);
+               me->comm, me->pid, where, frame, regs->ip,
+                   regs->sp, regs->orig_ax);
                print_vma_addr(" in ", regs->ip);
                printk("\n");
        }
-        force_sig(SIGSEGV, me); 
+        force_sig(SIGSEGV, me);
-} 
+}
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index 7985c5b3f916..45531e3ba194 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -88,7 +88,7 @@ static DEFINE_PER_CPU(struct task_struct *, idle_thread_array);
 #define get_idle_for_cpu(x)      (per_cpu(idle_thread_array, x))
 #define set_idle_for_cpu(x, p)   (per_cpu(idle_thread_array, x) = (p))
 #else
-struct task_struct *idle_thread_array[NR_CPUS] __cpuinitdata ;
+static struct task_struct *idle_thread_array[NR_CPUS] __cpuinitdata ;
 #define get_idle_for_cpu(x)      (idle_thread_array[(x)])
 #define set_idle_for_cpu(x, p)   (idle_thread_array[(x)] = (p))
 #endif
@@ -129,7 +129,7 @@ static int boot_cpu_logical_apicid;
 static cpumask_t cpu_sibling_setup_map;
 /* Set if we find a B stepping CPU */
-int __cpuinitdata smp_b_stepping;
+static int __cpuinitdata smp_b_stepping;
 #if defined(CONFIG_NUMA) && defined(CONFIG_X86_32)
@@ -1313,16 +1313,13 @@ __init void prefill_possible_map(void)
        if (!num_processors)
                num_processors = 1;
-#ifdef CONFIG_HOTPLUG_CPU
        if (additional_cpus == -1) {
                if (disabled_cpus > 0)
                        additional_cpus = disabled_cpus;
                else
                        additional_cpus = 0;
        }
-#else
-        additional_cpus = 0;
-#endif
        possible = num_processors + additional_cpus;
        if (possible > NR_CPUS)
                possible = NR_CPUS;
diff --git a/arch/x86/kernel/sys_i386_32.c b/arch/x86/kernel/sys_i386_32.c
index 7066cb855a60..1884a8d12bfa 100644
--- a/arch/x86/kernel/sys_i386_32.c
+++ b/arch/x86/kernel/sys_i386_32.c
@@ -22,6 +22,8 @@
 #include <linux/uaccess.h>
 #include <linux/unistd.h>
+#include <asm/syscalls.h>
 asmlinkage long sys_mmap2(unsigned long addr, unsigned long len,
                          unsigned long prot, unsigned long flags,
                          unsigned long fd, unsigned long pgoff)
diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c
index 3b360ef33817..6bc211accf08 100644
--- a/arch/x86/kernel/sys_x86_64.c
+++ b/arch/x86/kernel/sys_x86_64.c
@@ -13,15 +13,17 @@
 #include <linux/utsname.h>
 #include <linux/personality.h>
 #include <linux/random.h>
+#include <linux/uaccess.h>
-#include <asm/uaccess.h>
 #include <asm/ia32.h>
+#include <asm/syscalls.h>
-asmlinkage long sys_mmap(unsigned long addr, unsigned long len, unsigned long prot, unsigned long flags,
+asmlinkage long sys_mmap(unsigned long addr, unsigned long len,
-        unsigned long fd, unsigned long off)
+                unsigned long prot, unsigned long flags,
+                unsigned long fd, unsigned long off)
 {
        long error;
-        struct file * file;
+        struct file *file;
        error = -EINVAL;
        if (off & ~PAGE_MASK)
@@ -56,9 +58,9 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
                   unmapped base down for this case. This can give
                   conflicts with the heap, but we assume that glibc
                   malloc knows how to fall back to mmap. Give it 1GB
-                   of playground for now. -AK */ 
+                   of playground for now. -AK */
-                *begin = 0x40000000; 
+                *begin = 0x40000000;
-                *end = 0x80000000;              
+                *end = 0x80000000;
                if (current->flags & PF_RANDOMIZE) {
                        new_begin = randomize_range(*begin, *begin + 0x02000000, 0);
                        if (new_begin)
@@ -66,9 +68,9 @@ static void find_start_end(unsigned long flags, unsigned long *begin,
                }
        } else {
                *begin = TASK_UNMAPPED_BASE;
-                *end = TASK_SIZE; 
+                *end = TASK_SIZE;
        }
-} 
+}
 unsigned long
 arch_get_unmapped_area(struct file *filp, unsigned long addr,
@@ -78,11 +80,11 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
        struct vm_area_struct *vma;
        unsigned long start_addr;
        unsigned long begin, end;
-        
        if (flags & MAP_FIXED)
                return addr;
-        find_start_end(flags, &begin, &end); 
+        find_start_end(flags, &begin, &end);
        if (len > end)
                return -ENOMEM;
@@ -96,12 +98,12 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr,
        }
        if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
            && len <= mm->cached_hole_size) {
-                mm->cached_hole_size = 0;
+                mm->cached_hole_size = 0;
                mm->free_area_cache = begin;
        }
        addr = mm->free_area_cache;
-        if (addr < begin) 
+        if (addr < begin)
-                addr = begin; 
+                addr = begin;
        start_addr = addr;
 full_search:
@@ -127,7 +129,7 @@ full_search:
                        return addr;
                }
                if (addr + mm->cached_hole_size < vma->vm_start)
-                        mm->cached_hole_size = vma->vm_start - addr;
+                        mm->cached_hole_size = vma->vm_start - addr;
                addr = vma->vm_end;
        }
@@ -177,7 +179,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                vma = find_vma(mm, addr-len);
                if (!vma || addr <= vma->vm_start)
                        /* remember the address as a hint for next time */
-                        return (mm->free_area_cache = addr-len);
+                        return mm->free_area_cache = addr-len;
        }
        if (mm->mmap_base < len)
@@ -194,7 +196,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
                vma = find_vma(mm, addr);
                if (!vma || addr+len <= vma->vm_start)
                        /* remember the address as a hint for next time */
-                        return (mm->free_area_cache = addr);
+                        return mm->free_area_cache = addr;
                /* remember the largest hole we saw so far */
                if (addr + mm->cached_hole_size < vma->vm_start)
@@ -224,13 +226,13 @@ bottomup:
 }
-asmlinkage long sys_uname(struct new_utsname __user * name)
+asmlinkage long sys_uname(struct new_utsname __user *name)
 {
        int err;
        down_read(&uts_sem);
-        err = copy_to_user(name, utsname(), sizeof (*name));
+        err = copy_to_user(name, utsname(), sizeof(*name));
        up_read(&uts_sem);
-        if (personality(current->personality) == PER_LINUX32) 
+        if (personality(current->personality) == PER_LINUX32)
-                err |= copy_to_user(&name->machine, "i686", 5);                 
+                err |= copy_to_user(&name->machine, "i686", 5);
        return err ? -EFAULT : 0;
 }
diff --git a/arch/x86/kernel/syscall_64.c b/arch/x86/kernel/syscall_64.c
index 170d43c17487..3d1be4f0fac5 100644
--- a/arch/x86/kernel/syscall_64.c
+++ b/arch/x86/kernel/syscall_64.c
@@ -8,12 +8,12 @@
 #define __NO_STUBS
 #define __SYSCALL(nr, sym) extern asmlinkage void sym(void) ;
-#undef _ASM_X86_64_UNISTD_H_
+#undef ASM_X86__UNISTD_64_H
 #include <asm/unistd_64.h>
 #undef __SYSCALL
 #define __SYSCALL(nr, sym) [nr] = sym,
-#undef _ASM_X86_64_UNISTD_H_
+#undef ASM_X86__UNISTD_64_H
 typedef void (*sys_call_ptr_t)(void);
diff --git a/arch/x86/kernel/time_32.c b/arch/x86/kernel/time_32.c
index ffe3c664afc0..bbecf8b6bf96 100644
--- a/arch/x86/kernel/time_32.c
+++ b/arch/x86/kernel/time_32.c
@@ -36,6 +36,7 @@
 #include <asm/arch_hooks.h>
 #include <asm/hpet.h>
 #include <asm/time.h>
+#include <asm/timer.h>
 #include "do_timer.h"
diff --git a/arch/x86/kernel/tls.c b/arch/x86/kernel/tls.c
index ab6bf375a307..6bb7b8579e70 100644
--- a/arch/x86/kernel/tls.c
+++ b/arch/x86/kernel/tls.c
@@ -10,6 +10,7 @@
 #include <asm/ldt.h>
 #include <asm/processor.h>
 #include <asm/proto.h>
+#include <asm/syscalls.h>
 #include "tls.h"
diff --git a/arch/x86/kernel/traps_64.c b/arch/x86/kernel/traps_64.c
index 513caaca7115..7a31f104bef9 100644
--- a/arch/x86/kernel/traps_64.c
+++ b/arch/x86/kernel/traps_64.c
@@ -32,6 +32,8 @@
 #include <linux/bug.h>
 #include <linux/nmi.h>
 #include <linux/mm.h>
+#include <linux/smp.h>
+#include <linux/io.h>
 #if defined(CONFIG_EDAC)
 #include <linux/edac.h>
@@ -45,9 +47,6 @@
 #include <asm/unwind.h>
 #include <asm/desc.h>
 #include <asm/i387.h>
-#include <asm/nmi.h>
-#include <asm/smp.h>
-#include <asm/io.h>
 #include <asm/pgalloc.h>
 #include <asm/proto.h>
 #include <asm/pda.h>
@@ -85,7 +84,8 @@ static inline void preempt_conditional_cli(struct pt_regs *regs)
 void printk_address(unsigned long address, int reliable)
 {
-        printk(" [<%016lx>] %s%pS\n", address, reliable ? "": "? ", (void *) address);
+        printk(" [<%016lx>] %s%pS\n",
+                        address, reliable ?     "" : "? ", (void *) address);
 }
 static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
@@ -98,7 +98,8 @@ static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
                [STACKFAULT_STACK - 1] = "#SS",
                [MCE_STACK - 1] = "#MC",
 #if DEBUG_STKSZ > EXCEPTION_STKSZ
-                [N_EXCEPTION_STACKS ... N_EXCEPTION_STACKS + DEBUG_STKSZ / EXCEPTION_STKSZ - 2] = "#DB[?]"
+                [N_EXCEPTION_STACKS ...
+                        N_EXCEPTION_STACKS + DEBUG_STKSZ / EXCEPTION_STKSZ - 2] = "#DB[?]"
 #endif
        };
        unsigned k;
@@ -163,7 +164,7 @@ static unsigned long *in_exception_stack(unsigned cpu, unsigned long stack,
 }
 /*
- * x86-64 can have up to three kernel stacks: 
+ * x86-64 can have up to three kernel stacks:
 * process stack
 * interrupt stack
 * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
@@ -219,7 +220,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
                const struct stacktrace_ops *ops, void *data)
 {
        const unsigned cpu = get_cpu();
-        unsigned long *irqstack_end = (unsigned long*)cpu_pda(cpu)->irqstackptr;
+        unsigned long *irqstack_end = (unsigned long *)cpu_pda(cpu)->irqstackptr;
        unsigned used = 0;
        struct thread_info *tinfo;
@@ -237,7 +238,7 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
        if (!bp) {
                if (task == current) {
                        /* Grab bp right from our regs */
-                        asm("movq %%rbp, %0" : "=r" (bp) :);
+                        asm("movq %%rbp, %0" : "=r" (bp) : );
                } else {
                        /* bp is the last reg pushed by switch_to */
                        bp = *(unsigned long *) task->thread.sp;
@@ -339,9 +340,8 @@ static void
 show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs,
                unsigned long *stack, unsigned long bp, char *log_lvl)
 {
-        printk("\nCall Trace:\n");
+        printk("Call Trace:\n");
        dump_trace(task, regs, stack, bp, &print_trace_ops, log_lvl);
-        printk("\n");
 }
 void show_trace(struct task_struct *task, struct pt_regs *regs,
@@ -357,11 +357,15 @@ show_stack_log_lvl(struct task_struct *task, struct pt_regs *regs,
        unsigned long *stack;
        int i;
        const int cpu = smp_processor_id();
-        unsigned long *irqstack_end = (unsigned long *) (cpu_pda(cpu)->irqstackptr);
+        unsigned long *irqstack_end =
-        unsigned long *irqstack = (unsigned long *) (cpu_pda(cpu)->irqstackptr - IRQSTACKSIZE);
+                (unsigned long *) (cpu_pda(cpu)->irqstackptr);
+        unsigned long *irqstack =
+                (unsigned long *) (cpu_pda(cpu)->irqstackptr - IRQSTACKSIZE);
-        // debugging aid: "show_stack(NULL, NULL);" prints the
+        /*
-        // back trace for this cpu.
+         * debugging aid: "show_stack(NULL, NULL);" prints the
+         * back trace for this cpu.
+         */
        if (sp == NULL) {
                if (task)
@@ -386,6 +390,7 @@ show_stack_log_lvl(struct task_struct *task, struct pt_regs *regs,
                printk(" %016lx", *stack++);
                touch_nmi_watchdog();
        }
+        printk("\n");
        show_trace_log_lvl(task, regs, sp, bp, log_lvl);
 }
@@ -404,7 +409,7 @@ void dump_stack(void)
 #ifdef CONFIG_FRAME_POINTER
        if (!bp)
-                asm("movq %%rbp, %0" : "=r" (bp):);
+                asm("movq %%rbp, %0" : "=r" (bp) : );
 #endif
        printk("Pid: %d, comm: %.20s %s %s %.*s\n",
@@ -414,7 +419,6 @@ void dump_stack(void)
                init_utsname()->version);
        show_trace(NULL, NULL, &stack, bp);
 }
 EXPORT_SYMBOL(dump_stack);
 void show_registers(struct pt_regs *regs)
@@ -443,7 +447,6 @@ void show_registers(struct pt_regs *regs)
                printk("Stack: ");
                show_stack_log_lvl(NULL, regs, (unsigned long *)sp,
                                regs->bp, "");
-                printk("\n");
                printk(KERN_EMERG "Code: ");
@@ -493,7 +496,7 @@ unsigned __kprobes long oops_begin(void)
        raw_local_irq_save(flags);
        cpu = smp_processor_id();
        if (!__raw_spin_trylock(&die_lock)) {
-                if (cpu == die_owner) 
+                if (cpu == die_owner)
                        /* nested oops. should stop eventually */;
                else
                        __raw_spin_lock(&die_lock);
@@ -638,7 +641,7 @@ kernel_trap:
 }
 #define DO_ERROR(trapnr, signr, str, name) \
-asmlinkage void do_##name(struct pt_regs * regs, long error_code)       \
+asmlinkage void do_##name(struct pt_regs *regs, long error_code)        \
 {                                                                       \
        if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, signr)  \
                                                        == NOTIFY_STOP) \
@@ -648,7 +651,7 @@ asmlinkage void do_##name(struct pt_regs * regs, long error_code)	\
 }
 #define DO_ERROR_INFO(trapnr, signr, str, name, sicode, siaddr)         \
-asmlinkage void do_##name(struct pt_regs * regs, long error_code)       \
+asmlinkage void do_##name(struct pt_regs *regs, long error_code)        \
 {                                                                       \
        siginfo_t info;                                                 \
        info.si_signo = signr;                                          \
@@ -683,7 +686,7 @@ asmlinkage void do_stack_segment(struct pt_regs *regs, long error_code)
        preempt_conditional_cli(regs);
 }
-asmlinkage void do_double_fault(struct pt_regs * regs, long error_code)
+asmlinkage void do_double_fault(struct pt_regs *regs, long error_code)
 {
        static const char str[] = "double fault";
        struct task_struct *tsk = current;
@@ -778,9 +781,10 @@ io_check_error(unsigned char reason, struct pt_regs *regs)
 }
 static notrace __kprobes void
-unknown_nmi_error(unsigned char reason, struct pt_regs * regs)
+unknown_nmi_error(unsigned char reason, struct pt_regs *regs)
 {
-        if (notify_die(DIE_NMIUNKNOWN, "nmi", regs, reason, 2, SIGINT) == NOTIFY_STOP)
+        if (notify_die(DIE_NMIUNKNOWN, "nmi", regs, reason, 2, SIGINT) ==
+                        NOTIFY_STOP)
                return;
        printk(KERN_EMERG "Uhhuh. NMI received for unknown reason %02x.\n",
                reason);
@@ -882,7 +886,7 @@ asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
        else if (user_mode(eregs))
                regs = task_pt_regs(current);
        /* Exception from kernel and interrupts are enabled. Move to
-           kernel process stack. */
+           kernel process stack. */
        else if (eregs->flags & X86_EFLAGS_IF)
                regs = (struct pt_regs *)(eregs->sp -= sizeof(struct pt_regs));
        if (eregs != regs)
@@ -891,7 +895,7 @@ asmlinkage __kprobes struct pt_regs *sync_regs(struct pt_regs *eregs)
 }
 /* runs on IST stack. */
-asmlinkage void __kprobes do_debug(struct pt_regs * regs,
+asmlinkage void __kprobes do_debug(struct pt_regs *regs,
                                   unsigned long error_code)
 {
        struct task_struct *tsk = current;
@@ -1035,7 +1039,7 @@ asmlinkage void do_coprocessor_error(struct pt_regs *regs)
 asmlinkage void bad_intr(void)
 {
-        printk("bad interrupt"); 
+        printk("bad interrupt");
 }
 asmlinkage void do_simd_coprocessor_error(struct pt_regs *regs)
@@ -1047,7 +1051,7 @@ asmlinkage void do_simd_coprocessor_error(struct pt_regs *regs)
        conditional_sti(regs);
        if (!user_mode(regs) &&
-                kernel_math_error(regs, "kernel simd math error", 19))
+                        kernel_math_error(regs, "kernel simd math error", 19))
                return;
        /*
@@ -1092,7 +1096,7 @@ asmlinkage void do_simd_coprocessor_error(struct pt_regs *regs)
        force_sig_info(SIGFPE, &info, task);
 }
-asmlinkage void do_spurious_interrupt_bug(struct pt_regs * regs)
+asmlinkage void do_spurious_interrupt_bug(struct pt_regs *regs)
 {
 }
@@ -1149,8 +1153,10 @@ void __init trap_init(void)
        set_intr_gate(0, &divide_error);
        set_intr_gate_ist(1, &debug, DEBUG_STACK);
        set_intr_gate_ist(2, &nmi, NMI_STACK);
-        set_system_gate_ist(3, &int3, DEBUG_STACK); /* int3 can be called from all */
+        /* int3 can be called from all */
-        set_system_gate(4, &overflow); /* int4 can be called from all */
+        set_system_gate_ist(3, &int3, DEBUG_STACK);
+        /* int4 can be called from all */
+        set_system_gate(4, &overflow);
        set_intr_gate(5, &bounds);
        set_intr_gate(6, &invalid_op);
        set_intr_gate(7, &device_not_available);
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 8f98e9de1b82..161bb850fc47 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -104,7 +104,7 @@ __setup("notsc", notsc_setup);
 /*
 * Read TSC and the reference counters. Take care of SMI disturbance
 */
-static u64 tsc_read_refs(u64 *pm, u64 *hpet)
+static u64 tsc_read_refs(u64 *p, int hpet)
 {
        u64 t1, t2;
        int i;
@@ -112,9 +112,9 @@ static u64 tsc_read_refs(u64 *pm, u64 *hpet)
        for (i = 0; i < MAX_RETRIES; i++) {
                t1 = get_cycles();
                if (hpet)
-                        *hpet = hpet_readl(HPET_COUNTER) & 0xFFFFFFFF;
+                        *p = hpet_readl(HPET_COUNTER) & 0xFFFFFFFF;
                else
-                        *pm = acpi_pm_read_early();
+                        *p = acpi_pm_read_early();
                t2 = get_cycles();
                if ((t2 - t1) < SMI_TRESHOLD)
                        return t2;
@@ -123,13 +123,59 @@ static u64 tsc_read_refs(u64 *pm, u64 *hpet)
 }
 /*
+ * Calculate the TSC frequency from HPET reference
+ */
+static unsigned long calc_hpet_ref(u64 deltatsc, u64 hpet1, u64 hpet2)
+{
+        u64 tmp;
+        if (hpet2 < hpet1)
+                hpet2 += 0x100000000ULL;
+        hpet2 -= hpet1;
+        tmp = ((u64)hpet2 * hpet_readl(HPET_PERIOD));
+        do_div(tmp, 1000000);
+        do_div(deltatsc, tmp);
+        return (unsigned long) deltatsc;
+}
+/*
+ * Calculate the TSC frequency from PMTimer reference
+ */
+static unsigned long calc_pmtimer_ref(u64 deltatsc, u64 pm1, u64 pm2)
+{
+        u64 tmp;
+        if (!pm1 && !pm2)
+                return ULONG_MAX;
+        if (pm2 < pm1)
+                pm2 += (u64)ACPI_PM_OVRRUN;
+        pm2 -= pm1;
+        tmp = pm2 * 1000000000LL;
+        do_div(tmp, PMTMR_TICKS_PER_SEC);
+        do_div(deltatsc, tmp);
+        return (unsigned long) deltatsc;
+}
+#define CAL_MS          10
+#define CAL_LATCH       (CLOCK_TICK_RATE / (1000 / CAL_MS))
+#define CAL_PIT_LOOPS   1000
+#define CAL2_MS         50
+#define CAL2_LATCH      (CLOCK_TICK_RATE / (1000 / CAL2_MS))
+#define CAL2_PIT_LOOPS  5000
+/*
 * Try to calibrate the TSC against the Programmable
 * Interrupt Timer and return the frequency of the TSC
 * in kHz.
 *
 * Return ULONG_MAX on failure to calibrate.
 */
-static unsigned long pit_calibrate_tsc(void)
+static unsigned long pit_calibrate_tsc(u32 latch, unsigned long ms, int loopmin)
 {
        u64 tsc, t1, t2, delta;
        unsigned long tscmin, tscmax;
@@ -144,8 +190,8 @@ static unsigned long pit_calibrate_tsc(void)
         * (LSB then MSB) to begin countdown.
         */
        outb(0xb0, 0x43);
-        outb((CLOCK_TICK_RATE / (1000 / 50)) & 0xff, 0x42);
+        outb(latch & 0xff, 0x42);
-        outb((CLOCK_TICK_RATE / (1000 / 50)) >> 8, 0x42);
+        outb(latch >> 8, 0x42);
        tsc = t1 = t2 = get_cycles();
@@ -166,31 +212,154 @@ static unsigned long pit_calibrate_tsc(void)
        /*
         * Sanity checks:
         *
-         * If we were not able to read the PIT more than 5000
+         * If we were not able to read the PIT more than loopmin
         * times, then we have been hit by a massive SMI
         *
         * If the maximum is 10 times larger than the minimum,
         * then we got hit by an SMI as well.
         */
-        if (pitcnt < 5000 || tscmax > 10 * tscmin)
+        if (pitcnt < loopmin || tscmax > 10 * tscmin)
                return ULONG_MAX;
        /* Calculate the PIT value */
        delta = t2 - t1;
-        do_div(delta, 50);
+        do_div(delta, ms);
        return delta;
 }
+/*
+ * This reads the current MSB of the PIT counter, and
+ * checks if we are running on sufficiently fast and
+ * non-virtualized hardware.
+ *
+ * Our expectations are:
+ *
+ *  - the PIT is running at roughly 1.19MHz
+ *
+ *  - each IO is going to take about 1us on real hardware,
+ *    but we allow it to be much faster (by a factor of 10) or
+ *    _slightly_ slower (ie we allow up to a 2us read+counter
+ *    update - anything else implies a unacceptably slow CPU
+ *    or PIT for the fast calibration to work.
+ *
+ *  - with 256 PIT ticks to read the value, we have 214us to
+ *    see the same MSB (and overhead like doing a single TSC
+ *    read per MSB value etc).
+ *
+ *  - We're doing 2 reads per loop (LSB, MSB), and we expect
+ *    them each to take about a microsecond on real hardware.
+ *    So we expect a count value of around 100. But we'll be
+ *    generous, and accept anything over 50.
+ *
+ *  - if the PIT is stuck, and we see *many* more reads, we
+ *    return early (and the next caller of pit_expect_msb()
+ *    then consider it a failure when they don't see the
+ *    next expected value).
+ *
+ * These expectations mean that we know that we have seen the
+ * transition from one expected value to another with a fairly
+ * high accuracy, and we didn't miss any events. We can thus
+ * use the TSC value at the transitions to calculate a pretty
+ * good value for the TSC frequencty.
+ */
+static inline int pit_expect_msb(unsigned char val)
+{
+        int count = 0;
+        for (count = 0; count < 50000; count++) {
+                /* Ignore LSB */
+                inb(0x42);
+                if (inb(0x42) != val)
+                        break;
+        }
+        return count > 50;
+}
+/*
+ * How many MSB values do we want to see? We aim for a
+ * 15ms calibration, which assuming a 2us counter read
+ * error should give us roughly 150 ppm precision for
+ * the calibration.
+ */
+#define QUICK_PIT_MS 15
+#define QUICK_PIT_ITERATIONS (QUICK_PIT_MS * PIT_TICK_RATE / 1000 / 256)
+static unsigned long quick_pit_calibrate(void)
+{
+        /* Set the Gate high, disable speaker */
+        outb((inb(0x61) & ~0x02) | 0x01, 0x61);
+        /*
+         * Counter 2, mode 0 (one-shot), binary count
+         *
+         * NOTE! Mode 2 decrements by two (and then the
+         * output is flipped each time, giving the same
+         * final output frequency as a decrement-by-one),
+         * so mode 0 is much better when looking at the
+         * individual counts.
+         */
+        outb(0xb0, 0x43);
+        /* Start at 0xffff */
+        outb(0xff, 0x42);
+        outb(0xff, 0x42);
+        if (pit_expect_msb(0xff)) {
+                int i;
+                u64 t1, t2, delta;
+                unsigned char expect = 0xfe;
+                t1 = get_cycles();
+                for (i = 0; i < QUICK_PIT_ITERATIONS; i++, expect--) {
+                        if (!pit_expect_msb(expect))
+                                goto failed;
+                }
+                t2 = get_cycles();
+                /*
+                 * Make sure we can rely on the second TSC timestamp:
+                 */
+                if (!pit_expect_msb(expect))
+                        goto failed;
+                /*
+                 * Ok, if we get here, then we've seen the
+                 * MSB of the PIT decrement QUICK_PIT_ITERATIONS
+                 * times, and each MSB had many hits, so we never
+                 * had any sudden jumps.
+                 *
+                 * As a result, we can depend on there not being
+                 * any odd delays anywhere, and the TSC reads are
+                 * reliable.
+                 *
+                 * kHz = ticks / time-in-seconds / 1000;
+                 * kHz = (t2 - t1) / (QPI * 256 / PIT_TICK_RATE) / 1000
+                 * kHz = ((t2 - t1) * PIT_TICK_RATE) / (QPI * 256 * 1000)
+                 */
+                delta = (t2 - t1)*PIT_TICK_RATE;
+                do_div(delta, QUICK_PIT_ITERATIONS*256*1000);
+                printk("Fast TSC calibration using PIT\n");
+                return delta;
+        }
+failed:
+        return 0;
+}
 /**
 * native_calibrate_tsc - calibrate the tsc on boot
 */
 unsigned long native_calibrate_tsc(void)
 {
-        u64 tsc1, tsc2, delta, pm1, pm2, hpet1, hpet2;
+        u64 tsc1, tsc2, delta, ref1, ref2;
        unsigned long tsc_pit_min = ULONG_MAX, tsc_ref_min = ULONG_MAX;
-        unsigned long flags;
+        unsigned long flags, latch, ms, fast_calibrate;
-        int hpet = is_hpet_enabled(), i;
+        int hpet = is_hpet_enabled(), i, loopmin;
+        local_irq_save(flags);
+        fast_calibrate = quick_pit_calibrate();
+        local_irq_restore(flags);
+        if (fast_calibrate)
+                return fast_calibrate;
        /*
         * Run 5 calibration loops to get the lowest frequency value
@@ -216,7 +385,13 @@ unsigned long native_calibrate_tsc(void)
         * calibration delay loop as we have to wait for a certain
         * amount of time anyway.
         */
-        for (i = 0; i < 5; i++) {
+        /* Preset PIT loop values */
+        latch = CAL_LATCH;
+        ms = CAL_MS;
+        loopmin = CAL_PIT_LOOPS;
+        for (i = 0; i < 3; i++) {
                unsigned long tsc_pit_khz;
                /*
@@ -226,16 +401,16 @@ unsigned long native_calibrate_tsc(void)
                 * read the end value.
                 */
                local_irq_save(flags);
-                tsc1 = tsc_read_refs(&pm1, hpet ? &hpet1 : NULL);
+                tsc1 = tsc_read_refs(&ref1, hpet);
-                tsc_pit_khz = pit_calibrate_tsc();
+                tsc_pit_khz = pit_calibrate_tsc(latch, ms, loopmin);
-                tsc2 = tsc_read_refs(&pm2, hpet ? &hpet2 : NULL);
+                tsc2 = tsc_read_refs(&ref2, hpet);
                local_irq_restore(flags);
                /* Pick the lowest PIT TSC calibration so far */
                tsc_pit_min = min(tsc_pit_min, tsc_pit_khz);
                /* hpet or pmtimer available ? */
-                if (!hpet && !pm1 && !pm2)
+                if (!hpet && !ref1 && !ref2)
                        continue;
                /* Check, whether the sampling was disturbed by an SMI */
@@ -243,23 +418,41 @@ unsigned long native_calibrate_tsc(void)
                        continue;
                tsc2 = (tsc2 - tsc1) * 1000000LL;
+                if (hpet)
+                        tsc2 = calc_hpet_ref(tsc2, ref1, ref2);
+                else
+                        tsc2 = calc_pmtimer_ref(tsc2, ref1, ref2);
-                if (hpet) {
+                tsc_ref_min = min(tsc_ref_min, (unsigned long) tsc2);
-                        if (hpet2 < hpet1)
-                                hpet2 += 0x100000000ULL;
+                /* Check the reference deviation */
-                        hpet2 -= hpet1;
+                delta = ((u64) tsc_pit_min) * 100;
-                        tsc1 = ((u64)hpet2 * hpet_readl(HPET_PERIOD));
+                do_div(delta, tsc_ref_min);
-                        do_div(tsc1, 1000000);
-                } else {
+                /*
-                        if (pm2 < pm1)
+                 * If both calibration results are inside a 10% window
-                                pm2 += (u64)ACPI_PM_OVRRUN;
+                 * then we can be sure, that the calibration
-                        pm2 -= pm1;
+                 * succeeded. We break out of the loop right away. We
-                        tsc1 = pm2 * 1000000000LL;
+                 * use the reference value, as it is more precise.
-                        do_div(tsc1, PMTMR_TICKS_PER_SEC);
+                 */
+                if (delta >= 90 && delta <= 110) {
+                        printk(KERN_INFO
+                               "TSC: PIT calibration matches %s. %d loops\n",
+                               hpet ? "HPET" : "PMTIMER", i + 1);
+                        return tsc_ref_min;
                }
-                do_div(tsc2, tsc1);
+                /*
-                tsc_ref_min = min(tsc_ref_min, (unsigned long) tsc2);
+                 * Check whether PIT failed more than once. This
+                 * happens in virtualized environments. We need to
+                 * give the virtual PC a slightly longer timeframe for
+                 * the HPET/PMTIMER to make the result precise.
+                 */
+                if (i == 1 && tsc_pit_min == ULONG_MAX) {
+                        latch = CAL2_LATCH;
+                        ms = CAL2_MS;
+                        loopmin = CAL2_PIT_LOOPS;
+                }
        }
        /*
@@ -270,7 +463,7 @@ unsigned long native_calibrate_tsc(void)
                printk(KERN_WARNING "TSC: Unable to calibrate against PIT\n");
                /* We don't have an alternative source, disable TSC */
-                if (!hpet && !pm1 && !pm2) {
+                if (!hpet && !ref1 && !ref2) {
                        printk("TSC: No reference (HPET/PMTIMER) available\n");
                        return 0;
                }
@@ -278,7 +471,7 @@ unsigned long native_calibrate_tsc(void)
                /* The alternative source failed as well, disable TSC */
                if (tsc_ref_min == ULONG_MAX) {
                        printk(KERN_WARNING "TSC: HPET/PMTIMER calibration "
-                               "failed due to SMI disturbance.\n");
+                               "failed.\n");
                        return 0;
                }
@@ -290,44 +483,25 @@ unsigned long native_calibrate_tsc(void)
        }
        /* We don't have an alternative source, use the PIT calibration value */
-        if (!hpet && !pm1 && !pm2) {
+        if (!hpet && !ref1 && !ref2) {
                printk(KERN_INFO "TSC: Using PIT calibration value\n");
                return tsc_pit_min;
        }
        /* The alternative source failed, use the PIT calibration value */
        if (tsc_ref_min == ULONG_MAX) {
-                printk(KERN_WARNING "TSC: HPET/PMTIMER calibration failed due "
+                printk(KERN_WARNING "TSC: HPET/PMTIMER calibration failed. "
-                       "to SMI disturbance. Using PIT calibration\n");
+                       "Using PIT calibration\n");
                return tsc_pit_min;
        }
-        /* Check the reference deviation */
-        delta = ((u64) tsc_pit_min) * 100;
-        do_div(delta, tsc_ref_min);
-        /*
-         * If both calibration results are inside a 5% window, the we
-         * use the lower frequency of those as it is probably the
-         * closest estimate.
-         */
-        if (delta >= 95 && delta <= 105) {
-                printk(KERN_INFO "TSC: PIT calibration confirmed by %s.\n",
-                       hpet ? "HPET" : "PMTIMER");
-                printk(KERN_INFO "TSC: using %s calibration value\n",
-                       tsc_pit_min <= tsc_ref_min ? "PIT" :
-                       hpet ? "HPET" : "PMTIMER");
-                return tsc_pit_min <= tsc_ref_min ? tsc_pit_min : tsc_ref_min;
-        }
-        printk(KERN_WARNING "TSC: PIT calibration deviates from %s: %lu %lu.\n",
-               hpet ? "HPET" : "PMTIMER", tsc_pit_min, tsc_ref_min);
        /*
         * The calibration values differ too much. In doubt, we use
         * the PIT value as we know that there are PMTIMERs around
-         * running at double speed.
+         * running at double speed. At least we let the user know:
         */
+        printk(KERN_WARNING "TSC: PIT calibration deviates from %s: %lu %lu.\n",
+               hpet ? "HPET" : "PMTIMER", tsc_pit_min, tsc_ref_min);
        printk(KERN_INFO "TSC: Using PIT calibration value\n");
        return tsc_pit_min;
 }
diff --git a/arch/x86/kernel/visws_quirks.c b/arch/x86/kernel/visws_quirks.c
index 594ef47f0a63..61a97e616f70 100644
--- a/arch/x86/kernel/visws_quirks.c
+++ b/arch/x86/kernel/visws_quirks.c
@@ -25,45 +25,31 @@
 #include <asm/visws/cobalt.h>
 #include <asm/visws/piix4.h>
 #include <asm/arch_hooks.h>
+#include <asm/io_apic.h>
 #include <asm/fixmap.h>
 #include <asm/reboot.h>
 #include <asm/setup.h>
 #include <asm/e820.h>
-#include <asm/smp.h>
 #include <asm/io.h>
 #include <mach_ipi.h>
 #include "mach_apic.h"
-#include <linux/init.h>
-#include <linux/smp.h>
 #include <linux/kernel_stat.h>
-#include <linux/interrupt.h>
-#include <linux/init.h>
-#include <asm/io.h>
-#include <asm/apic.h>
 #include <asm/i8259.h>
 #include <asm/irq_vectors.h>
-#include <asm/visws/cobalt.h>
 #include <asm/visws/lithium.h>
-#include <asm/visws/piix4.h>
 #include <linux/sched.h>
 #include <linux/kernel.h>
-#include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/pci_ids.h>
 extern int no_broadcast;
-#include <asm/io.h>
 #include <asm/apic.h>
-#include <asm/arch_hooks.h>
-#include <asm/visws/cobalt.h>
-#include <asm/visws/lithium.h>
 char visws_board_type   = -1;
 char visws_board_rev    = -1;
diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
index 38f566fa27d2..4eeb5cf9720d 100644
--- a/arch/x86/kernel/vm86_32.c
+++ b/arch/x86/kernel/vm86_32.c
@@ -46,6 +46,7 @@
 #include <asm/io.h>
 #include <asm/tlbflush.h>
 #include <asm/irq.h>
+#include <asm/syscalls.h>
 /*
 * Known problems:
diff --git a/arch/x86/kernel/vmi_32.c b/arch/x86/kernel/vmi_32.c
index 6ca515d6db54..8c9ad02af5a2 100644
--- a/arch/x86/kernel/vmi_32.c
+++ b/arch/x86/kernel/vmi_32.c
@@ -235,7 +235,7 @@ static void vmi_write_ldt_entry(struct desc_struct *dt, int entry,
                                const void *desc)
 {
        u32 *ldt_entry = (u32 *)desc;
-        vmi_ops.write_idt_entry(dt, entry, ldt_entry[0], ldt_entry[1]);
+        vmi_ops.write_ldt_entry(dt, entry, ldt_entry[0], ldt_entry[1]);
 }
 static void vmi_load_sp0(struct tss_struct *tss,
@@ -393,13 +393,13 @@ static void *vmi_kmap_atomic_pte(struct page *page, enum km_type type)
 }
 #endif
-static void vmi_allocate_pte(struct mm_struct *mm, u32 pfn)
+static void vmi_allocate_pte(struct mm_struct *mm, unsigned long pfn)
 {
        vmi_set_page_type(pfn, VMI_PAGE_L1);
        vmi_ops.allocate_page(pfn, VMI_PAGE_L1, 0, 0, 0);
 }
-static void vmi_allocate_pmd(struct mm_struct *mm, u32 pfn)
+static void vmi_allocate_pmd(struct mm_struct *mm, unsigned long pfn)
 {
        /*
         * This call comes in very early, before mem_map is setup.
@@ -410,20 +410,20 @@ static void vmi_allocate_pmd(struct mm_struct *mm, u32 pfn)
        vmi_ops.allocate_page(pfn, VMI_PAGE_L2, 0, 0, 0);
 }
-static void vmi_allocate_pmd_clone(u32 pfn, u32 clonepfn, u32 start, u32 count)
+static void vmi_allocate_pmd_clone(unsigned long pfn, unsigned long clonepfn, unsigned long start, unsigned long count)
 {
        vmi_set_page_type(pfn, VMI_PAGE_L2 | VMI_PAGE_CLONE);
        vmi_check_page_type(clonepfn, VMI_PAGE_L2);
        vmi_ops.allocate_page(pfn, VMI_PAGE_L2 | VMI_PAGE_CLONE, clonepfn, start, count);
 }
-static void vmi_release_pte(u32 pfn)
+static void vmi_release_pte(unsigned long pfn)
 {
        vmi_ops.release_page(pfn, VMI_PAGE_L1);
        vmi_set_page_type(pfn, VMI_PAGE_NORMAL);
 }
-static void vmi_release_pmd(u32 pfn)
+static void vmi_release_pmd(unsigned long pfn)
 {
        vmi_ops.release_page(pfn, VMI_PAGE_L2);
        vmi_set_page_type(pfn, VMI_PAGE_NORMAL);
diff --git a/arch/x86/lib/msr-on-cpu.c b/arch/x86/lib/msr-on-cpu.c
index 01b868ba82f8..321cf720dbb6 100644
--- a/arch/x86/lib/msr-on-cpu.c
+++ b/arch/x86/lib/msr-on-cpu.c
@@ -16,37 +16,46 @@ static void __rdmsr_on_cpu(void *info)
        rdmsr(rv->msr_no, rv->l, rv->h);
 }
-static void __rdmsr_safe_on_cpu(void *info)
+static void __wrmsr_on_cpu(void *info)
 {
        struct msr_info *rv = info;
-        rv->err = rdmsr_safe(rv->msr_no, &rv->l, &rv->h);
+        wrmsr(rv->msr_no, rv->l, rv->h);
 }
-static int _rdmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h, int safe)
+int rdmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h)
 {
-        int err = 0;
+        int err;
        struct msr_info rv;
        rv.msr_no = msr_no;
-        if (safe) {
+        err = smp_call_function_single(cpu, __rdmsr_on_cpu, &rv, 1);
-                err = smp_call_function_single(cpu, __rdmsr_safe_on_cpu,
-                                               &rv, 1);
-                err = err ? err : rv.err;
-        } else {
-                err = smp_call_function_single(cpu, __rdmsr_on_cpu, &rv, 1);
-        }
        *l = rv.l;
        *h = rv.h;
        return err;
 }
-static void __wrmsr_on_cpu(void *info)
+int wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
+{
+        int err;
+        struct msr_info rv;
+        rv.msr_no = msr_no;
+        rv.l = l;
+        rv.h = h;
+        err = smp_call_function_single(cpu, __wrmsr_on_cpu, &rv, 1);
+        return err;
+}
+/* These "safe" variants are slower and should be used when the target MSR
+   may not actually exist. */
+static void __rdmsr_safe_on_cpu(void *info)
 {
        struct msr_info *rv = info;
-        wrmsr(rv->msr_no, rv->l, rv->h);
+        rv->err = rdmsr_safe(rv->msr_no, &rv->l, &rv->h);
 }
 static void __wrmsr_safe_on_cpu(void *info)
@@ -56,45 +65,30 @@ static void __wrmsr_safe_on_cpu(void *info)
        rv->err = wrmsr_safe(rv->msr_no, rv->l, rv->h);
 }
-static int _wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h, int safe)
+int rdmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h)
 {
-        int err = 0;
+        int err;
        struct msr_info rv;
        rv.msr_no = msr_no;
-        rv.l = l;
+        err = smp_call_function_single(cpu, __rdmsr_safe_on_cpu, &rv, 1);
-        rv.h = h;
+        *l = rv.l;
-        if (safe) {
+        *h = rv.h;
-                err = smp_call_function_single(cpu, __wrmsr_safe_on_cpu,
-                                               &rv, 1);
-                err = err ? err : rv.err;
-        } else {
-                err = smp_call_function_single(cpu, __wrmsr_on_cpu, &rv, 1);
-        }
-        return err;
-}
-int wrmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
+        return err ? err : rv.err;
-{
-        return _wrmsr_on_cpu(cpu, msr_no, l, h, 0);
 }
-int rdmsr_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h)
-{
-        return _rdmsr_on_cpu(cpu, msr_no, l, h, 0);
-}
-/* These "safe" variants are slower and should be used when the target MSR
-   may not actually exist. */
 int wrmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 l, u32 h)
 {
-        return _wrmsr_on_cpu(cpu, msr_no, l, h, 1);
+        int err;
-}
+        struct msr_info rv;
-int rdmsr_safe_on_cpu(unsigned int cpu, u32 msr_no, u32 *l, u32 *h)
+        rv.msr_no = msr_no;
-{
+        rv.l = l;
-        return _rdmsr_on_cpu(cpu, msr_no, l, h, 1);
+        rv.h = h;
+        err = smp_call_function_single(cpu, __wrmsr_safe_on_cpu, &rv, 1);
+        return err ? err : rv.err;
 }
 EXPORT_SYMBOL(rdmsr_on_cpu);
diff --git a/arch/x86/lib/string_32.c b/arch/x86/lib/string_32.c
index 94972e7c094d..82004d2bf05e 100644
--- a/arch/x86/lib/string_32.c
+++ b/arch/x86/lib/string_32.c
@@ -22,7 +22,7 @@ char *strcpy(char *dest, const char *src)
                "testb %%al,%%al\n\t"
                "jne 1b"
                : "=&S" (d0), "=&D" (d1), "=&a" (d2)
-                :"0" (src), "1" (dest) : "memory");
+                : "0" (src), "1" (dest) : "memory");
        return dest;
 }
 EXPORT_SYMBOL(strcpy);
@@ -42,7 +42,7 @@ char *strncpy(char *dest, const char *src, size_t count)
                "stosb\n"
                "2:"
                : "=&S" (d0), "=&D" (d1), "=&c" (d2), "=&a" (d3)
-                :"0" (src), "1" (dest), "2" (count) : "memory");
+                : "0" (src), "1" (dest), "2" (count) : "memory");
        return dest;
 }
 EXPORT_SYMBOL(strncpy);
@@ -60,7 +60,7 @@ char *strcat(char *dest, const char *src)
                "testb %%al,%%al\n\t"
                "jne 1b"
                : "=&S" (d0), "=&D" (d1), "=&a" (d2), "=&c" (d3)
-                : "0" (src), "1" (dest), "2" (0), "3" (0xffffffffu): "memory");
+                : "0" (src), "1" (dest), "2" (0), "3" (0xffffffffu) : "memory");
        return dest;
 }
 EXPORT_SYMBOL(strcat);
@@ -105,9 +105,9 @@ int strcmp(const char *cs, const char *ct)
                "2:\tsbbl %%eax,%%eax\n\t"
                "orb $1,%%al\n"
                "3:"
-                :"=a" (res), "=&S" (d0), "=&D" (d1)
+                : "=a" (res), "=&S" (d0), "=&D" (d1)
-                :"1" (cs), "2" (ct)
+                : "1" (cs), "2" (ct)
-                :"memory");
+                : "memory");
        return res;
 }
 EXPORT_SYMBOL(strcmp);
@@ -130,9 +130,9 @@ int strncmp(const char *cs, const char *ct, size_t count)
                "3:\tsbbl %%eax,%%eax\n\t"
                "orb $1,%%al\n"
                "4:"
-                :"=a" (res), "=&S" (d0), "=&D" (d1), "=&c" (d2)
+                : "=a" (res), "=&S" (d0), "=&D" (d1), "=&c" (d2)
-                :"1" (cs), "2" (ct), "3" (count)
+                : "1" (cs), "2" (ct), "3" (count)
-                :"memory");
+                : "memory");
        return res;
 }
 EXPORT_SYMBOL(strncmp);
@@ -152,9 +152,9 @@ char *strchr(const char *s, int c)
                "movl $1,%1\n"
                "2:\tmovl %1,%0\n\t"
                "decl %0"
-                :"=a" (res), "=&S" (d0)
+                : "=a" (res), "=&S" (d0)
-                :"1" (s), "0" (c)
+                : "1" (s), "0" (c)
-                :"memory");
+                : "memory");
        return res;
 }
 EXPORT_SYMBOL(strchr);
@@ -169,9 +169,9 @@ size_t strlen(const char *s)
                "scasb\n\t"
                "notl %0\n\t"
                "decl %0"
-                :"=c" (res), "=&D" (d0)
+                : "=c" (res), "=&D" (d0)
-                :"1" (s), "a" (0), "0" (0xffffffffu)
+                : "1" (s), "a" (0), "0" (0xffffffffu)
-                :"memory");
+                : "memory");
        return res;
 }
 EXPORT_SYMBOL(strlen);
@@ -189,9 +189,9 @@ void *memchr(const void *cs, int c, size_t count)
                "je 1f\n\t"
                "movl $1,%0\n"
                "1:\tdecl %0"
-                :"=D" (res), "=&c" (d0)
+                : "=D" (res), "=&c" (d0)
-                :"a" (c), "0" (cs), "1" (count)
+                : "a" (c), "0" (cs), "1" (count)
-                :"memory");
+                : "memory");
        return res;
 }
 EXPORT_SYMBOL(memchr);
@@ -228,9 +228,9 @@ size_t strnlen(const char *s, size_t count)
                "cmpl $-1,%1\n\t"
                "jne 1b\n"
                "3:\tsubl %2,%0"
-                :"=a" (res), "=&d" (d0)
+                : "=a" (res), "=&d" (d0)
-                :"c" (s), "1" (count)
+                : "c" (s), "1" (count)
-                :"memory");
+                : "memory");
        return res;
 }
 EXPORT_SYMBOL(strnlen);
diff --git a/arch/x86/lib/strstr_32.c b/arch/x86/lib/strstr_32.c
index 42e8a50303f3..8e2d55f754bf 100644
--- a/arch/x86/lib/strstr_32.c
+++ b/arch/x86/lib/strstr_32.c
@@ -23,9 +23,9 @@ __asm__ __volatile__(
        "jne 1b\n\t"
        "xorl %%eax,%%eax\n\t"
        "2:"
-        :"=a" (__res), "=&c" (d0), "=&S" (d1)
+        : "=a" (__res), "=&c" (d0), "=&S" (d1)
-        :"0" (0), "1" (0xffffffff), "2" (cs), "g" (ct)
+        : "0" (0), "1" (0xffffffff), "2" (cs), "g" (ct)
-        :"dx", "di");
+        : "dx", "di");
 return __res;
 }
diff --git a/arch/x86/mach-default/setup.c b/arch/x86/mach-default/setup.c
index 3d317836be9e..3f2cf11f201a 100644
--- a/arch/x86/mach-default/setup.c
+++ b/arch/x86/mach-default/setup.c
@@ -10,13 +10,15 @@
 #include <asm/e820.h>
 #include <asm/setup.h>
+#include <mach_ipi.h>
 #ifdef CONFIG_HOTPLUG_CPU
 #define DEFAULT_SEND_IPI        (1)
 #else
 #define DEFAULT_SEND_IPI        (0)
 #endif
-int no_broadcast=DEFAULT_SEND_IPI;
+int no_broadcast = DEFAULT_SEND_IPI;
 /**
 * pre_intr_init_hook - initialisation prior to setting up interrupt vectors
diff --git a/arch/x86/mm/discontig_32.c b/arch/x86/mm/discontig_32.c
index 62fa440678d8..847c164725f4 100644
--- a/arch/x86/mm/discontig_32.c
+++ b/arch/x86/mm/discontig_32.c
@@ -328,7 +328,7 @@ void __init initmem_init(unsigned long start_pfn,
        get_memcfg_numa();
-        kva_pages = round_up(calculate_numa_remap_pages(), PTRS_PER_PTE);
+        kva_pages = roundup(calculate_numa_remap_pages(), PTRS_PER_PTE);
        kva_target_pfn = round_down(max_low_pfn - kva_pages, PTRS_PER_PTE);
        do {
diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
index a20d1fa64b4e..e7277cbcfb40 100644
--- a/arch/x86/mm/dump_pagetables.c
+++ b/arch/x86/mm/dump_pagetables.c
@@ -148,8 +148,8 @@ static void note_page(struct seq_file *m, struct pg_state *st,
         * we have now. "break" is either changing perms, levels or
         * address space marker.
         */
-        prot = pgprot_val(new_prot) & ~(PTE_PFN_MASK);
+        prot = pgprot_val(new_prot) & PTE_FLAGS_MASK;
-        cur = pgprot_val(st->current_prot) & ~(PTE_PFN_MASK);
+        cur = pgprot_val(st->current_prot) & PTE_FLAGS_MASK;
        if (!st->level) {
                /* First entry */
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 455f3fe67b42..8f92cac4e6db 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -35,6 +35,7 @@
 #include <asm/tlbflush.h>
 #include <asm/proto.h>
 #include <asm-generic/sections.h>
+#include <asm/traps.h>
 /*
 * Page fault error code bits
@@ -357,8 +358,6 @@ static int is_errata100(struct pt_regs *regs, unsigned long address)
        return 0;
 }
-void do_invalid_op(struct pt_regs *, unsigned long);
 static int is_f00f_bug(struct pt_regs *regs, unsigned long address)
 {
 #ifdef CONFIG_X86_F00F_BUG
diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
index 60ec1d08ff24..6b9a9358b330 100644
--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -47,6 +47,7 @@
 #include <asm/paravirt.h>
 #include <asm/setup.h>
 #include <asm/cacheflush.h>
+#include <asm/smp.h>
 unsigned int __VMALLOC_RESERVE = 128 << 20;
diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c
index d3746efb060d..770536ebf7e9 100644
--- a/arch/x86/mm/init_64.c
+++ b/arch/x86/mm/init_64.c
@@ -225,7 +225,7 @@ void __init init_extra_mapping_uc(unsigned long phys, unsigned long size)
 void __init cleanup_highmap(void)
 {
        unsigned long vaddr = __START_KERNEL_map;
-        unsigned long end = round_up((unsigned long)_end, PMD_SIZE) - 1;
+        unsigned long end = roundup((unsigned long)_end, PMD_SIZE) - 1;
        pmd_t *pmd = level2_kernel_pgt;
        pmd_t *last_pmd = pmd + PTRS_PER_PMD;
@@ -451,14 +451,14 @@ static void __init find_early_table_space(unsigned long end)
        unsigned long puds, pmds, ptes, tables, start;
        puds = (end + PUD_SIZE - 1) >> PUD_SHIFT;
-        tables = round_up(puds * sizeof(pud_t), PAGE_SIZE);
+        tables = roundup(puds * sizeof(pud_t), PAGE_SIZE);
        if (direct_gbpages) {
                unsigned long extra;
                extra = end - ((end>>PUD_SHIFT) << PUD_SHIFT);
                pmds = (extra + PMD_SIZE - 1) >> PMD_SHIFT;
        } else
                pmds = (end + PMD_SIZE - 1) >> PMD_SHIFT;
-        tables += round_up(pmds * sizeof(pmd_t), PAGE_SIZE);
+        tables += roundup(pmds * sizeof(pmd_t), PAGE_SIZE);
        if (cpu_has_pse) {
                unsigned long extra;
@@ -466,7 +466,7 @@ static void __init find_early_table_space(unsigned long end)
                ptes = (extra + PAGE_SIZE - 1) >> PAGE_SHIFT;
        } else
                ptes = (end + PAGE_SIZE - 1) >> PAGE_SHIFT;
-        tables += round_up(ptes * sizeof(pte_t), PAGE_SIZE);
+        tables += roundup(ptes * sizeof(pte_t), PAGE_SIZE);
        /*
         * RED-PEN putting page tables only on node 0 could
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index d4b6e6a29ae3..cac6da54203b 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -421,7 +421,7 @@ void unxlate_dev_mem_ptr(unsigned long phys, void *addr)
        return;
 }
-int __initdata early_ioremap_debug;
+static int __initdata early_ioremap_debug;
 static int __init early_ioremap_debug_setup(char *str)
 {
@@ -547,7 +547,7 @@ static inline void __init early_clear_fixmap(enum fixed_addresses idx)
 }
-int __initdata early_ioremap_nested;
+static int __initdata early_ioremap_nested;
 static int __init check_early_ioremap_leak(void)
 {
diff --git a/arch/x86/mm/numa_64.c b/arch/x86/mm/numa_64.c
index a4dd793d6003..cebcbf152d46 100644
--- a/arch/x86/mm/numa_64.c
+++ b/arch/x86/mm/numa_64.c
@@ -79,7 +79,7 @@ static int __init allocate_cachealigned_memnodemap(void)
                return 0;
        addr = 0x8000;
-        nodemap_size = round_up(sizeof(s16) * memnodemapsize, L1_CACHE_BYTES);
+        nodemap_size = roundup(sizeof(s16) * memnodemapsize, L1_CACHE_BYTES);
        nodemap_addr = find_e820_area(addr, max_pfn<<PAGE_SHIFT,
                                      nodemap_size, L1_CACHE_BYTES);
        if (nodemap_addr == -1UL) {
@@ -176,10 +176,10 @@ void __init setup_node_bootmem(int nodeid, unsigned long start,
        unsigned long start_pfn, last_pfn, bootmap_pages, bootmap_size;
        unsigned long bootmap_start, nodedata_phys;
        void *bootmap;
-        const int pgdat_size = round_up(sizeof(pg_data_t), PAGE_SIZE);
+        const int pgdat_size = roundup(sizeof(pg_data_t), PAGE_SIZE);
        int nid;
-        start = round_up(start, ZONE_ALIGN);
+        start = roundup(start, ZONE_ALIGN);
        printk(KERN_INFO "Bootmem setup node %d %016lx-%016lx\n", nodeid,
               start, end);
@@ -210,9 +210,9 @@ void __init setup_node_bootmem(int nodeid, unsigned long start,
        bootmap_pages = bootmem_bootmap_pages(last_pfn - start_pfn);
        nid = phys_to_nid(nodedata_phys);
        if (nid == nodeid)
-                bootmap_start = round_up(nodedata_phys + pgdat_size, PAGE_SIZE);
+                bootmap_start = roundup(nodedata_phys + pgdat_size, PAGE_SIZE);
        else
-                bootmap_start = round_up(start, PAGE_SIZE);
+                bootmap_start = roundup(start, PAGE_SIZE);
        /*
         * SMP_CACHE_BYTES could be enough, but init_bootmem_node like
         * to use that to align to PAGE_SIZE
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 62c1eefcce05..898fad617abe 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -84,7 +84,7 @@ static inline unsigned long highmap_start_pfn(void)
 static inline unsigned long highmap_end_pfn(void)
 {
-        return __pa(round_up((unsigned long)_end, PMD_SIZE)) >> PAGE_SHIFT;
+        return __pa(roundup((unsigned long)_end, PMD_SIZE)) >> PAGE_SHIFT;
 }
 #endif
diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c
index d50302774fe2..86f2ffc43c3d 100644
--- a/arch/x86/mm/pgtable.c
+++ b/arch/x86/mm/pgtable.c
@@ -63,10 +63,8 @@ static inline void pgd_list_del(pgd_t *pgd)
 #define UNSHARED_PTRS_PER_PGD                           \
        (SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
-static void pgd_ctor(void *p)
+static void pgd_ctor(pgd_t *pgd)
 {
-        pgd_t *pgd = p;
        /* If the pgd points to a shared pagetable level (either the
           ptes in non-PAE, or shared PMD in PAE), then just copy the
           references from swapper_pg_dir. */
@@ -87,7 +85,7 @@ static void pgd_ctor(void *p)
                pgd_list_add(pgd);
 }
-static void pgd_dtor(void *pgd)
+static void pgd_dtor(pgd_t *pgd)
 {
        unsigned long flags; /* can be called from interrupt context */
diff --git a/arch/x86/mm/pgtable_32.c b/arch/x86/mm/pgtable_32.c
index cab0abbd1ebe..0951db9ee519 100644
--- a/arch/x86/mm/pgtable_32.c
+++ b/arch/x86/mm/pgtable_32.c
@@ -123,7 +123,8 @@ static int __init parse_vmalloc(char *arg)
        if (!arg)
                return -EINVAL;
-        __VMALLOC_RESERVE = memparse(arg, &arg);
+        /* Add VMALLOC_OFFSET to the parsed value due to vm area guard hole*/
+        __VMALLOC_RESERVE = memparse(arg, &arg) + VMALLOC_OFFSET;
        return 0;
 }
 early_param("vmalloc", parse_vmalloc);
diff --git a/arch/x86/oprofile/op_model_p4.c b/arch/x86/oprofile/op_model_p4.c
index 56b4757a1f47..43ac5af338d8 100644
--- a/arch/x86/oprofile/op_model_p4.c
+++ b/arch/x86/oprofile/op_model_p4.c
@@ -10,11 +10,12 @@
 #include <linux/oprofile.h>
 #include <linux/smp.h>
+#include <linux/ptrace.h>
+#include <linux/nmi.h>
 #include <asm/msr.h>
-#include <asm/ptrace.h>
 #include <asm/fixmap.h>
 #include <asm/apic.h>
-#include <asm/nmi.h>
 #include "op_x86_model.h"
 #include "op_counter.h"
@@ -40,7 +41,7 @@ static unsigned int num_controls = NUM_CONTROLS_NON_HT;
 static inline void setup_num_counters(void)
 {
 #ifdef CONFIG_SMP
-        if (smp_num_siblings == 2){
+        if (smp_num_siblings == 2) {
                num_counters = NUM_COUNTERS_HT2;
                num_controls = NUM_CONTROLS_HT2;
        }
@@ -86,7 +87,7 @@ struct p4_event_binding {
 #define CTR_FLAME_2    (1 << 6)
 #define CTR_IQ_5       (1 << 7)
-static struct p4_counter_binding p4_counters [NUM_COUNTERS_NON_HT] = {
+static struct p4_counter_binding p4_counters[NUM_COUNTERS_NON_HT] = {
        { CTR_BPU_0,   MSR_P4_BPU_PERFCTR0,   MSR_P4_BPU_CCCR0 },
        { CTR_MS_0,    MSR_P4_MS_PERFCTR0,    MSR_P4_MS_CCCR0 },
        { CTR_FLAME_0, MSR_P4_FLAME_PERFCTR0, MSR_P4_FLAME_CCCR0 },
@@ -97,32 +98,32 @@ static struct p4_counter_binding p4_counters [NUM_COUNTERS_NON_HT] = {
        { CTR_IQ_5,    MSR_P4_IQ_PERFCTR5,    MSR_P4_IQ_CCCR5 }
 };
-#define NUM_UNUSED_CCCRS        NUM_CCCRS_NON_HT - NUM_COUNTERS_NON_HT
+#define NUM_UNUSED_CCCRS (NUM_CCCRS_NON_HT - NUM_COUNTERS_NON_HT)
 /* p4 event codes in libop/op_event.h are indices into this table. */
 static struct p4_event_binding p4_events[NUM_EVENTS] = {
-        
        { /* BRANCH_RETIRED */
-                0x05, 0x06, 
+                0x05, 0x06,
                { {CTR_IQ_4, MSR_P4_CRU_ESCR2},
                  {CTR_IQ_5, MSR_P4_CRU_ESCR3} }
        },
-        
        { /* MISPRED_BRANCH_RETIRED */
-                0x04, 0x03, 
+                0x04, 0x03,
                { { CTR_IQ_4, MSR_P4_CRU_ESCR0},
                  { CTR_IQ_5, MSR_P4_CRU_ESCR1} }
        },
-        
        { /* TC_DELIVER_MODE */
                0x01, 0x01,
-                { { CTR_MS_0, MSR_P4_TC_ESCR0},  
+                { { CTR_MS_0, MSR_P4_TC_ESCR0},
                  { CTR_MS_2, MSR_P4_TC_ESCR1} }
        },
-        
        { /* BPU_FETCH_REQUEST */
-                0x00, 0x03, 
+                0x00, 0x03,
                { { CTR_BPU_0, MSR_P4_BPU_ESCR0},
                  { CTR_BPU_2, MSR_P4_BPU_ESCR1} }
        },
@@ -146,7 +147,7 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
        },
        { /* LOAD_PORT_REPLAY */
-                0x02, 0x04, 
+                0x02, 0x04,
                { { CTR_FLAME_0, MSR_P4_SAAT_ESCR0},
                  { CTR_FLAME_2, MSR_P4_SAAT_ESCR1} }
        },
@@ -170,43 +171,43 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
        },
        { /* BSQ_CACHE_REFERENCE */
-                0x07, 0x0c, 
+                0x07, 0x0c,
                { { CTR_BPU_0, MSR_P4_BSU_ESCR0},
                  { CTR_BPU_2, MSR_P4_BSU_ESCR1} }
        },
        { /* IOQ_ALLOCATION */
-                0x06, 0x03, 
+                0x06, 0x03,
                { { CTR_BPU_0, MSR_P4_FSB_ESCR0},
                  { 0, 0 } }
        },
        { /* IOQ_ACTIVE_ENTRIES */
-                0x06, 0x1a, 
+                0x06, 0x1a,
                { { CTR_BPU_2, MSR_P4_FSB_ESCR1},
                  { 0, 0 } }
        },
        { /* FSB_DATA_ACTIVITY */
-                0x06, 0x17, 
+                0x06, 0x17,
                { { CTR_BPU_0, MSR_P4_FSB_ESCR0},
                  { CTR_BPU_2, MSR_P4_FSB_ESCR1} }
        },
        { /* BSQ_ALLOCATION */
-                0x07, 0x05, 
+                0x07, 0x05,
                { { CTR_BPU_0, MSR_P4_BSU_ESCR0},
                  { 0, 0 } }
        },
        { /* BSQ_ACTIVE_ENTRIES */
                0x07, 0x06,
-                { { CTR_BPU_2, MSR_P4_BSU_ESCR1 /* guess */},  
+                { { CTR_BPU_2, MSR_P4_BSU_ESCR1 /* guess */},
                  { 0, 0 } }
        },
        { /* X87_ASSIST */
-                0x05, 0x03, 
+                0x05, 0x03,
                { { CTR_IQ_4, MSR_P4_CRU_ESCR2},
                  { CTR_IQ_5, MSR_P4_CRU_ESCR3} }
        },
@@ -216,21 +217,21 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
-  
        { /* PACKED_SP_UOP */
-                0x01, 0x08, 
+                0x01, 0x08,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
-  
        { /* PACKED_DP_UOP */
-                0x01, 0x0c, 
+                0x01, 0x0c,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
        { /* SCALAR_SP_UOP */
-                0x01, 0x0a, 
+                0x01, 0x0a,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
@@ -242,31 +243,31 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
        },
        { /* 64BIT_MMX_UOP */
-                0x01, 0x02, 
+                0x01, 0x02,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
-  
        { /* 128BIT_MMX_UOP */
-                0x01, 0x1a, 
+                0x01, 0x1a,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
        { /* X87_FP_UOP */
-                0x01, 0x04, 
+                0x01, 0x04,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
-  
        { /* X87_SIMD_MOVES_UOP */
-                0x01, 0x2e, 
+                0x01, 0x2e,
                { { CTR_FLAME_0, MSR_P4_FIRM_ESCR0},
                  { CTR_FLAME_2, MSR_P4_FIRM_ESCR1} }
        },
-  
        { /* MACHINE_CLEAR */
-                0x05, 0x02, 
+                0x05, 0x02,
                { { CTR_IQ_4, MSR_P4_CRU_ESCR2},
                  { CTR_IQ_5, MSR_P4_CRU_ESCR3} }
        },
@@ -276,9 +277,9 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
                { { CTR_BPU_0, MSR_P4_FSB_ESCR0},
                  { CTR_BPU_2, MSR_P4_FSB_ESCR1} }
        },
-  
        { /* TC_MS_XFER */
-                0x00, 0x05, 
+                0x00, 0x05,
                { { CTR_MS_0, MSR_P4_MS_ESCR0},
                  { CTR_MS_2, MSR_P4_MS_ESCR1} }
        },
@@ -308,7 +309,7 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
        },
        { /* INSTR_RETIRED */
-                0x04, 0x02, 
+                0x04, 0x02,
                { { CTR_IQ_4, MSR_P4_CRU_ESCR0},
                  { CTR_IQ_5, MSR_P4_CRU_ESCR1} }
        },
@@ -319,14 +320,14 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
                  { CTR_IQ_5, MSR_P4_CRU_ESCR1} }
        },
-        { /* UOP_TYPE */    
+        { /* UOP_TYPE */
-                0x02, 0x02, 
+                0x02, 0x02,
                { { CTR_IQ_4, MSR_P4_RAT_ESCR0},
                  { CTR_IQ_5, MSR_P4_RAT_ESCR1} }
        },
        { /* RETIRED_MISPRED_BRANCH_TYPE */
-                0x02, 0x05, 
+                0x02, 0x05,
                { { CTR_MS_0, MSR_P4_TBPU_ESCR0},
                  { CTR_MS_2, MSR_P4_TBPU_ESCR1} }
        },
@@ -349,8 +350,8 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
 #define ESCR_SET_OS_1(escr, os) ((escr) |= (((os) & 1) << 1))
 #define ESCR_SET_EVENT_SELECT(escr, sel) ((escr) |= (((sel) & 0x3f) << 25))
 #define ESCR_SET_EVENT_MASK(escr, mask) ((escr) |= (((mask) & 0xffff) << 9))
-#define ESCR_READ(escr,high,ev,i) do {rdmsr(ev->bindings[(i)].escr_address, (escr), (high));} while (0)
+#define ESCR_READ(escr, high, ev, i) do {rdmsr(ev->bindings[(i)].escr_address, (escr), (high)); } while (0)
-#define ESCR_WRITE(escr,high,ev,i) do {wrmsr(ev->bindings[(i)].escr_address, (escr), (high));} while (0)
+#define ESCR_WRITE(escr, high, ev, i) do {wrmsr(ev->bindings[(i)].escr_address, (escr), (high)); } while (0)
 #define CCCR_RESERVED_BITS 0x38030FFF
 #define CCCR_CLEAR(cccr) ((cccr) &= CCCR_RESERVED_BITS)
@@ -360,15 +361,15 @@ static struct p4_event_binding p4_events[NUM_EVENTS] = {
 #define CCCR_SET_PMI_OVF_1(cccr) ((cccr) |= (1<<27))
 #define CCCR_SET_ENABLE(cccr) ((cccr) |= (1<<12))
 #define CCCR_SET_DISABLE(cccr) ((cccr) &= ~(1<<12))
-#define CCCR_READ(low, high, i) do {rdmsr(p4_counters[(i)].cccr_address, (low), (high));} while (0)
+#define CCCR_READ(low, high, i) do {rdmsr(p4_counters[(i)].cccr_address, (low), (high)); } while (0)
-#define CCCR_WRITE(low, high, i) do {wrmsr(p4_counters[(i)].cccr_address, (low), (high));} while (0)
+#define CCCR_WRITE(low, high, i) do {wrmsr(p4_counters[(i)].cccr_address, (low), (high)); } while (0)
 #define CCCR_OVF_P(cccr) ((cccr) & (1U<<31))
 #define CCCR_CLEAR_OVF(cccr) ((cccr) &= (~(1U<<31)))
-#define CTRL_IS_RESERVED(msrs,c) (msrs->controls[(c)].addr ? 1 : 0)
+#define CTRL_IS_RESERVED(msrs, c) (msrs->controls[(c)].addr ? 1 : 0)
-#define CTR_IS_RESERVED(msrs,c) (msrs->counters[(c)].addr ? 1 : 0)
+#define CTR_IS_RESERVED(msrs, c) (msrs->counters[(c)].addr ? 1 : 0)
-#define CTR_READ(l,h,i) do {rdmsr(p4_counters[(i)].counter_address, (l), (h));} while (0)
+#define CTR_READ(l, h, i) do {rdmsr(p4_counters[(i)].counter_address, (l), (h)); } while (0)
-#define CTR_WRITE(l,i) do {wrmsr(p4_counters[(i)].counter_address, -(u32)(l), -1);} while (0)
+#define CTR_WRITE(l, i) do {wrmsr(p4_counters[(i)].counter_address, -(u32)(l), -1); } while (0)
 #define CTR_OVERFLOW_P(ctr) (!((ctr) & 0x80000000))
@@ -380,7 +381,7 @@ static unsigned int get_stagger(void)
 #ifdef CONFIG_SMP
        int cpu = smp_processor_id();
        return (cpu != first_cpu(per_cpu(cpu_sibling_map, cpu)));
-#endif  
+#endif
        return 0;
 }
@@ -395,25 +396,23 @@ static unsigned long reset_value[NUM_COUNTERS_NON_HT];
 static void p4_fill_in_addresses(struct op_msrs * const msrs)
 {
-        unsigned int i; 
+        unsigned int i;
        unsigned int addr, cccraddr, stag;
        setup_num_counters();
        stag = get_stagger();
        /* initialize some registers */
-        for (i = 0; i < num_counters; ++i) {
+        for (i = 0; i < num_counters; ++i)
                msrs->counters[i].addr = 0;
-        }
+        for (i = 0; i < num_controls; ++i)
-        for (i = 0; i < num_controls; ++i) {
                msrs->controls[i].addr = 0;
-        }
-        
        /* the counter & cccr registers we pay attention to */
        for (i = 0; i < num_counters; ++i) {
                addr = p4_counters[VIRT_CTR(stag, i)].counter_address;
                cccraddr = p4_counters[VIRT_CTR(stag, i)].cccr_address;
-                if (reserve_perfctr_nmi(addr)){
+                if (reserve_perfctr_nmi(addr)) {
                        msrs->counters[i].addr = addr;
                        msrs->controls[i].addr = cccraddr;
                }
@@ -447,22 +446,22 @@ static void p4_fill_in_addresses(struct op_msrs * const msrs)
                if (reserve_evntsel_nmi(addr))
                        msrs->controls[i].addr = addr;
        }
-        
        for (addr = MSR_P4_MS_ESCR0 + stag;
-             addr <= MSR_P4_TC_ESCR1; ++i, addr += addr_increment()) { 
+             addr <= MSR_P4_TC_ESCR1; ++i, addr += addr_increment()) {
                if (reserve_evntsel_nmi(addr))
                        msrs->controls[i].addr = addr;
        }
-        
        for (addr = MSR_P4_IX_ESCR0 + stag;
-             addr <= MSR_P4_CRU_ESCR3; ++i, addr += addr_increment()) { 
+             addr <= MSR_P4_CRU_ESCR3; ++i, addr += addr_increment()) {
                if (reserve_evntsel_nmi(addr))
                        msrs->controls[i].addr = addr;
        }
        /* there are 2 remaining non-contiguously located ESCRs */
-        if (num_counters == NUM_COUNTERS_NON_HT) {              
+        if (num_counters == NUM_COUNTERS_NON_HT) {
                /* standard non-HT CPUs handle both remaining ESCRs*/
                if (reserve_evntsel_nmi(MSR_P4_CRU_ESCR5))
                        msrs->controls[i++].addr = MSR_P4_CRU_ESCR5;
@@ -498,20 +497,20 @@ static void pmc_setup_one_p4_counter(unsigned int ctr)
        unsigned int stag;
        stag = get_stagger();
-        
        /* convert from counter *number* to counter *bit* */
        counter_bit = 1 << VIRT_CTR(stag, ctr);
-        
        /* find our event binding structure. */
        if (counter_config[ctr].event <= 0 || counter_config[ctr].event > NUM_EVENTS) {
-                printk(KERN_ERR 
+                printk(KERN_ERR
-                       "oprofile: P4 event code 0x%lx out of range\n", 
+                       "oprofile: P4 event code 0x%lx out of range\n",
                       counter_config[ctr].event);
                return;
        }
-        
        ev = &(p4_events[counter_config[ctr].event - 1]);
-        
        for (i = 0; i < maxbind; i++) {
                if (ev->bindings[i].virt_counter & counter_bit) {
@@ -526,25 +525,24 @@ static void pmc_setup_one_p4_counter(unsigned int ctr)
                                ESCR_SET_OS_1(escr, counter_config[ctr].kernel);
                        }
                        ESCR_SET_EVENT_SELECT(escr, ev->event_select);
-                        ESCR_SET_EVENT_MASK(escr, counter_config[ctr].unit_mask);                       
+                        ESCR_SET_EVENT_MASK(escr, counter_config[ctr].unit_mask);
                        ESCR_WRITE(escr, high, ev, i);
-                       
                        /* modify CCCR */
                        CCCR_READ(cccr, high, VIRT_CTR(stag, ctr));
                        CCCR_CLEAR(cccr);
                        CCCR_SET_REQUIRED_BITS(cccr);
                        CCCR_SET_ESCR_SELECT(cccr, ev->escr_select);
-                        if (stag == 0) {
+                        if (stag == 0)
                                CCCR_SET_PMI_OVF_0(cccr);
-                        } else {
+                        else
                                CCCR_SET_PMI_OVF_1(cccr);
-                        }
                        CCCR_WRITE(cccr, high, VIRT_CTR(stag, ctr));
                        return;
                }
        }
-        printk(KERN_ERR 
+        printk(KERN_ERR
               "oprofile: P4 event code 0x%lx no binding, stag %d ctr %d\n",
               counter_config[ctr].event, stag, ctr);
 }
@@ -559,14 +557,14 @@ static void p4_setup_ctrs(struct op_msrs const * const msrs)
        stag = get_stagger();
        rdmsr(MSR_IA32_MISC_ENABLE, low, high);
-        if (! MISC_PMC_ENABLED_P(low)) {
+        if (!MISC_PMC_ENABLED_P(low)) {
                printk(KERN_ERR "oprofile: P4 PMC not available\n");
                return;
        }
        /* clear the cccrs we will use */
        for (i = 0 ; i < num_counters ; i++) {
-                if (unlikely(!CTRL_IS_RESERVED(msrs,i)))
+                if (unlikely(!CTRL_IS_RESERVED(msrs, i)))
                        continue;
                rdmsr(p4_counters[VIRT_CTR(stag, i)].cccr_address, low, high);
                CCCR_CLEAR(low);
@@ -576,14 +574,14 @@ static void p4_setup_ctrs(struct op_msrs const * const msrs)
        /* clear all escrs (including those outside our concern) */
        for (i = num_counters; i < num_controls; i++) {
-                if (unlikely(!CTRL_IS_RESERVED(msrs,i)))
+                if (unlikely(!CTRL_IS_RESERVED(msrs, i)))
                        continue;
                wrmsr(msrs->controls[i].addr, 0, 0);
        }
        /* setup all counters */
        for (i = 0 ; i < num_counters ; ++i) {
-                if ((counter_config[i].enabled) && (CTRL_IS_RESERVED(msrs,i))) {
+                if ((counter_config[i].enabled) && (CTRL_IS_RESERVED(msrs, i))) {
                        reset_value[i] = counter_config[i].count;
                        pmc_setup_one_p4_counter(i);
                        CTR_WRITE(counter_config[i].count, VIRT_CTR(stag, i));
@@ -603,11 +601,11 @@ static int p4_check_ctrs(struct pt_regs * const regs,
        stag = get_stagger();
        for (i = 0; i < num_counters; ++i) {
-                
-                if (!reset_value[i]) 
+                if (!reset_value[i])
                        continue;
-                /* 
+                /*
                 * there is some eccentricity in the hardware which
                 * requires that we perform 2 extra corrections:
                 *
@@ -616,24 +614,24 @@ static int p4_check_ctrs(struct pt_regs * const regs,
                 *
                 * - write the counter back twice to ensure it gets
                 *   updated properly.
-                 * 
+                 *
                 * the former seems to be related to extra NMIs happening
                 * during the current NMI; the latter is reported as errata
                 * N15 in intel doc 249199-029, pentium 4 specification
                 * update, though their suggested work-around does not
                 * appear to solve the problem.
                 */
-                
                real = VIRT_CTR(stag, i);
                CCCR_READ(low, high, real);
-                CTR_READ(ctr, high, real);
+                CTR_READ(ctr, high, real);
                if (CCCR_OVF_P(low) || CTR_OVERFLOW_P(ctr)) {
                        oprofile_add_sample(regs, i);
-                        CTR_WRITE(reset_value[i], real);
+                        CTR_WRITE(reset_value[i], real);
                        CCCR_CLEAR_OVF(low);
                        CCCR_WRITE(low, high, real);
-                        CTR_WRITE(reset_value[i], real);
+                        CTR_WRITE(reset_value[i], real);
                }
        }
@@ -683,15 +681,16 @@ static void p4_shutdown(struct op_msrs const * const msrs)
        int i;
        for (i = 0 ; i < num_counters ; ++i) {
-                if (CTR_IS_RESERVED(msrs,i))
+                if (CTR_IS_RESERVED(msrs, i))
                        release_perfctr_nmi(msrs->counters[i].addr);
        }
-        /* some of the control registers are specially reserved in
+        /*
+         * some of the control registers are specially reserved in
         * conjunction with the counter registers (hence the starting offset).
         * This saves a few bits.
         */
        for (i = num_counters ; i < num_controls ; ++i) {
-                if (CTRL_IS_RESERVED(msrs,i))
+                if (CTRL_IS_RESERVED(msrs, i))
                        release_evntsel_nmi(msrs->controls[i].addr);
        }
 }
diff --git a/arch/x86/pci/amd_bus.c b/arch/x86/pci/amd_bus.c
index 6a0fca78c362..22e057665e55 100644
--- a/arch/x86/pci/amd_bus.c
+++ b/arch/x86/pci/amd_bus.c
@@ -580,7 +580,7 @@ static int __cpuinit amd_cpu_notify(struct notifier_block *self,
                                    unsigned long action, void *hcpu)
 {
        int cpu = (long)hcpu;
-        switch(action) {
+        switch (action) {
        case CPU_ONLINE:
        case CPU_ONLINE_FROZEN:
                smp_call_function_single(cpu, enable_pci_io_ecs, NULL, 0);
diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
index 8e077185e185..006599db0dc7 100644
--- a/arch/x86/pci/irq.c
+++ b/arch/x86/pci/irq.c
@@ -1043,35 +1043,44 @@ static void __init pcibios_fixup_irqs(void)
                if (io_apic_assign_pci_irqs) {
                        int irq;
-                        if (pin) {
+                        if (!pin)
-                                /*
+                                continue;
-                                 * interrupt pins are numbered starting
-                                 * from 1
+                        /*
-                                 */
+                         * interrupt pins are numbered starting from 1
-                                pin--;
+                         */
-                                irq = IO_APIC_get_PCI_irq_vector(dev->bus->number,
+                        pin--;
-                                        PCI_SLOT(dev->devfn), pin);
+                        irq = IO_APIC_get_PCI_irq_vector(dev->bus->number,
-        /*
+                                PCI_SLOT(dev->devfn), pin);
-         * Busses behind bridges are typically not listed in the MP-table.
+                        /*
-         * In this case we have to look up the IRQ based on the parent bus,
+                         * Busses behind bridges are typically not listed in the
-         * parent slot, and pin number. The SMP code detects such bridged
+                         * MP-table.  In this case we have to look up the IRQ
-         * busses itself so we should get into this branch reliably.
+                         * based on the parent bus, parent slot, and pin number.
-         */
+                         * The SMP code detects such bridged busses itself so we
-                                if (irq < 0 && dev->bus->parent) { /* go back to the bridge */
+                         * should get into this branch reliably.
-                                        struct pci_dev *bridge = dev->bus->self;
+                         */
+                        if (irq < 0 && dev->bus->parent) {
-                                        pin = (pin + PCI_SLOT(dev->devfn)) % 4;
+                                /* go back to the bridge */
-                                        irq = IO_APIC_get_PCI_irq_vector(bridge->bus->number,
+                                struct pci_dev *bridge = dev->bus->self;
-                                                        PCI_SLOT(bridge->devfn), pin);
+                                int bus;
-                                        if (irq >= 0)
-                                                dev_warn(&dev->dev, "using bridge %s INT %c to get IRQ %d\n",
+                                pin = (pin + PCI_SLOT(dev->devfn)) % 4;
-                                                         pci_name(bridge),
+                                bus = bridge->bus->number;
-                                                         'A' + pin, irq);
+                                irq = IO_APIC_get_PCI_irq_vector(bus,
-                                }
+                                                PCI_SLOT(bridge->devfn), pin);
-                                if (irq >= 0) {
+                                if (irq >= 0)
-                                        dev_info(&dev->dev, "PCI->APIC IRQ transform: INT %c -> IRQ %d\n", 'A' + pin, irq);
+                                        dev_warn(&dev->dev,
-                                        dev->irq = irq;
+                                                "using bridge %s INT %c to "
-                                }
+                                                        "get IRQ %d\n",
+                                                 pci_name(bridge),
+                                                 'A' + pin, irq);
+                        }
+                        if (irq >= 0) {
+                                dev_info(&dev->dev,
+                                        "PCI->APIC IRQ transform: INT %c "
+                                                "-> IRQ %d\n",
+                                        'A' + pin, irq);
+                                dev->irq = irq;
                        }
                }
 #endif
diff --git a/arch/x86/power/hibernate_asm_32.S b/arch/x86/power/hibernate_asm_32.S
index 4fc7e872c85e..d1e9b53f9d33 100644
--- a/arch/x86/power/hibernate_asm_32.S
+++ b/arch/x86/power/hibernate_asm_32.S
@@ -1,5 +1,3 @@
-.text
 /*
 * This may not use any stack, nor any variable that is not "NoSave":
 *
@@ -12,17 +10,18 @@
 #include <asm/segment.h>
 #include <asm/page.h>
 #include <asm/asm-offsets.h>
+#include <asm/processor-flags.h>
-        .text
+.text
 ENTRY(swsusp_arch_suspend)
        movl %esp, saved_context_esp
        movl %ebx, saved_context_ebx
        movl %ebp, saved_context_ebp
        movl %esi, saved_context_esi
        movl %edi, saved_context_edi
-        pushfl ; popl saved_context_eflags
+        pushfl
+        popl saved_context_eflags
        call swsusp_save
        ret
@@ -59,7 +58,7 @@ done:
        movl    mmu_cr4_features, %ecx
        jecxz   1f      # cr4 Pentium and higher, skip if zero
        movl    %ecx, %edx
-        andl    $~(1<<7), %edx;  # PGE
+        andl    $~(X86_CR4_PGE), %edx
        movl    %edx, %cr4;  # turn off PGE
 1:
        movl    %cr3, %eax;  # flush TLB
@@ -74,7 +73,8 @@ done:
        movl saved_context_esi, %esi
        movl saved_context_edi, %edi
-        pushl saved_context_eflags ; popfl
+        pushl saved_context_eflags
+        popfl
        xorl    %eax, %eax
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index a4e201b47f64..7dcd321a0508 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -812,7 +812,7 @@ static int xen_write_msr_safe(unsigned int msr, unsigned low, unsigned high)
 /* Early in boot, while setting up the initial pagetable, assume
   everything is pinned. */
-static __init void xen_alloc_pte_init(struct mm_struct *mm, u32 pfn)
+static __init void xen_alloc_pte_init(struct mm_struct *mm, unsigned long pfn)
 {
 #ifdef CONFIG_FLATMEM
        BUG_ON(mem_map);        /* should only be used early */
@@ -822,7 +822,7 @@ static __init void xen_alloc_pte_init(struct mm_struct *mm, u32 pfn)
 /* Early release_pte assumes that all pts are pinned, since there's
   only init_mm and anything attached to that is pinned. */
-static void xen_release_pte_init(u32 pfn)
+static void xen_release_pte_init(unsigned long pfn)
 {
        make_lowmem_page_readwrite(__va(PFN_PHYS(pfn)));
 }
@@ -838,7 +838,7 @@ static void pin_pagetable_pfn(unsigned cmd, unsigned long pfn)
 /* This needs to make sure the new pte page is pinned iff its being
   attached to a pinned pagetable. */
-static void xen_alloc_ptpage(struct mm_struct *mm, u32 pfn, unsigned level)
+static void xen_alloc_ptpage(struct mm_struct *mm, unsigned long pfn, unsigned level)
 {
        struct page *page = pfn_to_page(pfn);
@@ -856,12 +856,12 @@ static void xen_alloc_ptpage(struct mm_struct *mm, u32 pfn, unsigned level)
        }
 }
-static void xen_alloc_pte(struct mm_struct *mm, u32 pfn)
+static void xen_alloc_pte(struct mm_struct *mm, unsigned long pfn)
 {
        xen_alloc_ptpage(mm, pfn, PT_PTE);
 }
-static void xen_alloc_pmd(struct mm_struct *mm, u32 pfn)
+static void xen_alloc_pmd(struct mm_struct *mm, unsigned long pfn)
 {
        xen_alloc_ptpage(mm, pfn, PT_PMD);
 }
@@ -909,7 +909,7 @@ static void xen_pgd_free(struct mm_struct *mm, pgd_t *pgd)
 }
 /* This should never happen until we're OK to use struct page */
-static void xen_release_ptpage(u32 pfn, unsigned level)
+static void xen_release_ptpage(unsigned long pfn, unsigned level)
 {
        struct page *page = pfn_to_page(pfn);
@@ -923,23 +923,23 @@ static void xen_release_ptpage(u32 pfn, unsigned level)
        }
 }
-static void xen_release_pte(u32 pfn)
+static void xen_release_pte(unsigned long pfn)
 {
        xen_release_ptpage(pfn, PT_PTE);
 }
-static void xen_release_pmd(u32 pfn)
+static void xen_release_pmd(unsigned long pfn)
 {
        xen_release_ptpage(pfn, PT_PMD);
 }
 #if PAGETABLE_LEVELS == 4
-static void xen_alloc_pud(struct mm_struct *mm, u32 pfn)
+static void xen_alloc_pud(struct mm_struct *mm, unsigned long pfn)
 {
        xen_alloc_ptpage(mm, pfn, PT_PUD);
 }
-static void xen_release_pud(u32 pfn)
+static void xen_release_pud(unsigned long pfn)
 {
        xen_release_ptpage(pfn, PT_PUD);
 }